Privacy Policy

Last updated: 13 September 2026

1. Who we are

SocialAgent is a social media management service operated from Austria. You can reach us at hello@aisocialmedia.at for any privacy question or data request.

2. What we collect

• Account data: your email address and your authentication session.
• Waitlist data: the email address you register, when you joined, and whether your place qualifies for the Founding 100 offer.
• Brand and content data: brand profiles, drafts, platform versions, schedules, carousel slides, uploaded and generated media, and published post records.
• Research data: the URLs you add as sources and the text excerpts retrieved from them, retained so a claim in a draft can be traced back and re-checked.
• Social connections: OAuth access and refresh tokens for the platforms you connect, plus the account username and platform account id.
• AI provider keys: your own OpenAI, Anthropic or Google AI key, and the model you selected.
• Usage data: monthly counts of publications, AI generations and stored bytes, used to enforce plan allowances.
• Operational logs: request and error telemetry needed to run and debug the service.

3. Your AI keys and platform tokens

AI provider keys and social platform tokens are encrypted at rest. After you save a key it is never returned to your browser again — the workspace shows only a short hint such as the last four characters. Keys are used solely to call the provider you selected, and tokens solely to publish on your behalf to the accounts you authorized.

We do not resell AI credits, and we do not train models on your content.

4. How we use your data

To run the service: storing your waitlist place, contacting you about the SocialAgent launch and any founder offer attached to your email, storing your brands and drafts, generating content when you ask, publishing at the times you schedule, enforcing plan allowances, sending you operational notifications, and providing support. We do not sell your data and we do not use it for advertising.

5. Where data is stored

SocialAgent runs on Cloudflare Workers, with Cloudflare D1 for structured data and Cloudflare R2 for media, inside the EU. Calls to the AI provider you chose go to that provider under your own account and their terms.

6. Media sharing

Your media is private by default. Publishing an image or carousel to a platform requires that the platform can fetch the file, so at publish time SocialAgent mints a random, hashed, time-limited share link valid for up to 24 hours, then cleans it up. No permanently public media URLs are created.

7. Sub-processors

• Cloudflare — hosting, database, object storage and access control.
• The AI provider you connect — OpenAI, Anthropic or Google, under your own account.
• Meta and X — when you publish to Instagram, Threads or X.
• Our email provider — for login links and service notifications.

8. Data retention

We keep waitlist data until launch and, if you qualify for the Founding 100 offer, for as long as needed to honour that offer. You can ask us to remove your waitlist entry at any time. We keep account data while your account is active. You can delete individual content, media, sources, connections and whole brands at any time from the workspace; deleting a brand removes its drafts, media, connections and sources. When you close your account we remove your data within 30 days, except where we are required to retain records for legal or accounting reasons.

9. Your rights

Under the GDPR you can request access to, correction of, export of, restriction of, or deletion of your personal data, and you can object to processing. Email hello@aisocialmedia.at and we will respond within one month. You also have the right to complain to your local data protection authority.

10. Cookies and analytics

Strictly necessary. The application at app.aisocialmedia.at sets one cookie to keep you signed in. It is required for the service to work, so it needs no consent and cannot be switched off.

Analytics — only with your consent. This marketing site uses Google Analytics 4 (property G-M5R6W27H7V) to count visits and see which pages people read. The script is not loaded and no cookie is set until you press Accept on the cookie banner. If you decline, or simply ignore the banner, nothing is loaded and no data is sent to Google.

• _ga — distinguishes one browser from another so repeat visits are not counted twice. Expires after 2 years.
• _ga_M5R6W27H7V — keeps the state of the current visit. Expires after 2 years.

With your consent, Google Analytics processes your IP address (from which Google derives an approximate location and then discards it), the pages you view, the referring page, and basic device and browser information. We use it only as aggregate statistics. We do not run advertising, remarketing or cross-site tracking, we have not linked this property to Google Ads or Google Signals, and we do not sell or share this data.

Legal basis: your consent under Art. 6(1)(a) GDPR and § 165(3) TKG 2021. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor; data may be transferred to Google LLC in the United States on the basis of the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Storage of your choice: your answer to the banner is kept in your browser's local storage under sa-analytics-consent, not on our servers, so we can stop asking.

Withdrawing consent. Click Cookie settings at the bottom of any page and choose Decline. That deletes the Google Analytics cookies and stops any further measurement immediately. Withdrawal is as easy as consent and does not affect the lawfulness of processing before you withdrew. Clearing your browser data has the same effect and brings the banner back.

11. Changes

If we make a material change to this policy we will notify you by email or in the app before it takes effect.

12. Contact

Questions about privacy? Email hello@aisocialmedia.at.