Privacy Policy

Introduction

SocialX360 is a social media management platform operated by Gupta Technology LLC, a company based in New Jersey, United States ("SocialX360", "we", "us"). This Privacy Policy explains what personal information we collect when you use our website (socialx360.com) and our web application (the "Service"), how we use and share it, how long we keep it, and the choices and rights you have.

We act in two roles. For your own account, billing and usage information, we decide how it is used and are its controller. For information about the people who interact with the social accounts you connect (for example, someone who comments on your post or messages your Instagram account), we process it on your behalf and under your instructions, as your processor; see Information about your audience.

1. Information We Collect

Information you give us

• Your name, email address and password (stored only as a one-way hash)
• Your name, email address and profile photo from Google, if you sign in with Google
• Your profile photo, preferences and notification settings
• Billing details: your plan, number of channels and billing history. Card details are entered on and held by our payment processor, Stripe; we never see or store your full card number
• Posts, captions, media, tags, DM rules and other content you create in the Service
• Text you send to the AI Assistant when you ask it to write or rewrite a caption
• Messages you send to our support team

Information from the social accounts you connect

When you connect Instagram, Facebook, TikTok, YouTube, X (Twitter) or LinkedIn, you sign in with that network and choose what to allow. We then receive:

• Access tokens that let us act for you (encrypted with AES-256 before we store them)
• Account profile information: ID, username, name, profile picture and follower count
• Your posts and their insights, such as reach, impressions, likes and comments
• Comments and direct messages on your accounts, when you use comment and DM automation or the Inbox. The Inbox shows Instagram conversations live from Instagram and does not store them

Information collected automatically

• IP address, browser, operating system and device type
• Approximate location (city and country) worked out from your IP address
• A random device identifier stored in your browser, which we keep only in hashed form, so we can recognise new devices and email you a sign-in alert
• Sign-in history, active sessions and security events (such as failed sign-in attempts)
• Server logs, error logs and records of actions taken in your account

2. Data We Receive from Meta (Facebook and Instagram)

SocialX360 connects to Facebook and Instagram only through Meta's official login and APIs. We never ask for or see your Facebook or Instagram password, and we can only reach the Pages and Instagram professional accounts you choose to connect, with the permissions you grant. We use that access to:

• Show the Pages and Instagram accounts you can connect, and their names and profile pictures
• Publish and schedule the posts, Reels, Stories and carousels you create
• Read your posts' insights and your account's follower counts for your analytics
• Read comments on your posts, and post the public replies your DM automations are set to leave
• Send the automated direct messages you set up, only to people who first commented on your post, replied to your story or messaged you, and within Meta's messaging window
• Show and answer your Instagram conversations in the Inbox

We use data from Meta only to provide these features to you. We do not sell it, use it for advertising, build profiles of people from it, or share it with data brokers, and we follow Meta's Platform Terms and Developer Policies.

You can stop our access at any time by disconnecting the channel in SocialX360 or by removing SocialX360 in your Facebook or Instagram settings. If you remove SocialX360 there and ask for your data to be deleted, Meta tells us and we delete the data we received from Meta about you. See Data Deletion for the steps.

3. Other Networks

• YouTube: SocialX360 uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke our access on Google's third-party access page. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• TikTok, X and LinkedIn: we use their official APIs in the same way, only for the features you use, and you can revoke our access in each network's settings or by disconnecting the channel.

4. Information About Your Audience

When people comment on, reply to or message the accounts you connect, and your DM automations respond to them, we store a contact record for each of them: their ID and username on that network, their name and profile photo (from Instagram, once they have messaged you), the comments and messages that triggered your automations, the messages your automations sent, tags you add, and whether they are subscribed, have unsubscribed (for example by replying STOP) or cannot be messaged.

You control this information and we process it only to provide the Service to you. You are responsible for having a lawful basis to message these people, for telling them how you use their information (for example, in your own privacy policy), and for following Meta's rules and messaging laws. Our Terms set out these obligations.

If you are one of these people, please contact the business or creator you interacted with to access or delete your information. You can also email us at support@socialx360.com; we will delete it on their behalf and let them know.

5. How We Use Your Information

• Create and run your account, and sign you in securely
• Schedule and publish content to your connected accounts
• Run the comment and DM automations you set up, and show your Inbox
• Show your analytics and produce the reports you ask for
• Write or rewrite captions with the AI Assistant when you ask it to
• Process payments, apply your plan's limits and manage your subscription
• Send service emails: sign-in alerts, failed posts, usage warnings, billing notices and replies to you
• Detect and prevent fraud, abuse, spam and security incidents
• Fix problems and improve the Service, using aggregated or de-identified information where possible
• Comply with the law and enforce our Terms

We do not use your content or your audience's information to train AI models, and we do not sell personal information.

6. Legal Bases for Processing (EEA, UK and Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

• Contract: to provide the Service you signed up for and take payment
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, and improve the Service, where these interests are not overridden by your rights
• Consent: where we ask for it, which you can withdraw at any time
• Legal obligation: to keep tax records and respond to lawful requests

7. How We Share Information

We do not sell personal information or share it for cross-context behavioural advertising. We share it only as follows:

• The social networks you connect: to publish your content, send your messages and read your analytics, as you instruct
• Service providers who process data for us under contract and only for the purposes below:
  • Stripe: payments and billing
  • Vercel: hosting of our website and application
  • Railway: hosting of the background workers that publish posts and send messages
  • Neon: our database
  • Upstash: queues and short-lived data used to run background jobs
  • Cloudflare and Amazon Web Services: storage of your media files
  • Amazon Web Services (Amazon SES): sending our emails
  • OpenAI: the AI Assistant (only the text you ask it to work on)
  • Google: Sign in with Google, if you use it
• Your workspace: if you join or invite people to a workspace, its members can see the workspace's channels, posts and activity
• Legal reasons: when required by law, court order or a valid government request, or to protect the rights, safety or property of our users, the public or us
• Business transfers: if we are involved in a merger, acquisition or sale of assets, under a commitment to protect your information as this policy describes
• With your consent or at your direction

We will update this list when we add or replace a service provider.

8. Data Retention

• Your account and content: for as long as your account is open. When you delete your account it closes at once, and we permanently delete it and its content within 30 days
• Backups: overwritten within a further 90 days
• Data from a social network: until you disconnect the channel or delete your account, and deleted sooner when the network asks us to delete a person's data
• Sign-in security records: security events and devices for 180 days; sessions for 30 days after they end
• Audit logs: kept for security and legal purposes; once your account is deleted they no longer identify you
• Billing records: as long as tax and accounting law requires (held by Stripe)

9. Your Rights and Choices

Wherever you live, you can:

• Access your data: email support@socialx360.com from your account's email address and we will send you a copy in a commonly used, machine-readable format
• Correct your name, email and other details in Settings → Profile
• Delete your account: Settings → Profile → Delete account
• Disconnect any connected channel at any time
• Choose which notification emails you get in Settings → Notifications

If you are in the EEA, the UK or Switzerland, you also have the right to restrict or object to our processing, to data portability, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority.

For anything you can't do in Settings, email support@socialx360.com. We may ask you to confirm your identity, and we reply within 30 days. If we can't do what you ask, we will explain why, and you can appeal by replying to our answer.

10. California and Other US State Privacy Rights

If you live in California or another US state with a consumer privacy law, you have the right to:

• Know the categories and specific pieces of personal information we collected about you, where it came from, why we use it and whom we share it with (sections 1 to 7 above describe these)
• Delete it, and correct inaccurate information
• Opt out of the sale or sharing of personal information and of targeted advertising. We do neither, so there is nothing to opt out of
• Not be discriminated against for using these rights
• Use an authorised agent, who must show your written permission; we may still verify your identity

Send requests to support@socialx360.com. We confirm receipt within 10 business days and answer within 45 days (we will tell you if we need up to 45 more). Because we don't track you across other websites, we treat Do Not Track and Global Privacy Control signals as already honoured.

11. How to Delete Your Data

Delete your account in Settings → Profile → Delete account, disconnect channels in Social Accounts, remove SocialX360 in your Facebook or Instagram settings, or email support@socialx360.com. Step-by-step instructions, including for people who messaged a business that uses SocialX360, are on our Data Deletion page.

12. Data Security

• All traffic is encrypted in transit with TLS
• Social account access tokens are encrypted at rest with AES-256
• Passwords are stored only as salted bcrypt hashes
• Optional two-factor authentication, email alerts for sign-ins from new devices, temporary lock-out after repeated failed sign-ins, and a list of active sessions you can sign out of
• Staff access to systems and data is limited to those who need it, and staff actions are logged

No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will tell you and any authority we are required to notify without undue delay, including what happened and what we are doing about it.

13. International Data Transfers

We are based in the United States, and our service providers store and process data in the United States and other countries. If you use the Service from elsewhere, your information is transferred to the United States, where data protection laws may differ from yours. When we transfer personal information from the EEA, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and their UK and Swiss equivalents) or another lawful transfer mechanism.

14. Children's Privacy

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

15. Cookies and Similar Technologies

We use only what the Service needs to work. We do not use advertising or third-party analytics cookies.

• A sign-in cookie that keeps you signed in to the app
• Your browser's local storage, for your sign-in tokens, preferences (theme, time zone, time format), the filters you last used, and the device identifier described in section 1

You can clear these in your browser settings at any time; you will then need to sign in again.

16. Sensitive Information

Please do not upload or send us sensitive information, such as government ID numbers, health or financial information, or information about racial or ethnic origin, religion, sexual orientation or criminal records, and do not use the Service to collect it from your audience.

17. Third-Party Websites

The Service links to and works with third-party services, such as the social networks you connect. Their own privacy policies apply to what they do with your information.

18. Changes to This Privacy Policy

We may update this Privacy Policy. We will post the new version here and update the "Last updated" date. If we make material changes, we will tell you by email or in the Service at least 30 days before they take effect.

19. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: