Privacy Policy

Last updated 6 November 2026Effective 6 November 2026Version 1.1

Contents

1. 1. Introduction
2. 2. Who we are
3. 3. Summary
4. 4. What personal data we collect
5. 5. Why we use your data, and our legal basis
6. 6. Artificial intelligence
7. 7. Analytics from Connected Platforms
8. 8. Notifications and communications
9. 9. Who we share your data with
10. 10. Future B2B features
11. 11. International transfers
12. 12. Your rights
13. 13. Complaints
14. 14. How long we keep your data
15. 15. Security
16. 16. Children
17. 17. Cookies, SDKs and similar technologies
18. 18. Investors and our data room
19. 19. Marketing
20. 20. Third-party links
21. 21. Jurisdiction-specific information
22. 22. Changes to this Policy
23. 23. Contact

1. Introduction

This Privacy Policy explains what personal data Socialy collects about you, why we collect it, who we share it with, how long we keep it and what rights you have.

We know this is a lot of text. Section 3 is a plain-language summary; the rest is the detail you are legally entitled to.

We take a deliberately conservative approach to your data. Socialy does not scrape social platforms, does not buy audience data, does not sell your personal data, and does not use your creative content to train third-party AI models.

---

2. Who we are

Socialy LTD ("Socialy", "we", "us") is the data controller for the personal data described in this Policy.

This Policy applies to the Socialy mobile app, the website at https://socialyclub.app, and all related services (together, the "Service"). It should be read alongside our Terms of Use. Cookies, SDKs and device identifiers are covered in section 17 of this Policy — we do not publish a separate Cookie Policy.

---

3. Summary — the short version

---

4. What personal data we collect

4.1 Data you give us directly

4.2 Data generated by your use of the Service

4.3 Data from Connected Platforms (optional, v2.0 onwards)

If — and only if — you connect a social account via that platform's official API, we receive the data covered by the permissions you approve. Typically:

• your public profile identifiers (username, account ID, profile picture, follower count);
• metrics for your own posts: views, reach, impressions, likes, comments, shares, saves, watch time;
• aggregated audience insights the platform provides: age bands, gender split, country/city, active times;
• for Instagram Trial Reels and similar formats, the performance data the platform exposes.

What we do not do: we do not access your direct messages; we do not collect your followers' individual profiles or contact details; we do not scrape; we do not use your credentials — authentication is by OAuth token which you can revoke at any time.

Note that audience insights are aggregated statistics about other people, provided by the platform. We treat them as statistical data and do not attempt to identify individual audience members.

4.4 Data from third parties

4.5 Data we do not want

We do not ask for and do not need special category data (health, race or ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) or criminal offence data.

Because Socialy accepts free-form notes and voice recordings, it is technically possible for you to put such information into the app. Please avoid doing so.

If you do, we do not analyse it as special category data, do not use it to infer anything about you, and do not use it for any purpose other than storing and processing the note you asked us to process. Where our processing of such content requires a condition under Article 9, we rely on Article 9(2)(e) — personal data manifestly made public by you — where that applies, and otherwise on your explicit consent, which we obtain by a separate confirmation step at the point you choose to store content you have flagged as sensitive. We do not treat ordinary use of the app as explicit consent. You can delete any such content at any time, and doing so removes it from our systems in accordance with section 14.

We do not process criminal offence data.

Voice recordings. We use your voice recordings only to transcribe speech into text. We do not use voice data for biometric identification or voiceprints, and we do not generate synthetic voice from your recordings.

---

5. Why we use your data, and our legal basis

Under UK GDPR and EU GDPR we must have a lawful basis for each use.

Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interests against your rights. You can request a summary of any of these assessments at privacy@socialyclub.app, and you have the right to object (see section 12).

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

---

6. Artificial intelligence — how your data is processed

This section explains our AI processing in detail, because it is the part of the Service people most want to understand.

6.1 What gets sent to an AI provider

When you run a Generation, we assemble a request containing only what is needed for that task. Typically this includes:

• your Pillars and tone-of-voice settings;
• the specific notes, transcripts and saved references you have selected or that fall in the relevant period;
• where enabled, retrieved excerpts from your personal style profile;
• where relevant, summary metrics from your Connected Platforms;
• our system instructions.

We minimise what we send. By design, Socialy sends the distilled meaning of your own voice notes rather than bulk transcripts of third-party videos.

We do not send: your email address, password, payment data, precise location, or your full account history.

6.2 Who our AI providers are

Your personal style profile is not held by a third-party vector service. Embeddings and retrieval run inside our own database on our own servers in the EU (see section 9.1), so this data does not leave our infrastructure.

We are open about the fact that Claude powers Socialy's AI. Each provider acts as our processor under a data processing agreement containing GDPR Article 28 terms and appropriate transfer safeguards. We keep this table current; check back for changes, and see section 22 for how we notify you of material changes.

6.3 Retention at the provider

Our AI providers may retain request data for a short period for abuse monitoring and then delete it. We have configured the strictest retention setting available to us. Providers do not build user profiles from our requests.

6.4 We do not train third-party models on your content

Your User Content and Outputs are not used to train foundation models. We may use aggregated, de-identified signals (for example, "prompts of type X are regenerated more often") to improve our own prompts and product. If we ever want to use your identifiable content to improve our own systems, we will ask for separate, specific, revocable consent first.

6.5 Human access

Access to your content by our staff is restricted, logged and limited to what is necessary:

• to investigate a bug or support request you raise;
• to investigate a credible report of a serious breach of our acceptable use rules;
• where required by law.

We do not read your idea bank or listen to your voice notes for any other reason.

6.6 Transparency and AI-generated content

We tell you in the interface when you are interacting with an AI system and when content has been generated by AI, and we technically mark AI-generated Outputs as artificially generated, consistent with Article 50 of the EU Artificial Intelligence Act.

AI Outputs can be inaccurate. Always review them before use. See clause 7 of our Terms of Use.

6.7 Automated decision-making

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing.

The Service does use automation to generate suggestions — proposed content plans, recommended posting times, topic suggestions and analytical commentary. These are recommendations, not decisions. You review, edit, approve or discard every one of them, and nothing happens to your account, your money or your legal position as a result.

If we ever introduce a feature that does involve solely automated decisions with significant effects — for example an automated eligibility score for a brand marketplace — we will inform you beforehand, provide meaningful information about the logic involved, and give you the right to obtain human intervention, express your point of view and contest the decision.

6.8 Profiling

We analyse your usage patterns to personalise your experience (for example, suggesting a better recording time based on when you actually complete tasks). This is profiling in a limited sense and you may object to it under section 12.

---

7. Analytics from Connected Platforms

If you connect a platform:

• we store the OAuth access token securely and use it only for the permissions you granted;
• we pull the metrics needed for your dashboard, typically once per day;
• we may store historical snapshots so you can see trends over time;
• you can disconnect at any time in settings, and revoke access from within the platform itself.

On disconnection we stop collecting new data. Data already collected is deleted within 30 days unless you ask us to retain your historical dashboard, or we are required to keep it.

We access these platforms strictly through official APIs and in compliance with each platform's developer terms.

---

8. Notifications and communications

---

9. Who we share your data with

We share personal data only with the categories of recipient below, and only as far as necessary.

9.1 Service providers (processors)

Each is bound by a written contract that requires them to process data only on our instructions, keep it confidential, apply appropriate security, and delete or return it at the end of the engagement.

The table above is the current, complete list. We do not publish it as a separate page — this section is the single place it lives, so it cannot fall out of date relative to the rest of this Policy. You can also request it by email at privacy@socialyclub.app.

9.2 Others

• Apple — as an independent controller for App Store transactions, in accordance with Apple's own privacy policy.
• Connected Platforms — receive API calls from us using the token you granted; they are independent controllers of their own data.
• Professional advisers — lawyers, accountants and auditors, under duties of confidentiality.
• Authorities and legal claimants — where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We assess every request, refuse overbroad ones, and will notify you where we are legally permitted to do so.
• Acquirers — in a merger, acquisition, financing or asset sale, on a minimised and confidential basis. If control of your data changes, we will notify you and you may delete your Account.

9.3 What we never do

We do not sell your personal data. We do not share the content you create in Socialy — your notes, voice recordings, plans, scripts or platform metrics — with brands, advertisers or data brokers.

We do not disclose your individual reliability or discipline metrics to any third party, and we will only ever do so with your separate, specific opt-in consent under section 10.

We currently run no advertising or attribution tracking at all — no pixels, no advertising identifiers, no install-attribution SDK. See section 17.

---

10. Future B2B features — our commitment to you

Our long-term product plans include a module connecting creators with brands, which could involve sharing verified information about a creator's consistency and reliability.

We are telling you about this now, before it exists, so there are no surprises.

If and when we build it:

• inclusion will be strictly opt-in. We will not enrol you automatically, and there will be no penalty for declining;
• we will ask for separate, specific, informed consent at that time and explain exactly which metrics would be shared and with whom;
• you will be able to see what a brand would see, and withdraw at any time;
• we will publish an updated Privacy Policy and, where required, carry out a Data Protection Impact Assessment before launch;
• we will not retrospectively apply this to data collected before you opted in without your consent.

Any aggregated market research we publish (for example, "creators using content pillars post 2.4× more often") will use data that is aggregated and de-identified so that no individual can be identified.

---

11. International transfers

We are based in the UK, and your account data, content, voice notes, transcripts and content plans are stored on our own dedicated servers in Helsinki, Finland — inside the EU.

Some of the services we rely on are based in the United States, so certain data does leave the UK and EEA: the contents of AI generation requests (Anthropic), voice recordings sent for transcription (OpenAI), in-app analytics (Amplitude), crash reports (Sentry), outbound email (Resend), push notification payloads (Expo, Apple), and traffic metadata (Cloudflare).

Where personal data leaves the UK or EEA, we rely on one or more of:

• an adequacy decision by the UK Government or European Commission for the destination country;
• for EEA data, the European Commission's Standard Contractual Clauses (Decision 2021/914);
• for UK data, either the ICO's International Data Transfer Agreement (IDTA) as a standalone contract, or the ICO's International Data Transfer Addendum attached to those EU SCCs — we use whichever the provider offers;
• our own transfer risk assessment, applying the UK "data protection test" introduced by the Data (Use and Access) Act 2025, supported by supplementary technical measures including encryption in transit and at rest and strict access controls.

You can request a copy of the relevant safeguards (with commercially confidential terms redacted) at privacy@socialyclub.app.

---

12. Your rights

Under UK GDPR and EU GDPR you have the following rights. They are normally free to exercise, and we will respond within one month (extendable by two further months for complex requests, in which case we will tell you within the first month). Where a request is manifestly unfounded or excessive — in particular because it is repetitive — the law permits us to charge a reasonable administrative fee or to refuse; if we ever rely on that, we will explain why and tell you how to challenge it.

How to exercise them. Use the in-app privacy controls, or email privacy@socialyclub.app. We may ask you to verify your identity — we will only ask for what is necessary, and we will not use identity documents for any other purpose.

Note on access requests. Following the Data (Use and Access) Act 2025, we are required to carry out a reasonable and proportionate search in response to an access request. If we need clarification from you about what you are looking for, the response period pauses until you reply.

---

13. Complaints

13.1 Complain to us first

If you are unhappy with how we handle your personal data, please tell us at privacy@socialyclub.app with "Data protection complaint" in the subject line.

We are required by UK law to have a complaints process. We aim to acknowledge your complaint within 5 working days, and we are legally required to acknowledge it within 30 days, then respond substantively without undue delay.

13.2 Complain to a regulator

You also have the right to complain to a supervisory authority at any time.

United Kingdom — Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 — ico.org.uk

European Union — you may complain to the data protection authority in the EU country where you live, work, or where the issue arose. A list is available at edpb.europa.eu. Our representative in the Union under Article 27 GDPR is Aerva OÜ, Veskiposti tn 2-1002, Kesklinna district, Tallinn, Harju county, 10138, Estonia, reachable at gdpr@logicllab.com. You may address them on any matter relating to the processing of your personal data, in addition to or instead of contacting us directly.

You also have the right to an effective judicial remedy.

---

14. How long we keep your data

After you delete your Account, we delete or irreversibly anonymise your personal data within 30 days, except for the categories above with a legal retention requirement. Data may persist in encrypted backups for up to 90 days, after which it is overwritten; it is not accessible for ordinary use during that period.

---

15. Security

We apply technical and organisational measures appropriate to the risk, including:

• encryption in transit (TLS 1.2+) and at rest;
• passwords stored using a modern one-way hashing algorithm — we never see them in plain text;
• role-based access control, least privilege and logging of staff access to user content;
• multi-factor authentication for administrative access;
• segregated environments, with production data not used in development or testing;
• regular dependency patching and vulnerability scanning;
• vendor due diligence before onboarding any processor;
• staff confidentiality obligations and data protection training;
• a documented incident response plan.

No system is perfectly secure. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and we will notify you without undue delay where the risk is high.

Please help us: use a strong, unique password, enable device-level security, and tell us immediately at privacy@socialyclub.app if you suspect a problem.

---

16. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children or teenagers. If you believe a child has provided us with personal data, contact privacy@socialyclub.app and we will delete it promptly.

---

17. Cookies, SDKs and similar technologies

This section explains everything we store on or read from your device — browser cookies on the Website, and SDKs and identifiers in the App. It replaces what used to be a separate Cookie Policy.

The short version: the Website sets only cookies that are exempt from consent — those needed to sign you in and keep the site secure, plus two that remember a display preference you chose. The App contains two optional tools, behind a consent prompt. We run no advertising pixels, no advertising identifiers and no attribution tracking of any kind.

17.1 What these technologies are

A cookie is a small text file a website places on your device so it can recognise your browser on a later visit. We also use:

• Local storage — browser storage holding your session and interface preferences.
• SDKs — code libraries embedded in the App. We use two: product analytics and crash reporting.
• App-instance identifier — a random identifier generated at install, distinguishing one installation from another without identifying you personally.

What we do not use: advertising pixels (Meta, TikTok, Google Ads, LinkedIn or any other), the Apple IDFA or Google Advertising ID, install-attribution SDKs, and third-party web analytics.

The law that governs cookies governs storing or reading any information on your device, including through an app SDK. So the same consent rules apply to the App as to the Website.

17.2 On the Website

The Website sets only the following, all of which are exempt from consent. There is therefore no cookie banner — there is nothing to ask permission for.

The first six are strictly necessary — PECR reg. 6(4) / ePrivacy Art. 5(3) exemption. The last two are set only to remember a preference you actively chose, are never shared, and are not used to analyse or track you; in the UK they fall within the appearance-cookie exemption introduced by the Data (Use and Access) Act 2025, and in the EEA they are treated as necessary to deliver the setting you requested.

If we ever add anything beyond this, we will introduce a proper consent banner with equally prominent Accept and Reject options, no pre-ticked boxes and a persistent "Cookie settings" link — and we will not set any such cookie before you have chosen.

17.3 In the App

The App contains two optional SDKs:

On first launch, before either SDK is initialised, the App asks whether you consent. Until you answer, only the components strictly necessary to sign you in and keep the App secure are running. If you decline, the SDKs are not initialised and nothing is collected — this is not merely a flag applied after the fact.

You can change your answer at any time in Settings → Privacy → Analytics and crash reporting. Withdrawing is as easy as giving, and does not affect the lawfulness of anything processed beforehand. We will re-ask after 6 months, or sooner if we introduce a materially new technology.

Legal basis — two layers, because two laws apply. Storing or reading identifiers on your device is governed by ePrivacy/PECR and requires your consent. What we then do with the data is governed by UK/EU GDPR: for product analytics we rely on consent; for crash reports, on our legitimate interest in keeping the App working (section 5). We ask for consent everywhere, including in the UK, rather than relying on the narrower UK statistical-purposes exemption — that exemption covers only data used solely to improve Socialy, which would have to be re-verified against each provider's terms every time they change.

We do not request the App Tracking Transparency permission, because we do not track you across other companies' apps or websites.

17.4 Advertising — none

We currently use no marketing, advertising or attribution technologies whatsoever. No Meta pixel, no TikTok pixel, no Google Ads tag, no LinkedIn Insight tag, no IDFA or Advertising ID access, no attribution SDK.

This is stated explicitly so that its absence is clear rather than implied. If we ever introduce any of these, we will update this Policy, give 30 days' notice (section 22) and obtain your consent before anything is set.

17.5 How to control these technologies

• App: Settings → Privacy → Analytics and crash reporting.
• Website: nothing to configure while only exempt cookies are in use. To clear the two preference cookies, use your browser settings.
• Browsers: Chrome — Settings → Privacy and security; Safari (macOS) — Settings → Privacy; Safari (iOS) — Settings app → Safari → Privacy & Security; Firefox — Settings → Privacy & Security → Cookies and Site Data; Edge — Settings → Cookies and site permissions. Blocking all cookies will break sign-in on most websites, including ours.
• Deleting the App removes its local storage and SDK identifiers.

17.6 If you decline

The App works exactly the same — nothing is paywalled or degraded. We simply have less insight into which features work, and we will not receive crash reports from your device, so a bug affecting only you may take longer to find. You can always report one at support@socialyclub.app.

We will never make access to Socialy conditional on accepting non-essential tracking, and we will not degrade the Service or charge you more because you declined.

17.7 Is this personal data?

Some of it. A cookie identifier, an app-instance identifier or an IP address can be personal data under UK and EU law even where we do not know your name. Where it is, everything in this Policy applies — your rights under section 12, our retention limits under section 14, and the transfer safeguards in section 11 for Amplitude and Sentry, both of which are in the United States.

We do not combine analytics data with the content you create in Socialy. Your idea bank, voice notes, scripts and plans are never linked to analytics events.

---

18. Investors and our data room

This section applies to anyone who visits our investor data room at room.socialyclub.app: visitors of its public page, investors who request access, and investors who receive a login. It does not apply to users of the App.

What we collect.

• When you open any page or file of the data room, including its public page: a log line with the time, the page or file, your browser, your IP address shortened to its first three parts (IPv4) or its first 48 bits (IPv6), and your login if you are signed in. If a request fails at our web server, its error log keeps the full IP address.
• When you request access: your full name, your company or fund, your email address, the time of the request, and whether the address is a personal (free-mail) one. We do not store your IP address with your request.
• If we give you access: your login, your access level, and the dates we gave or changed it. Documents at the second level are made for you personally and carry your name and firm.

Why, and our legal basis. We use this data to answer your request, give you access and reply to you. It also lets us keep confidential documents personal to you, know which documents were opened, and keep the data room secure. Our legal basis is our legitimate interest in raising investment and protecting confidential information (Article 6(1)(f) UK GDPR and EU GDPR).

Where it is kept.

• On our server at Hetzner in Helsinki, Finland:
  • access requests;
  • the access log;
  • your login, with your password only as a one-way hash;
  • while you have second-level access, the copies of those documents made for you.
  Your login also appears in the server's system logs.
• On a company computer, not on the server: the list of investors with access (name, firm, email, level, dates).
• Your password: we send it to you once, by email from our mailbox, and then delete our copy of that email. Please delete yours once you have signed in.

Who has access. Our founders, and the administrator of our server, who can technically access the files on it. Hetzner (hosting) and our email provider process this data on our behalf. We share it with no one else, and we use it only to manage your request and your access.

How long we keep it.

• Access requests: deleted 90 days after they arrive, or 7 days after we approve them. We run the deletion at least once a week, so a request can stay up to 7 days longer.
• The access log: 14 days. The error log of our web server and the server's system logs: about two weeks and about five weeks.
• Copies of second-level documents made for you: removed when your access ends. Earlier versions of the data room, which we keep for recovery, hold them until three later updates replace those versions.
• Your login and access record: deleted 24 months after your access ends, or earlier if you ask us.
• Backups: our server backups do not include access requests.

Cookies. The data room sets no cookies. Your browser remembers your login only for the session.

Your rights. You have the rights described in section 12. To use them, or to ask us to delete your request or your record before its retention period ends, write to privacy@socialyclub.app.

---

19. Marketing

We will only send you marketing email where you have consented, or where you are an existing customer receiving information about similar services and did not opt out when we collected your address.

Every marketing message contains a one-click unsubscribe link. You can also manage preferences in the App or email privacy@socialyclub.app. Unsubscribing from marketing does not stop transactional or security messages.

We run no advertising pixels, no advertising identifiers and no attribution tracking — see section 17. Nothing you do inside Socialy is used for advertising, and no advertising platform receives data about you from us. If this ever changes we will update this Policy and ask for your consent first, as described in section 22.

---

20. Third-party links

The Service contains links to third-party sites and platforms. We are not responsible for their privacy practices. Read their policies before providing data to them.

---

21. Jurisdiction-specific information

If you are in the EEA: you have the rights described in section 12 under the EU GDPR. You may exercise them with us at privacy@socialyclub.app, or through our representative in the Union: Aerva OÜ, Veskiposti tn 2-1002, Kesklinna district, Tallinn, Harju county, 10138, Estonia — gdpr@logicllab.com. Contacting the representative does not limit your right to contact us directly, or to complain to your own supervisory authority.

If you are in the UK: the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, apply.

If you are in Switzerland: the Swiss Federal Act on Data Protection (revFADP) applies alongside this Policy; you may complain to the FDPIC.

If you are in California: we do not sell personal information, and we do not share it for cross-context behavioural advertising — we run no advertising pixels and no advertising identifiers. You have rights to know, delete, correct, and to non-discrimination for exercising them. Contact privacy@socialyclub.app.

Other regions: where local law grants you greater rights than this Policy provides, those rights apply.

---

22. Changes to this Policy

We will update this Policy as the Service develops — in particular when we add Connected Platform analytics (v2.0), the personal style profile (v3.0), or community and B2B features (v4.0).

• Minor changes: we update the "Last updated" date.
• Material changes — including any new purpose, new category of recipient, or new AI provider: we will notify you by email or prominent in-app notice at least 30 days before they take effect, and where the change requires your consent we will ask for it rather than assume it.

This is version 1.1. Version 1.1 added section 18, for investors who use our data room; nothing changed for users of the App. You can request any previous version at privacy@socialyclub.app.

---

23. Contact

Socialy LTD 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom Company number: 17184561

Privacy and data protection: privacy@socialyclub.app General support: support@socialyclub.app EU representative under Article 27 GDPR: Aerva OÜ, Veskiposti tn 2-1002, Kesklinna district, Tallinn, Harju county, 10138, Estonia — gdpr@logicllab.com

We aim to respond to privacy enquiries within 5 working days and to formal rights requests within one month.

---

© 2026 Socialy LTD. All rights reserved.