Privacy Policy

This Privacy Policy explains how Social Agent ("Social Agent", "we", "us") collects, uses, shares and protects personal information when you visit socialagent.space, use the Social Agent web application or API, or interact with a business that uses Social Agent. We process personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other laws that apply to us.

1. Our two roles

• Responsible party. For the personal information of people who visit our website, sign up, buy a plan or contact us, we decide how and why it is processed. This policy describes that processing.
• Operator for our customers. Businesses use Social Agent to talk to their own customers and contacts, for example on WhatsApp or social media. For that information ("Customer Content"), the business is the responsible party and we process it on its behalf, under our Terms of Service. If you are a contact of a business that uses Social Agent, please direct privacy requests to that business first. We will help it respond.

2. Information we collect

Information you give us

• Account details: name, email address, password (stored only as a secure hash by our identity service), organisation name and role.
• Workspace content: chats with the AI agent, drafts, posts, campaigns, workflows, files, knowledge documents and settings you create.
• Contacts you import or collect: phone numbers, names, attributes, consent and opt-out status.
• Integration details: the settings and credentials you provide to connect email, databases, servers and APIs. Credentials are encrypted at rest and never shown to the AI or in the browser.
• Billing details: plan, invoices and billing contact. Payments are handled by our payment providers. We work with multiple local and international providers, chosen to suit the plan and the client, and we do not receive or store full card numbers.
• Messages you send us, such as support requests and contact forms.

Information from connected platforms

When you connect an account, we receive the information that platform shares under the permissions you approve, for example:

• Meta (Facebook, Instagram and WhatsApp): Page and account profiles, posts, comments and messages, insights and advertising performance, and WhatsApp Business account details, phone numbers, message templates, messages and delivery statuses.
• X, LinkedIn, TikTok and YouTube: profile information, published posts or videos, and engagement and analytics data.
• Your WhatsApp provider, if you connect one instead of Meta directly: messages, delivery statuses and number details.

Information collected automatically

• Log and device data: IP address, browser and device type, pages visited, and dates and times of requests, which we use for security, troubleshooting and capacity planning.
• Product analytics: how features are used, through our analytics provider PostHog, to improve the Service.
• Cookies and similar technologies (see section 11).

3. How we use personal information

• To provide the Service: create and secure accounts, run workspaces, send and receive messages, publish posts, run workflows and show analytics.
• To run AI features you use (see section 4).
• To process payments, manage plans and send invoices.
• To keep the Service safe: detect abuse, prevent fraud, enforce our Terms and investigate security incidents.
• To support you and to send service messages such as security alerts, billing notices and important changes.
• To improve the Service, using aggregated or de-identified usage information where possible.
• To send product news and offers, only where the law allows it. Every marketing email has an unsubscribe link.
• To meet legal obligations, such as tax records and lawful requests from authorities.

We rely on the lawful grounds in POPIA section 11: performance of our contract with you, your consent where we ask for it, our legitimate interests (for example security and product improvement) where they are not outweighed by your rights, and compliance with the law.

4. AI processing

When you use the AI agent, Ask AI or an AI workflow step, we send the content needed for that request (for example the conversation, your instructions and relevant workspace context) to a third-party large language model provider through our AI gateway, OpenRouter, and return the result to you.

• We never send stored passwords, tokens or keys to an AI provider. Tools run on our servers, and only their results reach the model.
• We do not use your workspace content to train AI models.
• We choose model providers and settings with data protection in mind, and we send only what a request needs.

5. Who we share it with

We do not sell personal information. We share it only as follows:

Our service providers act on our instructions under agreements that require them to protect personal information and use it only to provide their services.

6. Cross-border transfers

Some of our service providers store or process information outside South Africa. When we transfer personal information across borders, we do so in line with POPIA section 72, for example where the recipient is bound by law, binding corporate rules or an agreement that provides an adequate level of protection, or where the transfer is needed to perform our contract with you.

7. How long we keep it

• Account and workspace data: for as long as your account or workspace is active. After a workspace is deleted, we delete or anonymise its data within a reasonable period, unless the law requires us to keep it.
• Developer event logs: 30 days by default. Workspace owners can set between 1 and 365 days.
• Opt-out and suppression records: kept for as long as needed to make sure an opted-out person is not messaged again.
• Backups: encrypted backups roll over on a fixed schedule, so deleted data disappears from them over time.
• Billing records: for the period tax and accounting laws require.

8. How we protect it

• Encryption in transit (TLS) on every public connection and a private, encrypted network between our servers.
• Credentials and secrets held in a dedicated secrets manager and encrypted at rest, never exposed to the AI, the browser or logs.
• Single sign-on through a dedicated identity service, role-based access within each workspace, and approvals for sensitive actions.
• Strict tenant isolation: every query is scoped to the workspace it belongs to.
• An audit trail of actions, monitored infrastructure, and encrypted off-site backups.

No system is completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA section 22 requires. Read more on our Security page.

9. Your rights

Under POPIA you may:

• ask whether we hold personal information about you and request a copy;
• ask us to correct, update or delete it;
• object to processing on grounds of legitimate interest, and to direct marketing at any time;
• withdraw consent where we rely on it, without affecting earlier processing;
• lodge a complaint with the Information Regulator.

To make a request, email [email protected]. We may need to confirm your identity first, and we will respond within a reasonable time. If you are a contact of one of our customers, we will pass your request to that business and help it respond.

Information Regulator (South Africa): inforegulator.org.za.

10. Disconnecting accounts and deleting data

• Disconnect a channel: in the app, open the integration and choose Disconnect. We stop accessing that account and delete its stored access tokens.
• Revoke on the platform: you can also remove Social Agent in the platform's own settings, for example Facebook Settings, then Apps and websites, or your Google account's third-party access page.
• Delete data: you can delete posts, contacts and other content in the app, erase an individual contact (their messages are anonymised), or ask us to delete your workspace or account by emailing [email protected]. We confirm when the deletion is complete.

Google and YouTube. If you connect a YouTube channel, Social Agent uses YouTube API Services, and you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy. You can revoke our access at any time from your Google security settings.

11. Cookies

We use cookies that are needed to sign you in and keep your session secure, and to remember preferences such as your theme. We also use product analytics cookies to understand how the Service is used. You can block or delete cookies in your browser settings, but the app needs its sign-in cookies to work.

12. Children

Social Agent is a business service for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new date and, for material changes, tell you by email or in the app before they take effect.

14. Contact us

Questions, requests or complaints about privacy: [email protected]. Our Information Officer can be reached at the same address.