Privacy Policy

Socialista is the data controller for personal information described in this policy, except where we process information solely on behalf of a customer workspace (for example, when enterprise customers determine how end-user data is used).

For privacy questions, requests to exercise your rights, complaints, or general support, contact us at hello@socialista.app. You may also write to us at the mailing address published on https://socialista.app.

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland and we are required to appoint a representative, details will be posted on our website or provided on request.

This policy applies to personal information we collect through the Services, sales and marketing communications, support channels, and events where we identify ourselves as Socialista.

It does not apply to third-party websites, apps, or social networks you connect to or publish through. Those platforms have their own privacy policies and terms. When you connect a social account, you authorize us to access and process data from that platform as described below and as permitted by your settings on the platform.

If you use the Services on behalf of an organization, that organization may control certain workspace data. In those cases, the organization is responsible for its own compliance program and for providing notices to its users.

• "Personal information" (or "personal data") means information that identifies, relates to, or could reasonably be linked with an individual or household, as defined by applicable law.
• "Customer Content" means prompts, brand assets, product information, media files, posts, captions, and other materials you or your workspace submit to the Services.
• "Generated Content" means outputs produced by our AI and creative tools based on your inputs and settings.
• "Connected Accounts" means third-party social or advertising accounts you link for publishing, analytics, or authentication.
• "Usage Data" means technical and interaction data generated when you use the Services.

We collect information in three main ways: (1) you provide it to us, (2) we collect it automatically when you use the Services, and (3) we receive it from third parties such as sign-in providers, payment processors, and social platforms.

Account and profile information. When you register, we collect information such as your name, email address, password (stored in hashed form), profile photo, timezone, and workspace membership details. If you sign in with a third-party identity provider (such as Google, GitHub, or X/Twitter), we receive profile elements that provider shares with us according to your consent on that provider.

Billing and transaction information. If you purchase a paid plan, our payment partner (currently Polar) processes payment card or wallet details and billing metadata. We receive subscription status, plan tier, invoices, tax identifiers you provide, and transaction history—not full payment card numbers.

Customer Content and workspace data. We process content you upload or create, including images, videos, audio, text prompts, brand guidelines, product catalogs, skills, influencer configurations, scheduled posts, publishing settings, and collaboration data within workspaces and projects.

Connected Account and platform data. When you connect social channels (such as Facebook, Instagram, TikTok, Threads, or LinkedIn), we collect OAuth tokens, account identifiers, display names, profile metadata, publishing permissions, and—depending on the connection—post performance metrics, audience summaries, and content required to publish on your behalf. We access only the data needed to provide the features you enable.

Usage Data. We automatically collect device and log information, including IP address, browser type, operating system, device identifiers, pages viewed, feature usage, referral URLs, crash reports, and timestamps. We use cookies and similar technologies as described in the Cookies section.

Communications. If you contact support, request a demo, or subscribe to marketing emails, we process the content of your messages, your contact details, and related metadata.

We do not intentionally collect sensitive categories of personal information (such as government ID numbers, precise health data, or biometric templates for identification) unless you voluntarily include them in Customer Content or we are legally required to process them.

• Directly from you when you create an account, configure the studio, upload media, connect accounts, or communicate with us.
• Automatically through cookies, logs, and similar technologies when you use the Services.
• From authentication and social platform partners when you choose to connect those services.
• From payment processors and fraud-prevention providers when you make purchases.
• From service providers that host infrastructure, deliver email, run background jobs, or provide AI inference on our behalf.
• From other members of your workspace when they invite you or share content with you.

We use personal information for the following purposes, depending on your relationship with us and the features you use:

• Provide, operate, maintain, and secure the Services, including authentication, workspace collaboration, media storage, scheduling, and publishing.
• Generate, edit, and deliver AI-assisted creatives and captions based on your instructions and Customer Content.
• Process subscriptions, credits, usage limits, taxes, and billing disputes.
• Connect to third-party platforms at your direction to publish content and display analytics.
• Monitor performance, debug errors, prevent abuse, enforce our Terms, and protect the rights and safety of users and the public.
• Communicate with you about the Services, including transactional messages, security alerts, and—with your consent or as permitted by law—marketing.
• Improve and develop the Services, including training tuning, quality evaluation, and feature research using aggregated or de-identified data where possible.
• Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use Customer Content to train generalized third-party foundation models for unrelated products unless we clearly disclose that practice and obtain any consent required by law. We may use subprocessors and model providers to process prompts and media solely to deliver the feature you request.

If you are located in the EEA, UK, or Switzerland, we process personal data only when we have a valid legal basis:

• Contract: processing necessary to provide the Services you request, including account creation, content generation, publishing, and billing.
• Legitimate interests: securing the Services, improving features, preventing fraud, and marketing to business users in a balanced way that respects your rights. You may object to processing based on legitimate interests as described in Your rights.
• Consent: where required for optional cookies, certain marketing, or connecting third-party accounts when consent is the appropriate basis.
• Legal obligation: complying with tax, accounting, anti-fraud, and regulatory requirements.

Socialista uses automated systems, including machine learning models operated by us and our infrastructure partners, to generate and transform content, transcribe audio, analyze brand context, and suggest captions or hooks. Outputs may be inaccurate or inappropriate; you are responsible for reviewing Generated Content before publishing.

Inputs you provide (prompts, product details, media, and brand settings) may be transmitted to subprocessors for inference, storage, and delivery. We implement contractual and technical safeguards designed to limit use to providing the Services.

Where applicable law grants rights related to automated decision-making, you may contact us to request human review of decisions that produce legal or similarly significant effects. Our core creative tools do not typically make such decisions about individuals without human involvement.

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws, except as disclosed here or with your direction.

We may share personal information with:

• Service providers and subprocessors that host our application, store media, send email (such as Resend), process payments (Polar), run background jobs (such as Trigger.dev), provide AI inference, analytics, customer support tools, and security monitoring—bound by confidentiality and data processing terms.
• Connected social and identity platforms when you authorize publishing, analytics, or sign-in.
• Other members of your workspace according to your permissions and workspace settings.
• Professional advisers (lawyers, accountants, insurers) under confidentiality obligations.
• Authorities, regulators, or parties to litigation when we believe disclosure is required by law or necessary to protect rights, safety, and integrity.
• Successors in connection with a merger, acquisition, financing, or sale of assets, subject to this policy or successor notice.

We may publish aggregated or de-identified information that cannot reasonably identify you.

When you connect a social account, you instruct us to exchange data with that platform’s APIs. Data we receive may include account identifiers, access tokens, content you choose to publish, and performance metrics. We store tokens securely and refresh or revoke them according to platform rules and your disconnect actions.

Publishing on your behalf occurs only when you schedule or approve posts (or enable automation features you configure). You remain responsible for complying with each platform’s terms, community standards, and advertising policies.

If you disconnect an account, we delete or deactivate associated tokens within a reasonable period, subject to backup retention and legal holds.

We and our partners use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure OAuth flows, measure usage, and improve the Services.

• Strictly necessary: authentication sessions, security tokens, load balancing, and fraud prevention. These are required for core functionality.
• Functional: timezone, UI preferences, and workspace context.
• Analytics: understanding feature adoption and diagnosing errors. Where required, we request consent before setting non-essential analytics cookies.

You can control cookies through browser settings. Blocking strictly necessary cookies may prevent you from using parts of the Services. Where we use consent banners, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We retain personal information for as long as needed to provide the Services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

• Account data is retained while your account is active and for a limited period afterward to allow reactivation and backup integrity.
• Customer Content and Generated Content are retained according to your workspace settings and product features (including exports and deletions you initiate).
• Billing records may be kept longer where required for tax and accounting law.
• Logs and security records are retained for a shorter operational window unless needed for incident investigation.

When you delete content or close an account, we delete or de-identify information within a commercially reasonable timeframe, except where retention is required by law or permitted for legitimate backup, audit, or security purposes.

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, secrets management, and monitoring. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

You are responsible for safeguarding your credentials and workspace access. Notify us promptly at hello@socialista.app if you believe your account has been compromised.

We may process and store information in the United States and other countries where we or our service providers operate. These locations may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to countries not recognized as providing adequate protection, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful mechanisms, supplemented by technical and organizational measures where appropriate.

You may request a copy of relevant transfer safeguards by contacting hello@socialista.app.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing, to data portability, and to withdraw consent where processing is consent-based. You may also have the right to lodge a complaint with a supervisory authority.

To exercise rights, email hello@socialista.app with sufficient information to verify your identity and describe your request. We respond within the timeframe required by applicable law. Authorized agents may submit requests where permitted, with proof of authority.

We may deny requests that are manifestly unfounded, excessive, or where we are permitted or required to retain data. We will explain the basis for any denial when required.

Residents of California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have additional rights, including the right to know categories of personal information collected, sources, purposes, and recipients; to delete personal information; to correct inaccuracies; and to opt out of certain processing.

We do not sell personal information and do not share it for cross-context behavioral advertising as defined under the California Consumer Privacy Act (CCPA), as amended by the CPRA. We do not use or disclose sensitive personal information for purposes requiring a "limit the use" right under CPRA, except as permitted by law.

Categories collected in the preceding 12 months may include identifiers, commercial information, internet activity, audio/visual information in Customer Content, professional information related to your business use, and inferences used to improve the Services. We collect these categories for the business and commercial purposes described in this policy.

California residents may designate an authorized agent to submit requests on their behalf. We do not discriminate against you for exercising privacy rights.

Nevada residents may opt out of the sale of covered information. We do not sell covered information as defined under Nevada law. You may still contact us with questions.

The Services are not directed to children under 16 (or the minimum age required in your jurisdiction to consent to information services without parental approval). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact hello@socialista.app and we will take appropriate steps to delete it.

The Services may contain links to third-party websites, plugins, or integrations. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing personal information to third parties.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services, by email, or by other reasonable means. The "Last updated" date at the top indicates when this policy was last revised. Continued use after the effective date of an update constitutes acceptance of the revised policy, except where further consent is required by law.

Questions about this Privacy Policy or our privacy practices: hello@socialista.app. Website: https://socialista.app.