Privacy policy

Sociolark (“we”, “us”) is operated by Agile Media Labs Inc., 7 Dalbeattie Drive, Brampton, Ontario L6Y 6H7, Canada. We are the controller of the personal information described here. Contact our privacy officer at privacy@sociolark.com.

Sign-in data. When you continue with Google, Facebook or TikTok we receive a unique account identifier, your name and profile photo, and (Google and Facebook only) your email address. We never receive or store your passwords.

Connected-account data. When you connect a Facebook Page, Instagram professional account, YouTube channel, TikTok account, LinkedIn profile or Company Page, X account, Threads profile, Pinterest business account or Bluesky account, we store encrypted access tokens (for Bluesky, session tokens; we never store your Bluesky app password) and the data those platforms return through their official APIs: account profile details, audience and performance metrics (for example followers, views, reach, likes, comments, shares, saves and watch time), and details of your published posts and videos.

Content you create. Drafts, scheduled posts, captions, media you upload, reports, notes and settings.

Inbox and assistant data. When you grant the relevant platform permissions, we receive comments, messages, mentions and their sender/profile details for your connected accounts. We store conversation history, replies, assistant settings, knowledge sources and examples within your workspace.

Billing data. Plan, subscription status and invoices. Card details are collected and stored by Stripe; we never see full card numbers.

Technical data. Security and audit logs (actions taken in your workspace), hashed IP addresses for rate limiting, and error reports. We do not use advertising trackers.

• To provide the service you asked for: show analytics, publish and schedule your posts, and generate reports.
• To show your inbox and send replies you authorize, and to provide enabled AI features such as reply drafts, post analysis and brand-voice suggestions.
• To secure the service: authentication, fraud and abuse prevention, rate limiting and audit trails.
• To bill you and send transactional emails (for example invitations and receipts).
• To comply with law and enforce our Terms.

Google & YouTube. Sociolark uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. Sociolark's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to show you your channel's analytics and to upload the videos you schedule; we do not use it for advertising, do not sell it, and do not let humans read it except with your consent, for security, or where required by law. You can revoke Sociolark's access at any time at security.google.com/settings/security/permissions.

Meta (Facebook, Instagram & Threads). We access the accounts you authorize for profile information, publishing, insights and supported inbox features, according to the permissions you grant. Removing Sociolark in your platform settings revokes access. Disconnecting in Sociolark removes stored access tokens and pauses pending publishing targets, while preserving workspace history. Revocation and deletion are separate actions; see our data deletion instructions to request removal of stored data.

TikTok. We access your TikTok profile information, statistics and video list, and post videos you explicitly schedule, following TikTok's Developer Terms. You can revoke access in TikTok under Settings → Security → Manage app permissions.

We do not sell platform data or use it to train or fine-tune general-purpose AI models. Enabled AI features may send relevant content to inference providers to produce a result for your workspace. The feature called Auto-train proposes brand instructions and reply examples; it does not change model weights. Workspace members can also create report share links and authorize integrations that expose selected data outside the workspace.

We use these service providers to operate Sociolark:

• Supabase (database, authentication and file storage; hosted in Canada)
• Vercel (application hosting and delivery)
• Stripe (payments)
• Resend (transactional email)
• OpenRouter and the model providers it routes to (AI inference for enabled assistant and analysis features; configured model families include Anthropic, OpenAI and Google)
• Google Analytics (website measurement and advertising measurement; see Analytics and cookies below)

When you publish, we send your content to the social platforms you selected. We may disclose information if required by law. Some providers process data outside Canada, including in the United States.

AI requests can include relevant post text or media, metrics, comments, conversation excerpts and your brand knowledge. We request inference routes that disallow provider data collection. This setting does not establish zero retention for every provider. Do not put passwords, payment details or government ID documents into assistant knowledge or prompts.

• Access tokens: until you disconnect the account or the platform revokes access, then deleted immediately.
• Analytics, posts and inbox history: retained in your workspace after disconnect so you can keep records. Request deletion of platform data or delete your account to remove it.
• Uploaded media: temporary source files become eligible for hourly deletion 24 hours after every post using them has finished publishing or been cancelled. Drafts, scheduled posts, failed deliveries and active provider processing protect their source files. Uploads not attached to any post expire after 72 hours. Post receipts and analytics remain, but reusing a removed source requires uploading your original again. Deleting source files removes the private Storage objects, not copies already published on social platforms. Backup retention follows the storage provider configuration.
• Workspace knowledge: retained for your assistant until removed or included in a deletion request.
• Account data: retained while your account exists. Deletion requests also require review of storage, derived assistant data and service-provider copies; backup retention follows the applicable provider configuration.
• Billing records: as long as tax law requires (typically 7 years).

Access tokens are encrypted at rest with AES-256-GCM. Data is encrypted in transit with TLS, isolated per workspace with row-level security, and every sensitive action is recorded in an audit log. No system is perfectly secure; if a breach affects you, we will notify you and the relevant authorities as the law requires.

You can access, correct, export or delete your data at any time. Export and deletion are self-service in Settings, and you can also email privacy@sociolark.com. Depending on where you live (for example under PIPEDA, the GDPR or US state laws) you may also have the right to object to or restrict processing, withdraw consent, and complain to your data protection authority, such as the Office of the Privacy Commissioner of Canada.

For deleting data received from Facebook or Instagram, see our data deletion instructions.

We use essential cookies for your sign-in session, security tokens and preferences such as active workspace, brand and theme. We also use Google Analytics 4 to understand how people find and use Sociolark and to measure our marketing.

When it runs. In the European Economic Area, the United Kingdom, Switzerland and Quebec, analytics stays off until you accept it in the cookie banner. Elsewhere it is on by default, and you can switch it off at any time below.

What it sees. The public pages you visit, with every query parameter except campaign tags and ad click ids removed from the address; your approximate location (city level); your device and browser; how you arrived; and a few events such as clicks on sign-up and pricing buttons, signing up, and purchases. Pages inside the app (/app), sign-in callbacks, report and media links and invitations are never measured. We never send email addresses, the content of your posts, messages or reports, or the names of your connected accounts.

Signed-in visits. On the welcome and checkout confirmation pages we attach a pseudonymous id (a keyed one-way hash of your account id) and your plan, so that these visits count as one person. Without our secret key, it cannot be traced back to you.

Advertising. We tell Google whether this data may be used to measure our advertising. If your browser sends a Global Privacy Control signal, we tell Google not to use it for advertising at all. In the regions where we ask first, we never allow it to be used for personalised ads.

How long. Everything is sent from your browser. A purchase is sent from the checkout confirmation page after our server confirms the payment with Stripe. Google Analytics keeps event-level data for 14 months.

Your browser also stores your colour theme, whether the cookie banner applies where you are (this visit only), and a short list of recent order references so a purchase is not counted twice. None of it is sent to anyone. Switching analytics off deletes the list.

Switching analytics off stops it in this browser and deletes the Google Analytics cookies this site set. Your choice is saved for 180 days. You can also block cookies in your browser settings.

Sociolark is not directed to children under 16 and we do not knowingly collect their personal information.

We will post changes here and update the date above. For material changes we will notify workspace owners by email or in the app before they take effect.