Privacy policy

Socials Creator (socialscreator.com and app.socialscreator.com) is a service of Soluciones Educativas Digitales, S.L., the controller of your personal data:

• Company name: Soluciones Educativas Digitales, S.L.
• Tax ID (CIF): B22499735
• Registered address: Paraje Flores Bonete, no. 648, 30400 Caravaca de la Cruz (Murcia), Spain
• Data protection contact: info@socialscreator.com (subject “Data protection”)

This policy covers the Socials Creator website, app and Instagram and Facebook integration. We have not appointed a data protection officer because we are not required to; our team handles any privacy question at the address above.

When you upload content that contains other people's data to Socials Creator (for example, photos of your customers or your team), you decide what to upload and why, and you are responsible for having permission to do so. For that data you are the controller and we are your processor: we process it only to provide the service, following your instructions, under the data processing section of the terms of service.

This English version is provided for convenience. If there is any discrepancy, the Spanish version prevails.

Your account

• Name, email and password. The password is stored hashed (bcrypt): nobody, including our team, can read it.
• If you sign in with Google: the name, email and profile picture Google shares with us. We never receive your Google password.
• Language and app preferences.

Subscription and payments

• Plan, credits, subscription status, and payment and invoice history.
• Payment and billing details (card, name, address and, if you provide it, tax number) are collected directly by Stripe on its checkout page. We never see or store your full card number; we only keep the customer and subscription IDs Stripe gives us.

What you create in Socials Creator

• Your brands: name, website, logos, colors, fonts, description, tone and, if you ask us to analyze your website, that website's public content and screenshots.
• Projects, copy, ideas, hashtags, calendar, templates, images and videos you upload or generate, and the instructions you give the AI.
• Avatars: photos of people you upload or create with AI to use in your designs.

Instagram and Facebook

If you connect an Instagram account or a Facebook Page, the data described in Connecting Instagram and Facebook.

Technical and usage data

• Credits used and a log of each AI call (provider, model, cost and duration, without the content).
• Error logs so we can fix problems (page, error message and, if you were signed in, your user ID).
• Our own cookieless visit statistics: page visited, where you came from (referring site and campaign), country, device type, browser and operating system. To count visits without tracking you we use a code computed from your IP and browser that changes every day; the IP is not stored.
• When you sign up, which channel or campaign you came from.
• If you accept analytics cookies, Google Analytics (see the cookie policy).

Communications

The emails we send you about your account and the service (for example, the welcome email or notices of important changes) and anything you write to us when asking for help. Payment receipts may be sent by Stripe.

We don't send you marketing emails without your consent and we don't sell your data. We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR): the AI only generates the content you ask for.

To generate copy, images, videos and voices, Socials Creator sends AI providers what each request needs: your instructions, the brand details you use, the text and images you upload or pick as a reference (logos, photos, avatars) and, if you ask us to analyze a website, its content.

• Providers: Google (Gemini), Anthropic (Claude), OpenAI, xAI (Grok) and Replicate (third-party video models hosted on Replicate). Each feature uses the one that does it best.
• No training:we use their business APIs, whose terms don't allow providers to use the content we send them to train their models. They may keep it for a limited time to monitor abuse, under their own terms.
• Review the output: AI can make mistakes. Check what it generates before you publish it.
• Photos of people:they are only used to create the design you ask for. We don't use them to identify anyone or for biometric purposes. Don't upload photos of people without their permission.
• Avoid sensitive data:don't include health data, beliefs or other special categories, or third-party data you don't need, in your instructions.

You can connect a professional Instagram account (business or creator) and a Facebook Page you manage to publish from Socials Creator. Both are connected at once on Meta's sign-in screen, where you choose the account, the Page and the permissions you grant. We never see your Instagram or Facebook password.

• What we store from Instagram: the account ID, username, profile picture and the access token Meta gives us.
• What we store from your Facebook Page: the Page ID, its name, its picture and the Page access token Meta gives us.
• How we store the tokens: encrypted (AES-256-GCM). They are never sent to the browser.
• Permissions we ask Meta for:instagram_basic (to identify your Instagram account and, in competitor analysis, read public data of other professional accounts), instagram_content_publish (to publish to your Instagram account), instagram_manage_insights (required by Meta to read the public metrics of the accounts you add to competitor analysis), pages_show_list (to list the Pages you manage so we can find yours and its linked Instagram account), pages_manage_posts (to publish to your Facebook Page) and pages_read_engagement (to read the Page's basic details and the link of what you publish).
• What for: publishing on your behalf the posts, carousels or stories you decide to publish (stories only on Instagram), and showing you in the app which account and Page are connected. Nothing is published until you press “Publish”, and for each post you choose whether it goes to Instagram, your Facebook Page or both. For each post we keep its ID, link and date so we can show it in your history.
• What we don't do:we never publish anything you didn't ask for, we don't read your messages or your Page's comments, and we don't use Instagram or Facebook data for advertising or share it with third parties.
• Disconnect: go to Settings → Instagram and Facebook → “Disconnect”. The tokens, IDs, names and pictures of the Instagram account and the Facebook Page are deleted immediately. You can also remove access from Instagram or Facebook, under “Apps and websites” or “Business integrations”.

What you do on Instagram and Facebook is also governed by Meta's privacy policy; Meta acts as an independent controller of its platform.

Socials Creatoroffers a competitor analysis feature: you can add professional (Business or Creator) Instagram accounts you choose, such as competitors or accounts you look up to, to see their best posts, when they post, which hashtags they use and what topics they cover. To do this we query, through Meta's Business Discovery API and the Instagram account you have connected, only public information about those accounts. This is what we store:

• Public profile: username, name, profile picture (only its link), and follower and post counts.
• For each of their latest ~100 public posts: caption, type (image, carousel or video), date, link, thumbnail link, and like and comment counts and, for Reels, view counts.
• The result of the AI action plan, if you ask for it: the topics (names and which posts each one contains), the conclusions and the post ideas.

Your own account, to compare yourself:if you add your account to the comparison (“You vs. competitor”), we read in the same way, through Business Discovery, the public data of the Instagram account you have connected (the same public profile and your latest ~100 posts with their counts), and we keep it under the same rules as a competitor's. It doesn't count as a competitor or towards your plan's limit.

This API only works with professional accounts, which publish to promote themselves. We don't access personal or private accounts, follower lists, messages, comments or the people who interact with the posts, and we don't store bios or contact details. The data is shown only to the person who runs the analysis. To prepare the action plan (which includes grouping posts into topics), and only when you ask for it, we send the captions and counts of those posts, and the name, sector and description of the brand you assign the competitor to, to our text AI provider (see “Service providers and international transfers”).

How long we keep it:each refresh replaces the previous one (anything the account deletes from Instagram disappears from our copy). If an account isn't refreshed for 30 days, we delete its posts, topics and action plan. We also delete them when you remove that competitor, when you disconnect Instagram and when you delete your account. The copy of your own account follows the same rules and is also deleted every time you reconnect Instagram.

Legal basis: the legitimate interest of the person running the analysis, and ours, in studying public information about professional activity (Art. 6(1)(f) GDPR). We have balanced it against your rights: the account itself makes this data public for commercial purposes, it is limited to metrics and posts, and it is not used to profile individuals or for advertising.

If you own one of those accounts, you can object or ask us to delete what we hold about it by writing to info@socialscreator.com. This policy is the information required by Article 14 GDPR when data is not obtained from the data subject; its source is your public Instagram profile.

We work with these providers, which process data on our behalf under a data processing agreement (Art. 28 GDPR) and only to provide their service to us:

When a provider processes data outside the European Economic Area, the transfer relies on the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) if the provider is certified, or on the standard contractual clauses approved by the European Commission.

Meta (Instagram and Facebook) is not our provider: when you publish or look up data on Instagram or Facebook, Meta processes that data as an independent controller. When you edit content, your browser downloads fonts from Google Fonts servers, which receive your IP address.

We would only disclose data to authorities or other third parties if the law requires it. We never sell or rent personal data.

You can exercise these rights over your data at any time:

• Access: know what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing based on legitimate interest.
• Restriction: ask us to stop using your data while a complaint is resolved.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent you have given (for example, for analytics cookies), without affecting what was done before.

Write to info@socialscreator.com from your account email with the subject “Data protection”. It's free and we'll reply within one month (extendable by two more months for complex requests, in which case we'll let you know). If you don't write from your account email, we may ask for the minimum needed to confirm your identity. You can correct or delete much of your data (brands, projects, images) yourself in the app.

If you think we haven't respected your rights, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority in your country.

• Only your Instagram and Facebook data: go to Settings→ Instagram and Facebook → “Disconnect”. The access tokens, IDs, names and pictures of the Instagram account and the Facebook Page are deleted immediately. To also remove the permission on Meta's side, open your Instagram or Facebook settings, go to “Apps and websites” or “Business integrations”, and remove Socials Creator.
• Specific content: you can delete your projects, images, videos, brands, templates and avatars at any time in the app.
• If you don't have an account (for example, you own an Instagram account someone has analyzed), email info@socialscreator.com with the username.

After deletion we only keep what the law requires us to keep (invoices and tax data) and statistics that no longer identify you (errors, AI cost, visits and payment events, with no link to your account).

Socials Creatoris a service for professionals and businesses, intended for people aged 18 or over. It is not meant for minors and we don't knowingly collect data from children under 14 (Art. 7 of the Spanish Data Protection Act, LOPDGDD). If we find an account belonging to a child under that age, we will delete it.

We apply technical and organizational measures appropriate to the risk (Art. 32 GDPR), including:

• Encrypted connections (HTTPS) between your device and our servers.
• Passwords hashed with bcrypt and a limit on sign-in attempts.
• Instagram and Facebook Page tokens encrypted with AES-256-GCM.
• Database and files with providers that encrypt stored data.
• Access to data limited to authorized staff bound by confidentiality.

Images and videos are served through hard-to-guess links (so Meta can download them to publish them on Instagram or Facebook): anyone with the exact link to a file can view it. Don't share those links if you don't want others to see the file.

If a security breach affects personal data, we will notify the Spanish Data Protection Agency within 72 hours and let you know if it poses a high risk to you (Arts. 33 and 34 GDPR).

We use the cookies needed for the website and the app to work and, only if you accept them, Google Analytics cookies. See the details and change your choice in the cookie policy.

If we change anything important, we'll publish the new version here with its date and, if it affects how we use your data, let you know by email or in the app before it applies.

Soluciones Educativas Digitales, S.L. · Tax ID B22499735 · Paraje Flores Bonete, no. 648, 30400 Caravaca de la Cruz (Murcia), Spain · info@socialscreator.com