Privacy Policy

1. Who we are

SocialGrip is operated by Eldritch Logic, LLC, a Texas limited liability company. For data protection purposes we are the controller of the personal information described below.

25710 Loop 494, Apt 318, Kingwood, TX 77339, United States
Privacy questions and data requests: [email protected]

2. What we collect

Account information

Your name, email address, and a hashed form of your password — we never store the password itself. We also keep your workspace name, your role in it, and session records including IP address and browser user agent, which let us keep you signed in and spot suspicious access.

Billing information

Your Stripe customer and subscription identifiers, plan status, and billing period dates. Card details are entered on Stripe’s own hosted checkout page and never reach our servers.

Connected social accounts

When you connect an account we store the platform, whether it is a personal profile or a page, the platform’s account identifier, your handle, display name, avatar URL, the instance or host URL for platforms that have one, and the OAuth access and refresh tokens plus their expiry. Tokens are encrypted at rest with AES-256-GCM and are used only to publish to, and read metrics for, the accounts you connected.

Content you create

Post text, scheduled times, which accounts you target, the result of each publish attempt including any error the platform returned, designs you build in the editor, and the image files you upload.

Performance metrics

Aggregate counts returned by each platform’s API: impressions, reach, likes, comments, shares, saves, clicks, video views, and your follower, following and post totals.

We do not collect, store or process any information identifying your followers, your commenters, or any other individual member of your audience. We do not read your inbox, your direct messages, or the contents of comment threads.

Technical information

Server logs recording IP address, requested path, timestamp and user agent, kept for security and debugging. We do not use analytics, advertising, or tracking technologies of any kind.

3. Why we process it

Where the GDPR applies, our legal basis for each purpose is as follows.

• Running the service — creating, scheduling, publishing and reporting on posts: performance of our contract with you, Article 6(1)(b).
• Connecting a social account and publishing on your behalf: performance of that contract, acting on the authorisation you granted at the platform.
• Generating post drafts with AI, when you ask for one: performance of that contract.
• Keeping billing and tax records: compliance with a legal obligation, Article 6(1)(c).
• Security, abuse prevention and debugging: our legitimate interests in operating a safe service, Article 6(1)(f).

4. Platform data and limited use

Data we obtain from a social platform’s API is used only to deliver the features you asked for: publishing what you create, scheduling it, and showing you how it performed. Specifically:

• We do not sell platform data, or any other personal information, to anyone.
• We do not use platform data for advertising, ad targeting, or building audience profiles.
• We do not use platform data, your content, or your prompts to train machine-learning models, and our AI sub-processor is contractually barred from training on data submitted through its API.
• We do not transfer platform data to data brokers or information resellers, or to any third party other than the sub-processors listed below, which act only on our instructions.
• We keep platform data only while the account is connected. Disconnecting it deletes that data — see Deleting your data.

Our use of information received from Google APIs, which is how the YouTube integration works, adheres to the Google API Services User Data Policy, including its Limited Use requirements. The same commitments apply to data received from Meta, TikTok, LinkedIn, Pinterest, X, Bluesky and Mastodon under their respective platform terms.

5. AI-generated drafts

When you ask SocialGripto draft a post, the idea, tone and target platforms you entered are sent to OpenAI’s API to generate the text. OpenAI acts as our sub-processor and does not use data submitted through its API to train its models. Please do not put sensitive personal information into prompts, and review every draft before you publish it.

6. Who processes data on our behalf

These are the only third parties that process customer data for us. Each acts on our instructions under a data processing agreement.

• Stripe, Inc. — Subscription billing and payment processing. Located in United States. Privacy policy
• Cloudflare, Inc. (R2) — Storage of the images and media you upload. Located in United States. Privacy policy
• OpenAI, L.L.C. — Generating post drafts from the prompts you write. Located in United States. Privacy policy

Everything else — application servers, database, and the background job scheduler — runs on infrastructure we operate ourselves in Texas.

Separately, when you publish a post its content and media are sent to the social platform you chose. Those platforms are independent controllers of what you publish, and their own policies govern it from that point on.

7. Where your data is stored

Your data is stored and processed in the United States, on our own infrastructure in Texas and with the sub-processors above.

If you are in the European Economic Area, the United Kingdom or Switzerland, using SocialGrip means your personal information is transferred to and processed in the United States. For our own processing we rely on Article 49(1)(b) — the transfer is necessary to perform the contract you asked us to perform. Transfers to our sub-processors are covered by Standard Contractual Clauses. We have not appointed a representative in the Union under Article 27; send any request directly to [email protected] and we will handle it.

8. How long we keep it

• Account details and workspace content: for as long as your account exists.
• Connected accounts and their tokens: until you disconnect the account or delete your account.
• Performance metrics: alongside the post they belong to.
• Server logs: up to 90 days.
• After you delete your account: erased immediately, including stored media files. Residual copies may persist in encrypted backups until those backups are rotated out of use.
• Billing and tax records: retained for as long as United States tax law requires, even after account deletion.

9. Your rights

If the GDPR or UK GDPR applies to you, you have the right to access your personal data, correct it, have it erased, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what we collect, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We offer no financial incentives for personal information, and we will never discriminate against you for exercising a right. The categories we collect are identifiers, commercial information, internet activity information, and the content you create; we collect them from you and from the platforms you choose to connect, for the purposes described in section 3.

To exercise any of these rights, delete your data in the product at any time — see Deleting your data — or email [email protected]. We verify requests by requiring them to come from the email address on the account, or by another reasonable check. We respond within 30 days under the GDPR and within 45 days under the CCPA, which we may extend once where the law allows. An authorised agent may act for you with your written permission.

10. Cookies

We set only strictly necessary cookies: the session cookies our authentication system uses to keep you signed in and to protect against cross-site request forgery. We set no analytics, advertising, or third-party tracking cookies, which is why you are not asked to consent to any. Clearing these cookies signs you out.

11. Security

Traffic is encrypted in transit with TLS. Passwords are hashed. OAuth tokens are encrypted at rest with AES-256-GCM. Every request is authorised server-side and scoped to your workspace, so one workspace’s data is never reachable from another. Access to production systems is limited to those who need it.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to [email protected].

12. Children

SocialGrip is not directed at anyone under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The date at the top always reflects the current version, and we will note material changes in the product before they take effect. Continuing to use SocialGrip after a change means you accept the updated policy.

14. Contact us

Eldritch Logic, LLC
25710 Loop 494, Apt 318, Kingwood, TX 77339, United States
[email protected]