Privacy Policy

01 / PRIVACY POLICY

1. In short

We collect what is needed to run an account, bill calls and keep the service safe: your email, the metadata of your connector and calls, and payment records without card numbers. We do not sell personal data, we do not run tracking cookies, and analytics are off unless you switch them on in the console.

SocialToAI is a sole proprietorship based in Hong Kong SAR and is the controller of the personal data described here.

02 / PRIVACY POLICY

2. What we collect

Account: your email address, the identity provider you sign in with (email link or Google) and the identifier that provider assigns, handled through Supabase Auth. Connector: a key identifier, a one-way hash of the key, its scopes and daily limit. We never store the key itself; it exists only in your browser and your client.

Calls: for every request we record a request id, the platform and operation, the result status, the credits charged, the duration and the channel (HTTP or MCP). The parameters you send and the results returned are stored encrypted for a short period, normally up to 24 hours, so that a retried request is not charged twice, and are then deleted. Search terms and public identifiers are forwarded to the upstream supplier that serves the platform.

Payments: Stripe processes your card; we receive and keep the order id, amount, currency, status and Stripe's event identifiers, never card numbers. Security: our hosting provider logs IP addresses and user agents for a limited time; the public demo stores a hashed network identifier to enforce its limits; Cloudflare Turnstile may set a cookie while it checks that a sign-in is not automated.

03 / PRIVACY POLICY

3. How we use it

To provide the service and show you your usage and balance; to bill calls and reconcile payments; to detect abuse, enforce limits and keep accounts secure; to answer support requests; and to meet legal and accounting obligations. We do not use your data to train models and we do not build advertising profiles.

Optional product analytics (PostHog) run only after you choose Allow in the console. They record your entry category, key availability, successful-call categories and settled top-ups under a random identifier; they never include your email, keys, queries, results or browsing URLs. Consent expires after 90 days and can be withdrawn at any time.

04 / PRIVACY POLICY

4. Who processes it

Supabase (authentication and database), Vercel (hosting and request logs), Stripe (payments), Cloudflare (DNS, bot protection and encrypted backup storage), Resend (transactional email), PostHog (analytics, only with your consent) and the upstream data suppliers that serve each platform (TikHub and twitterapi.io), which receive the search terms and public identifiers of your calls but not your identity. Each processor acts under its own agreement with us and its own privacy terms.

These providers operate outside Hong Kong, mainly in the United States and Singapore, so your data is transferred internationally to be processed. We do not share personal data with anyone else unless the law requires it or you ask us to.

05 / PRIVACY POLICY

5. How long we keep it

Account and connector records exist while your account exists. Billing records, including credit purchases and charges, are kept for as long as accounting law requires after the transaction. Encrypted call payloads are deleted after the short retention period above; call metadata stays in your usage history. Server logs are kept by the hosting provider for a limited period. Encrypted backups are kept for a limited period and then overwritten.

06 / PRIVACY POLICY

6. Your rights

You can see your usage, balance and connector in the console at any time. You can ask us to access, correct, export or delete your personal data, or to close your account, by email. Deletion removes your email and sign-in identity; billing records that we must keep by law are retained without linking them to a usable identity. If you are in a jurisdiction with a data protection authority you may also complain to it.

07 / PRIVACY POLICY

7. Cookies, local storage and children

The site sets no advertising or tracking cookies. Your sign-in session and your theme choice are kept in your browser's local storage; the console keeps your connector credential there so that it is never shown again on a page. Turnstile may set a cookie for bot detection during sign-in. The service is not directed at children and you must be at least 18 to use it.

08 / PRIVACY POLICY

8. Changes and contact

When this policy changes, the effective date at the top changes and material changes are announced on the site. Questions and requests about your data go to the address below.

Contact: support@socialtoai.com.