Social Command Privacy Policy

Social Command is a multi-user, multi-brand social media operations application. It helps authorized teams organize workspaces, connect social accounts, prepare and approve content, schedule or publish posts, and review available performance information. Some features, including live publishing, analytics, advertising, voice, and AI, are available only when the relevant provider and credentials have been configured by the operator of the deployment.

Depending on how Social Command is configured and used, it may handle:

• Account information: name, email address, authentication provider, profile image, time zone, account role, sign-in activity, and technical information such as IP address and browser or device details. If password sign-in is enabled, the application stores a hashed password, not the readable password.
• Workspace and business information: organization and workspace names, brand profiles, brand voice, content rules, team memberships, roles, permissions, approval records, notifications, and audit records.
• Connected social-account metadata: platform, account or page identifier, display name, username, profile image, connection status, and other metadata returned by an authorized platform.
• OAuth tokens and credentials: access tokens, refresh tokens where a platform provides them, expiration information, and related connection data needed to perform authorized platform actions.
• Posts and media: drafts, captions, variants, tags, schedules, approvals, publishing status, platform settings, uploaded images or video, and provider post identifiers or URLs.
• Analytics and performance information: authorized account and post metrics such as audience, reach, impressions, engagement, views, clicks, and publishing outcomes when the platform makes them available.
• Service and diagnostic information: requests, errors, security events, and product usage or performance measurements. Depending on deployment configuration, monitoring or analytics tools may use cookies or similar technologies.

Social Command uses official platform APIs and OAuth. Users authorize access on the relevant platform. Social Command does not collect or store Facebook, Instagram, TikTok, or other social-account passwords. OAuth tokens are handled server-side and are not returned through the Social Command application programming interface to the browser.

When a user chooses to connect an eligible Facebook Page or Instagram professional account, Meta presents the authorization flow and the user chooses whether to grant the requested permissions. Social Command uses data received from Meta only to provide functionality that the user has authorized, including:

• connecting and identifying authorized Facebook Pages and Instagram accounts;
• creating, scheduling, and publishing authorized content;
• retrieving authorized account, audience, post, and performance analytics; and
• managing authorized account functions, publishing status, and connection health.

Social Command does not use Meta Platform Data to build advertising profiles or sell it. Access is limited to the permissions approved by the user and Meta. Functionality that requires additional Meta permissions, such as advertising management, will remain unavailable unless it is separately configured, reviewed, and authorized.

Where TikTok integration is enabled, users authorize access through TikTok's official OAuth flow. Social Command may use authorized profile and account statistics, video or post information, publishing settings, upload status, and performance metrics to connect the account, send content to TikTok, track publishing status, and display available analytics. TikTok access is used only when the integration is configured and the user has granted the relevant permissions. Some upload modes require the user to finish publishing within TikTok.

Social Command includes optional foundations for AI-assisted drafting, analysis, summaries, recommendations, and an assistant. These features are active only when an AI provider has been configured. When a user intentionally uses an enabled AI feature, the prompt and the workspace content needed to answer it may be sent to that configured provider. The current assistant design keeps requests within the user's authorized workspace and requires confirmation before external write actions.

An unconfigured AI feature does not send prompts or workspace data to an AI model. If a cloud AI provider is enabled in the future, its use should be subject to a separate data-processing and security review. Users should review AI-generated output before using or publishing it.

Social Command uses information to:

• create accounts, authenticate users, and manage organizations, workspaces, roles, and permissions;
• provide requested account connections, content workflows, approvals, scheduling, publishing, analytics, and assistant features;
• maintain connection health, refresh supported credentials, process background publishing work, and prevent duplicate operations;
• secure, troubleshoot, monitor, and improve the service; and
• comply with applicable law, platform rules, and valid legal requests.

Application records are stored in the deployment's database. Media is stored using the deployment's configured local or object-storage provider. Background publishing may use job-processing and cache services. The exact hosting region and subprocessors depend on the production deployment selected by the service operator.

OAuth access and refresh tokens are stored in the server-side integration store and used by backend workers; they are not exposed in Social Command workspace responses. Social Command applies server-side authentication, workspace-scoped authorization, role-based access controls, input validation, permission checks, audit logging for significant actions, and limits on uploaded file types and sizes. Production deployments are expected to use HTTPS, protected secrets, backups, and access-controlled infrastructure. No method of storage or transmission is completely secure.

Social Command does not sell user data or platform data.

Information may be shared only as needed with:

• social platforms that a user directs Social Command to connect with or publish to;
• hosting, database, object storage, email, monitoring, analytics, background-processing, and security providers configured by the service operator;
• AI providers, only when an AI feature is configured and intentionally used;
• other authorized members of the same organization or workspace, according to their roles and permissions; and
• authorities or other parties when required by law, needed to protect rights and safety, or involved in a business reorganization subject to appropriate safeguards.

A particular deployment may not use every category above. Third-party providers process information under their own terms and privacy policies, as well as any agreements made by the Social Command service operator.

Information is retained for as long as needed to provide the service, maintain security and audit records, meet platform or legal obligations, and resolve disputes. Retention periods can vary by record type and by the operator of the Social Command deployment. Deleted information may remain for a limited time in backups, logs, or records that must be kept for legal or security reasons.

Users may request account or data deletion through the contact method below. Requests may need to be verified and, for managed workspaces, coordinated with the organization that controls the workspace. Users can disconnect an integration in Social Command where that control is available, and can revoke Social Command's access through the relevant platform's security or business-integration settings. Revocation stops future API access but does not automatically delete content already published to a social platform.

Step-by-step instructions are available on the public Data Deletion Instructions page.

Depending on location and applicable law, users may have rights to ask for access, correction, deletion, restriction, objection, or a portable copy of personal information, and may have the right to appeal a decision or complain to a data-protection authority. Users can also manage platform permissions directly with Facebook, Instagram, TikTok, or another connected platform. Social Command may need to verify identity and authority before completing a request.

Social Command is intended for organizations and people authorized to manage business or professional social accounts. It is not directed to children under 13, or under the higher minimum age required in their jurisdiction, and the service should not be used by a minor who cannot lawfully consent to the processing described here. If a child's personal information may have been provided, contact the service operator so it can be reviewed and deleted where required.

This policy may be updated as Social Command changes or legal and platform requirements evolve. The revised policy will be posted at this URL and the “Last updated” date will be changed. Material changes should be accompanied by additional notice when appropriate.

For privacy questions, rights requests, or account and data deletion requests, contact the Social Command workspace administrator or the organization that provided your account. That organization operates your Social Command deployment and can verify the request or direct it to the appropriate service operator.

Contact method: your Social Command workspace administrator or inviting organization, using the same business contact channel through which your account or workspace access was provided.