Privacy Policy

Solosocial (https://social.solosocial.net) is a web application that helps businesses plan, create, schedule and publish content on their own social media accounts (Facebook, Instagram, Threads, TikTok, YouTube, Bluesky, Mastodon, LinkedIn, Pinterest and Google Business Profile), read the comments they receive and see how their posts perform. It is operated by Bluevents (Massimo Cipicchia, DBA), 129 S Sycamore Ave, Los Angeles, CA 90036, USA (“we”). This policy explains what data we process, why, and the choices you have.

1. Data we collect

• Account data: the username, name, email address and password (stored only as a salted hash) you use to sign in to Solosocial.
• Business information you enter: brand descriptions, tone of voice, target audience, posting times and similar settings.
• Content: the photos, videos, music, captions, hashtags and drafts you upload or create in Solosocial, and the posts you schedule or publish.
• Data from connected social accounts, only after you connect them and only within the permissions you grant:
  • Meta (Facebook & Instagram): the list of Pages you manage, their linked Instagram professional accounts, Page access tokens, your published posts, their comments and their statistics (likes, comments, shares, views).
  • TikTok: your basic profile information (display name and open ID), access and refresh tokens, and the information needed to upload and publish videos you choose to post (permissions user.info.basic, video.upload, video.publish).
  • Pinterest: your username, access and refresh tokens, your boards and the Pins you publish.
  • Threads: your Threads user ID and username, the access token, the posts you publish and their statistics (permissions threads_basic, threads_content_publish, threads_manage_insights).
  • YouTube (Google): your channel name, access and refresh tokens, the videos you choose to upload and their public statistics (views, likes, comments). Scopes: youtube.upload, youtube.readonly.
  • Google Business Profile (Google): the business accounts and locations you manage, access and refresh tokens, and the updates you publish (scope business.manage).
  • Bluesky: your handle and account ID (DID) and the session tokens Bluesky gives us when you log in with an app password (we never store the app password itself), plus the posts and media you publish and their public numbers.
  • Mastodon: your server name, account name and ID, the access token your server gives us (scopes read and write), plus the posts and media you publish and their public numbers.
  • LinkedIn: your name and member ID (via OpenID Connect), the access token and the posts you publish on your profile (scopes openid, profile, w_member_social).
• Billing data, only if you subscribe to Solosocial Pro: card and payment details are entered on Stripe's pages and stay with Stripe; we receive and keep only the Stripe customer and subscription IDs, the subscription status and its renewal dates, and your email for the receipt.
• AI usage: a record of the AI actions you run (what, when, the credits used), to count your credits.
• Technical data: a session cookie that keeps you signed in, a cookie that remembers the selected workspace, a short-lived security cookie used while connecting a social account, and server logs (IP address, time, errors) kept for security and troubleshooting.

We do not use advertising cookies or trackers, and we do not build advertising profiles.

2. How we use the data

• To provide the service: publish the content you approve or schedule, at the time you choose, on the accounts you connected.
• To show you comments and messages on your posts and help you reply to them.
• To show statistics about your posts.
• To generate suggestions (texts, hashtags, images, music) when you ask for them.
• To manage AI credits and, if you subscribe, your Solosocial Pro plan.
• To keep the service secure and working, and to answer your support requests.

Content is published only on the accounts you connected and, except for features you explicitly turn on (such as scheduled posts or automatic replies), only after you approve it. Data received from TikTok, Meta or Pinterest is used only to provide these features to you; it is never sold, never used for advertising, and never shared with other users.

Google user data (YouTube and Google Business Profile)

Solosocial's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you ask for (uploading your videos, publishing your business updates and showing their statistics); it is not used for advertising, not sold, not transferred to others except as needed to run the service or required by law, and not read by people except with your consent, for security or to comply with the law.

YouTube features use the YouTube API Services: by using them you agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. You can revoke Solosocial's access at any time from your Google Account → Third-party connections; we then delete the stored tokens.

3. Legal bases (GDPR)

We process data to perform our contract with you (providing the service and, if you subscribe, the paid plan), on the basis of your consent when you connect a social account (you can withdraw it at any time by disconnecting it), and on our legitimate interest in keeping the service secure.

4. Who we share data with

We share data only with the providers needed to run the service, and only to the extent needed:

• The social networks you connect (Meta for Facebook, Instagram and Threads; TikTok; Google for YouTube and Business Profile; X; LinkedIn; Pinterest), to publish your content and read your posts' comments and statistics, under their own privacy policies.
• Hosting and network: Namecheap (web hosting) and Cloudflare (network and security).
• Stripe (payments), only if you subscribe to Solosocial Pro: it processes the payment, may act as the seller of record, calculates and collects taxes and prevents fraud, under the Stripe Privacy Policy.
• AI providers, only when you use AI features: Anthropic (text generation) and fal.ai (image and video generation) receive the text, and where relevant the images, needed for the request. GIPHY receives search terms when you search for stickers.

Some of these providers may process data outside the European Economic Area; in that case transfers rely on the safeguards provided by law, such as the European Commission's Standard Contractual Clauses.

5. How long we keep data

• Account data and content: as long as your account exists.
• Social account tokens: until you disconnect the account, delete the workspace or delete your account, or until they expire or are revoked by the platform.
• Billing records: as long as your account exists; Stripe keeps payment and tax records for the periods required by law.
• Server logs: up to 30 days.

6. Your choices and rights

• Disconnect a social account at any time in Brand & Settings, or revoke access directly from the platform (Facebook: Settings → Business integrations; Threads: Settings → Account → Website permissions; TikTok: Settings and privacy → Security → Manage app permissions; Google/YouTube: myaccount.google.com/connections; X: Settings → Security and account access → Apps and sessions; LinkedIn: Settings → Data privacy → Permitted services; Pinterest: Settings → Security and logins → Apps).
• Delete content, a workspace or your whole account, which removes its data and tokens from our servers.
• Under the GDPR you can ask to access, correct, delete or export your data, or object to or restrict its processing, by writing to [email protected]. You can also lodge a complaint with your local data protection authority.
• California residents: under the CCPA/CPRA you can ask to know, correct or delete the personal information we hold about you by writing to [email protected]. We do not sell or share personal information, and we do not use it for targeted advertising.

7. Security

Connections are encrypted (HTTPS). Passwords are stored as salted hashes and social account tokens are kept only on our server: they are never sent to your browser or shown to other users. Each user can see only their own workspaces.

8. Children

Solosocial is a business tool and is not intended for anyone under 18.

9. Changes

We may update this policy; the date at the top shows the latest version. Important changes will be announced in the app.

10. Contact

For any question about this policy or your data, contact Bluevents (Massimo Cipicchia, DBA), 129 S Sycamore Ave, Los Angeles, CA 90036, USA at [email protected].