Privacy Policy
Last updated: October 4, 2026
Your privacy is of utmost importance to us. This Privacy Policy outlines how SociallFlow ("SociallFlow," "we," "us," or "our"), accessible at https://www.sociallflow.com, collects, uses, protects, and discloses your personal data when you use our social media management and automation platform.
Official Application Identification & Privacy Commitment
This application is officially named SociallFlow and is hosted on the primary domain sociallflow.com. We adhere strictly to international privacy frameworks including the General Data Protection Regulation (GDPR) and the developer policies of our integration partners, including the TikTok Developer Terms.
Table of Contents
- Data Controller & Contact Details
- Information We Collect
- TikTok API Data Collection, Use & Privacy Policy
- TikTok Data Deletion & Revocation Instructions
- How We Use Your Data
- Legal Basis for Processing (GDPR)
- Data Sharing and Third Parties
- Data Retention Schedule
- Your Rights Under GDPR & Privacy Laws
- Data Security Measures
- International Data Transfers
- Cookies & Tracking Technologies
- Children's Privacy
- Changes to This Privacy Policy
- Contact Us & Data Protection Officer
1. Data Controller & Contact Details
SociallFlow ("we," "us," or "our"), operating via https://www.sociallflow.com, is the data controller responsible for the personal data collected through the Service. We are committed to processing your personal data lawfully, transparently, and securely in full compliance with the General Data Protection Regulation (EU GDPR) and other applicable privacy regulations.
Data Controller Information:
Entity: SociallFlow
Website: https://www.sociallflow.com
Data Protection Officer / Inquiries: privacy@sociallflow.com
Customer Support: support@sociallflow.com
2. Information We Collect
We collect personal information that you provide directly, data generated through your use of SociallFlow, and data received via authorized third-party APIs:
2.1 Account & Profile Information
- Name, business or store name, and industry category;
- Email address and encrypted authentication credentials;
- Profile settings and workspace preferences.
2.2 Connected Social Media Account Data
When you choose to connect social media channels to SociallFlow (including TikTok, Facebook, Instagram, and LinkedIn), we receive authorized tokens and metadata through official OAuth 2.0 flows:
- Unique platform user IDs (e.g., TikTok open_id / union_id);
- Public profile names, display handles, and avatar image URLs;
- OAuth access tokens and refresh tokens required to publish content on your behalf;
- Aggregated post engagement statistics (impressions, likes, video views, comments).
2.3 User Content & Media Assets
- Text captions, hashtags, and scheduling timestamps;
- Videos and images uploaded to our media library for publishing;
- AI generation prompts and campaign planning notes.
2.4 Technical & Usage Information
- Browser type, device operating system, and IP address;
- System logs, performance metrics, and feature interaction timestamps.
3. TikTok API Data Collection, Use & Privacy Policy
SociallFlow provides integration with the TikTok Content Posting API and TikTok Login Kit to allow users to schedule, automate, and publish video content directly to their TikTok accounts. This section details our explicit handling of TikTok user data:
3.1 TikTok Data Accessed
Through your explicit authorization during the TikTok OAuth 2.0 consent flow, SociallFlow accesses only the permissions (scopes) necessary for service operation:
- Basic Profile Information (
user.info.basic): TikTokopen_id,union_id, display name, and avatar URL to identify your connected account within SociallFlow. - Content Publishing (
video.publish/video.upload): Authorization to upload and publish video content and captions to your TikTok account as scheduled by you. - Creator Information (
creator_info/query): Basic verification of creator account status to ensure video formats meet TikTok requirements.
3.2 How We Use TikTok Data
We strictly use your TikTok data for the following specific purposes:
- Displaying your connected TikTok handle and avatar in the SociallFlow dashboard;
- Uploading, publishing, and scheduling your video posts in accordance with your explicit scheduling settings;
- Displaying post status and publishing confirmations.
3.3 What We DO NOT Do with TikTok Data
Our Strict Data Protection Commitments:
- We never sell, rent, lease, or monetize TikTok user data or profile information to any third parties or data brokers.
- We never use TikTok data for surveillance, profiling, cross-site behavioral targeting, or unauthorized advertising.
- We never access or store your TikTok account password. Authentication is strictly handled via TikTok's official OAuth 2.0 consent dialog.
- We do not transfer TikTok data to any unauthorized external systems.
3.4 Storage & Encryption of TikTok Credentials
TikTok OAuth access tokens and refresh tokens are stored in our secure database with industry-standard encryption (AES-256) at rest and TLS 1.3 encryption in transit. Tokens are accessible solely by automated backend workers tasked with dispatching your scheduled publications.
3.5 Compliance with TikTok Developer Policies
Our integration operates in strict compliance with the TikTok Developer Terms of Service and the TikTok Privacy Policy.
4. TikTok Data Deletion & Revocation Instructions
In compliance with TikTok developer rules and GDPR regulations, users have absolute control over their connected TikTok accounts and associated data. You can disconnect your account or request immediate data deletion at any time:
Option A: Disconnect Within SociallFlow
- Log in to your SociallFlow dashboard at https://www.sociallflow.com.
- Navigate to Dashboard > Connections (or Settings > Social Accounts).
- Find your TikTok account card and click Disconnect.
- SociallFlow will immediately delete your stored OAuth access and refresh tokens from our active database.
Option B: Revoke Authorization Directly on TikTok
- Open the TikTok mobile app.
- Go to your Profile tab in the bottom right corner.
- Tap the Menu icon (three horizontal lines) in the top right > select Settings and Privacy.
- Tap Security > tap Manage App Permissions.
- Locate SociallFlow in the list of authorized apps and tap Remove Access.
Option C: Request Complete Data Purge via Email
If you wish to have all stored data, tokens, and metadata permanently erased from our records, simply send an email to:
Email: privacy@sociallflow.com
Subject: TikTok Data Deletion Request
Please include your registered SociallFlow email address and TikTok handle. We will permanently purge all associated data within 30 calendar days and send you confirmation.
5. How We Use Your Data
We process your personal information strictly for legitimate business and operational purposes:
- Core Functionality: To deliver scheduled publishing, content generation, and multi-platform automation across your connected accounts.
- Account Administration: To create, manage, and safeguard your account profile.
- Performance Analytics: To calculate aggregated reach, follower growth, and post performance metrics for your business dashboard.
- Customer Support: To resolve technical inquiries, answer support requests, and address platform issues.
- System Reliability & Security: To detect abuse, prevent unauthorized access, and ensure server integrity.
6. Legal Basis for Processing (GDPR)
Under Regulation (EU) 2016/679 (GDPR), we rely upon the following legal bases:
- Contractual Performance (Art. 6(1)(b)): Processing necessary to fulfill our Terms of Service and execute requested social media publishing.
- Consent (Art. 6(1)(a)): For OAuth account linking, optional analytics cookies, and marketing updates (which you may withdraw at any time).
- Legitimate Interests (Art. 6(1)(f)): To secure our infrastructure, prevent fraud, and optimize platform reliability.
- Legal Obligation (Art. 6(1)(c)): To comply with applicable tax, financial, and regulatory requirements.
7. Data Sharing and Third Parties
We do not sell personal data. We only disclose personal information to trusted third-party service providers bound by strict data processing agreements:
- Social Media Platforms: TikTok, Meta (Facebook & Instagram), and LinkedIn to execute user-directed publishing.
- Cloud Infrastructure & Database: Vercel and Supabase for reliable, encrypted cloud hosting.
- Payment Processing: Stripe for secure, PCI-DSS compliant payment transactions.
- AI Sub-processors: OpenAI for natural language drafting assistance (no personal identifiers are used to train external models).
8. Data Retention Schedule
We store personal information only for the duration required to satisfy the purposes specified in this policy:
- Account Profile & Tokens: Retained while your account remains active. Tokens are deleted immediately upon account disconnection or deletion request.
- Scheduled Media Assets: Retained until published or manually deleted from your media library.
- Billing & Invoicing Records: Stored for statutory accounting periods (up to 7 years) in accordance with applicable tax laws.
9. Your Rights Under GDPR & Privacy Laws
You possess comprehensive rights regarding your personal data under the GDPR:
- Right of Access: Request a full copy of the personal data we hold about you;
- Right to Rectification: Request correction of inaccurate or incomplete records;
- Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your personal data;
- Right to Restriction: Request restriction of data processing under certain circumstances;
- Right to Data Portability: Receive your data in a structured, machine-readable format;
- Right to Object: Object to processing based on legitimate interests;
- Right to Withdraw Consent: Revoke consent at any moment without affecting prior lawful processing.
To exercise any of these rights, contact our Data Protection Officer at privacy@sociallflow.com. We respond to all verified requests within thirty (30) days.
10. Data Security Measures
We implement robust technical and organizational security protocols to safeguard your information:
- End-to-end TLS 1.3 encryption for all data in transit;
- AES-256 encryption at rest for authentication tokens and database storage;
- Strict role-based access control and principle of least privilege;
- Continuous monitoring, automated security patches, and vulnerability scanning.
11. International Data Transfers
If data is transferred outside the European Economic Area (EEA), we implement legally recognized safeguards, including European Commission Standard Contractual Clauses (SCCs) and adequacy decisions, to ensure equivalent standards of data protection.
13. Children's Privacy
SociallFlow is a business application intended strictly for individuals aged 16 and older. We do not knowingly collect personal information from minors. If you suspect that a minor has provided us with personal information, please notify us immediately at privacy@sociallflow.com for prompt removal.
14. Changes to This Privacy Policy
We may revise this Privacy Policy periodically to reflect technological improvements, operational requirements, or regulatory changes. We will notify users of material modifications by updating the "Last updated" date and providing in-app notifications.
15. Contact Us & Data Protection Officer
For questions, concerns, or requests concerning this Privacy Policy or your personal information, please reach out to our team:
SociallFlow Privacy & Data Protection Office
Website: https://www.sociallflow.com
Privacy Officer: privacy@sociallflow.com
Support Desk: support@sociallflow.com
EU citizens also retain the statutory right to lodge a complaint with their local supervisory authority (such as the CNIL in France or the relevant national DPA).