Privacy Policy

This Privacy Policy explains how Sociary ("Sociary", "we", "us") collects, uses, stores, and protects your information when you use our web application and services at https://sociary.cloud(the "Service"). Sociary is an analytics and content-planning assistant that helps creators understand and grow their Instagram and TikTok presence.

This Policy is designed to meet the requirements of the EU General Data Protection Regulation (GDPR) and applicable German data protection law. By using the Service you acknowledge this Policy. If you do not agree, please do not use the Service.

1. Data controller

The controller responsible for processing your personal data is:

Marco Pollmann
Schwalenbergstr. 7
33428 Marienfeld
Germany
Email: info.twoclouds@gmail.com

2. Information we collect

Account information

When you create an account we collect your email address and, if you choose, your name and profile details. You may sign in with email or Google OAuth. Authentication and session management are handled by Supabase on our behalf.

Data from connected platforms (TikTok & Instagram)

When you connect a TikTok or Instagram account, you authorize us through the platform's official OAuth flow to access certain data on your behalf. Depending on the permissions you grant, this may include:

• Your public profile information (e.g. username, display name, avatar, follower count).
• Your posts/videos and their performance metrics (e.g. views, likes, comments, shares, reach).
• Content you choose to publish or schedule through Sociary, including captions and media you provide.
• OAuth access and refresh tokens needed to call the platform APIs on your behalf.

We only access data for accounts you explicitly connect, and only for the scopes you approve. We do not collect data about other users without their authorization.

Profile & preferences

Information you enter to personalize recommendations (e.g. account type, niche, goals, target audience) is stored to tailor the Service.

Content you upload

Videos, images, drafts, and other media you upload or generate through the Service (e.g. hook clips, demo videos, character assets) are stored in our infrastructure so you can use scheduling, library, and publishing features.

Billing information

If you subscribe to a paid plan, payment processing is handled by Stripe. We receive subscription status, plan information, and a Stripe customer reference from Stripe. We do not store full payment card numbers on our servers.

Technical and usage data

We collect limited technical data necessary to operate and secure the Service, such as server logs, request metadata, and browser/device information generated when you use the app.

3. Cookies and similar technologies

We do not use third-party marketing, analytics, or advertising trackers (such as Google Analytics, Meta Pixel, or similar tools).

We use only cookies and local storage that are technically necessary to operate the Service, including:

• Authentication and session cookies from Supabase to keep you signed in.
• Short-lived OAuth state cookies when you connect TikTok or Instagram, to protect the authorization flow.

These cookies are required for core functionality. Without them, sign-in and account connection would not work.

4. How we use your information

• To provide analytics, insights, trends, and recommendations.
• To publish or schedule content to your connected accounts when you request it.
• To generate AI-assisted suggestions, chat responses, captions, and media features based on your account data and preferences.
• To process subscriptions and manage billing through Stripe.
• To operate, maintain, secure, and improve the Service.
• To communicate with you about your account and the Service.

We do not sell your personal data, and we do not use data obtained through the TikTok or Instagram APIs for advertising or for any purpose other than providing the features you use within Sociary.

5. Legal bases (GDPR)

We process personal data on the following legal bases:

• Contract (Art. 6 (1) (b) GDPR): to provide the Service, manage your account, connect platforms, schedule or publish content, and handle subscriptions you purchase.
• Consent (Art. 6 (1) (a) GDPR): where you explicitly connect a social account or authorize optional processing steps.
• Legitimate interests (Art. 6 (1) (f) GDPR): to secure the Service, prevent abuse, and improve reliability, balanced against your rights.
• Legal obligation (Art. 6 (1) (c) GDPR): where we must retain or disclose data under applicable law.

6. Use of TikTok and Instagram data

Our use of information received from the TikTok APIs adheres to the TikTok Developer Terms of Service and related policies. Our use of information received from the Meta / Instagram APIs adheres to the Meta Platform Terms and Developer Policies. We access, store, and use this data solely to provide Sociary's features to you.

7. Processors and third-party services

We use the following service providers to operate Sociary. They process data only on our instructions and for the purposes described below:

• Supabase — authentication, database, and file storage. We use Supabase infrastructure in the European region for hosting core user data.
• Netlify — application hosting and delivery of the web app.
• Stripe — payment processing and subscription management for paid plans.
• DeepSeek — AI model provider used for chat, recommendations, and text generation. Relevant account context may be sent to generate a response.
• fal.ai — AI media generation for features such as character image generation and hook video swap processing. Media you submit for these features may be transmitted to fal.ai.
• Google— only if you choose "Continue with Google" for authentication via Supabase OAuth.
• TikTok and Meta/Instagram — the platforms whose APIs you connect for analytics and publishing.

Some providers may process data outside the European Economic Area (EEA). Where required, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms offered by the respective provider.

8. Data retention

We keep your data for as long as your account is active or as needed to provide the Service. You can disconnect a platform at any time in Settings, which removes the stored access tokens for that platform. When you delete your account, we delete or anonymize your personal data, except where retention is required by law (e.g. tax or billing records).

9. Your rights under the GDPR

If you are in the EU/EEA (or otherwise covered by the GDPR), you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your data, subject to legal retention requirements.
• Restriction — request limited processing in certain cases.
• Data portability — receive data you provided in a structured, commonly used format where applicable.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
• Disconnect platforms— revoke Sociary's access in Settings and/or in your TikTok / Instagram app settings at any time.

To exercise these rights, contact us at info.twoclouds@gmail.com. You also have the right to lodge a complaint with a supervisory authority. The lead authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), unless another authority is competent in your case.

10. Security

We use industry-standard measures, including encryption in transit and access controls, to protect your data. No method of transmission or storage is completely secure, but we work to protect your information.

11. Children

The Service is not directed to individuals under the age required to hold a TikTok or Instagram account in their jurisdiction, and we do not knowingly collect data from them.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

13. Contact

For privacy questions or data requests, contact info.twoclouds@gmail.com. Provider details are also listed in our Imprint.