Privacy Policy

Account information. When you sign in, we use Sign in with Google to authenticate you. We receive and store your email address, display name, and profile photo URL from your Google account, along with Google’s account identifier. We do not receive or store your Google password.

Workspace and team information. If you invite teammates to a workspace, we store the email addresses and roles of invited members, and a record of workspace and brand names you create.

Connected social media account data. To publish and schedule content on your behalf, you may connect third-party accounts, including Facebook Pages, Instagram professional accounts, LinkedIn Pages, and Google Business Profile locations. When you connect an account, we receive and store, via OAuth: the access and refresh tokens needed to act on your behalf (encrypted at rest and never stored or transmitted in plain text); the list of pages, profiles, or business locations you choose to connect, including their platform-assigned IDs and display names; and the specific permissions (“scopes”) you granted during authorization. We only request the minimum scopes needed to discover your pages/locations and publish the content you create — we do not read your private messages, contacts, or any data unrelated to the publishing features of the Service.

Content you create. We store the post drafts, captions, and per-platform overrides you write, along with any images or video you upload (including file metadata such as dimensions, duration, and alt text). Uploaded media is stored in secure cloud object storage.

Publishing activity. We keep records of scheduled jobs, publishing attempts, and the result returned by each connected platform (success, failure, or partial failure), so we can show you accurate status and retry failed publishes.

Billing information. Subscription payments are processed by Stripe. We store your Stripe customer ID, subscription ID, plan, and invoice history — we do not collect or store your full card number, and Stripe’s own privacy policy governs the payment data it holds directly.

Usage and log data. We keep an audit log of significant account actions (for example, connecting or disconnecting an account, publishing a post, or changing a team member’s role), recording who performed the action and when, for security and troubleshooting purposes.

Cookies. We use a single, strictly necessary session cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies, and we do not currently use third-party analytics trackers on the Service.

We use the information above to:

• Authenticate you and maintain your session.
• Let you connect, manage, and publish to your social media accounts and Google Business Profile locations.
• Compose, schedule, validate, and publish the content you create, per platform.
• Show you the status of scheduled and published posts, including errors that need your attention.
• Operate team workspaces, roles, and permissions.
• Process subscription billing and send related notifications.
• Maintain the security, integrity, and reliability of the Service, including detecting abuse.
• Communicate with you about your account, such as service notifications and support requests.

We do not sell your personal information, and we do not use the content of your posts or your connected accounts’ data for advertising purposes.

Soch’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google Business Profile data to display your business locations to you and to publish the posts and updates you create through the Service.
• We do not use this data for advertising.
• We do not allow humans to read this data unless: we have your affirmative consent for specific messages, doing so is necessary for security purposes, or to comply with applicable law.

Our use of information obtained through Meta (Facebook and Instagram) and LinkedIn APIs is subject to and limited by, respectively, the Meta Platform Terms and Data Policy, and the LinkedIn API Terms of Use. We only request the permissions needed to discover the Pages/organizations you administer and to publish the content you author, and we do not use this data to build advertising profiles or sell it to third parties.

We share information only in these circumstances:

• With the platforms you connect — to publish the content you create, we send your posts, captions, and media to Facebook, Instagram, LinkedIn, and/or Google Business Profile, as instructed by you.
• With service providers who process data on our behalf, under contract and only for the purpose of providing the Service, including: cloud hosting and database infrastructure, cloud object storage for media files, Stripe for payment processing, and a transactional email provider for account and notification emails.
• For legal reasons — if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Soch, our users, or others.
• In a business transfer — if Soch is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you of any such change.

We do not sell personal information to third parties.

We retain your account, workspace, and connected-account data for as long as your account is active. If you disconnect a social media account, we delete the associated access tokens and stop syncing new data for that destination. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain records (for example, billing records) to comply with legal, tax, or accounting obligations.

We encrypt connected-account access tokens at rest, restrict internal access to production data on a need-to-know basis, and use industry-standard transport encryption (HTTPS/TLS) for data in transit. No method of storage or transmission is 100% secure, but we work to protect your information using appropriate technical and organizational measures.

• Disconnect accounts: You can disconnect any connected social media account or Google Business Profile at any time from within the Service; this revokes our stored access token for that connection.
• Access and correction: You can review and update your account and workspace information within the Service.
• Deletion: You may request deletion of your account and associated data by contacting us at the email above.

Depending on your location, you may have additional rights under applicable data protection law (such as the UAE Personal Data Protection Law, or the EU/UK GDPR if applicable to you), including the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. Contact us to exercise these rights.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

Soch is based in the UAE, and the Service may be hosted or processed in other countries. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection wherever it is processed.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date above and, where appropriate, through the Service or by email.

Soch
Dubai, UAE
privacy@houseofsoch.com