Privacy Policy

1. Introduction

This Privacy Policy explains how SocialFlow ("we", "us") collects, uses, stores, and shares information when you use our website, dashboard, and API (the "Service"). By creating an account or using the Service, you agree to the collection and use of information as described here.

2. Information We Collect

Account information. When you sign up, we collect your name, email address, and password (stored securely by our authentication provider, Supabase).

Instagram data. When you connect an Instagram professional account, Meta issues us an access token along with basic profile data (username, follower count, media) so we can publish posts, read insights, and manage your inbox on your behalf.

Content you upload. Images and videos you upload for scheduling are stored on our media hosting provider (Backblaze B2) so they can be published to Instagram.

Usage data. We collect basic technical data such as IP address, browser type, and pages visited to keep the Service secure and reliable.

3. How We Use Your Information

• To operate core features: scheduling, publishing, inbox, and analytics.
• To authenticate you and keep your account secure.
• To send essential account and verification emails.
• To troubleshoot issues and improve reliability.

We do not use your data to train third-party AI models, and we do not sell your personal information.

4. How We Share Information

We share data only with the service providers necessary to run SocialFlow:

• Meta Platforms, Inc. — to publish content and retrieve insights via the Instagram API.
• Supabase — for authentication and database storage.
• Backblaze B2 — for hosting media files used in publishing.

We may also disclose information if required by law or to protect the rights and safety of our users.

5. Data Storage & Security

Your data is stored on encrypted infrastructure and access to Instagram tokens is restricted to the systems that need them for publishing and messaging. No method of transmission over the internet is 100% secure, but we take reasonable technical and organizational measures to protect your information.

6. Data Retention

We retain your account data for as long as your account is active. If you disconnect an Instagram account, its access token is deleted immediately. If you request account deletion, we remove your data within 30 days, except where retention is required by law.

7. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can:

• Update your profile information anytime from Account Settings.
• Disconnect a connected Instagram account from Settings → Connect Instagram.
• Submit a full data removal request from our Data Removal page.

8. Children's Privacy

SocialFlow is intended for users who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will remove it.

9. Third-Party Services

Your use of connected platforms, including Instagram, is also governed by their own terms and privacy policies, such as Meta's Data Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice before they take effect.

11. Contact Us

Questions about this policy can be sent to legal@socialflow.killua.my.