Privacy Policy

• To provide, maintain, and improve the SocialFlow platform
• To publish and schedule content to your connected social media accounts, as directed by you
• To display and let you reply to comments and messages from your connected accounts
• To run the automation rules you configure (for example, auto-replies to comments or DMs)
• To generate AI-powered captions, images, strategies, and reply suggestions
• To send transactional emails (account verification, password reset)
• To detect and prevent fraud or unauthorized access
• To comply with legal obligations

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

Where the UK GDPR, the Data Protection Act 2018, or the EU GDPR applies, we rely on the following lawful bases under Article 6 to process your personal data:

• Contract — to provide the Service you signed up for (account, publishing, inbox, analytics)
• Consent — when you connect a social account or enable an optional feature; you may withdraw consent at any time by disconnecting the account, without affecting processing already carried out
• Legitimate interests — service security, fraud prevention, and product improvement, balanced against your rights and freedoms
• Legal obligation — where retention or disclosure is required by law

SocialFlow integrates with the Meta Platform. By connecting your Meta accounts you authorize us to use the following permissions:

• Read the list of Pages you manage (pages_show_list)
• Read Page engagement and insights (pages_read_engagement)
• Publish posts to your Facebook Page (pages_manage_posts)
• Read your Instagram business profile (instagram_basic)
• Publish content to Instagram (instagram_content_publish)
• Read and reply to Instagram comments (instagram_manage_comments)
• Read and reply to Instagram Direct messages (instagram_manage_messages)
• Send and receive Page Messenger messages (pages_messaging)
• Read advertising performance data (ads_read)

We access only the data necessary to provide the features you actively use, and we use Meta Platform Data solely to provide the Service to you — never for advertising, profiling unrelated to the Service, or resale. Page access tokens are encrypted at rest. Comments and message threads retrieved from Meta are stored only so you can manage them inside SocialFlow, and are deleted when you disconnect the channel or delete your account.

You can revoke SocialFlow's access at any time from your Facebook Business Integrations settings.

SocialFlow uses Google OAuth for sign-in and, if you connect a YouTube channel, the YouTube API Services to upload and manage videos on your behalf.

SocialFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we only use Google user data to provide user-facing features of the Service, we do not transfer it except as necessary to provide those features, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security, or to comply with law.

By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke SocialFlow's access to your Google data at any time via your Google security settings.

When you connect these platforms, we receive an OAuth token and basic profile information, and we use them solely to publish the content you create and schedule in SocialFlow. Your use of each platform remains subject to its own terms and privacy policy: LinkedIn, TikTok, X. You can revoke access from the connected-apps settings of each platform, or by disconnecting the channel inside SocialFlow.

SocialFlow offers AI-assisted features (caption generation, image generation, brand guideline extraction, strategy suggestions, and automated replies). To provide these features, the relevant text you provide — such as prompts, captions, brand guidelines, or the public comments/messages a rule is replying to — is sent to our AI providers:

• Anthropic (Claude) — reply generation and text assistance
• Google Gemini — content generation and document analysis
• Stability AI — image generation

We send only the minimum content needed for the requested feature. Under their API terms, these providers do not use API data to train their models. AI outputs are stored with your content so you can review, edit, or delete them.

We use the following processors to operate SocialFlow:

• MongoDB Atlas — database hosting
• Cloudinary — media file storage and delivery
• Cloud infrastructure providers — application hosting
• AI providers — as listed in Section 7

Each provider processes data on our instructions and under its own security and privacy commitments. We do not share your data with any third party for their own marketing.

We retain your account data for as long as your account is active. Connected channel tokens are deleted immediately when you disconnect a channel or delete your account. Synced comments and conversations are deleted together with the brand or account they belong to. Backup copies are purged on a rolling basis within 30 days.

• All OAuth tokens are encrypted with AES-256-GCM using a unique IV per token
• Passwords are hashed with bcrypt — never stored in plain text
• All data is transmitted over HTTPS/TLS
• OAuth state parameters are signed with HMAC-SHA256 to prevent CSRF attacks
• Database access is restricted via IP allowlists and credential rotation

No method of transmission over the internet is 100% secure; we cannot guarantee absolute security, but we notify affected users of any breach as required by applicable law.

Under the UK GDPR and Data Protection Act 2018 (and the EU GDPR / CCPA where they apply), you have the right to:

• Be informed about how your data is used (this policy)
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your account and associated data ("right to be forgotten")
• Data portability — export your content in a portable format
• Restrict or object to certain processing, including profiling
• Withdraw consent where consent is the legal basis
• Not be subject to solely automated decisions with legal or similarly significant effects

To exercise any of these rights, contact us at Support@vyooo.com. We respond within one month, as required by the UK GDPR.

If you are in the UK and believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority (ico.org.uk). If you are in the EU/EEA, you may complain to your local data protection authority. We would appreciate the chance to address your concerns first.

You can delete your SocialFlow account and all associated data at any time:

1. Log in to your account
2. Go to Profile Settings → Account
3. Click "Delete Account" and confirm

This permanently removes your profile, brands, content, connected-channel tokens, and synced comments/conversations. Alternatively, email Support@vyooo.com with the subject "Data Deletion Request" and we will process your request within 30 days. If you connected via Facebook, you can also trigger deletion from Facebook's Apps and Websites settings.

Our infrastructure and processors may store or process data in countries outside the UK and EEA. Where we transfer personal data internationally, we rely on an appropriate safeguard recognised under the UK GDPR, namely one of:

• a transfer to a country with UK "adequacy" regulations;
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses; or
• equivalent contractual safeguards offered by our providers.

You may request a copy of the relevant safeguard by contacting us at Support@vyooo.com.

The Service is intended for business use and is not directed to children. Consistent with the Data Protection Act 2018, we do not knowingly process the personal data of children under 13 without verifiable parental consent, and the Service is not offered to anyone under that age. If you believe a child has provided us with personal data, contact us at Support@vyooo.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated "Last updated" date and, for significant changes, notify you in-app or by email. Continued use of SocialFlow after changes constitutes acceptance.