1. Introduction

This Privacy Policy explains how SocialAPIs ("we," "our," or "us") collects, uses and protects personal information when you use our website, dashboard, API, SDKs, n8n node and MCP server (the "Service"). SocialAPIs is the controller of your account information. You can reach us about anything in this policy at privacy@socialapis.io.

2. Information We Collect

2.1 Information You Provide

Account information: first name, last name, email address and password (stored only as a one-way hash).
Payment information: handled by Stripe. We receive your billing details and payment status, but never your full card number.
Communications: messages you send to support or through the contact form.

2.2 Information Collected When You Use the API

For each API request we log:

The endpoint, query parameters, status code, response time and credits charged
The IP address and approximate country the request came from
Request and response headers and bodies, used for debugging, billing questions and your request history in the dashboard

API responses can contain public content from Facebook and Instagram, including public information about people. See section 6.

2.3 Information Collected on the Website

Essential cookies: a secure session cookie that keeps you signed in. We do not use advertising cookies.
Analytics: we use Umami, a privacy-focused analytics tool that we host ourselves. It does not use cookies and does not track you across other sites. It records page views, referrer, browser, device type and country.
Local storage: small settings in your browser, such as which announcements you have dismissed.
How you found us: on your first visit your browser keeps, for up to 30 days, the campaign tags of the link you followed (utm_ parameters), the website that sent you (its address without any query string) and the first page you opened. If you create an account, this is saved with it so we know which channels bring customers; it is deleted from your browser after sign-up. After sign-up (or, for accounts created before we asked, later on your dashboard) we may also ask you once how you heard about us, and note when we asked; answering is optional.
Affiliate links: if you open a link with an affiliate code (?ref=), a first-party cookie (sa_ref) keeps that code for up to 60 days (the period set in our affiliate program). If you then create an account, the affiliate who referred you is saved with it and earns a commission on your payments; the affiliate never sees your email or your data. If you become an affiliate yourself, we keep your payout method and payout email, the terms version you accepted and the commissions you earned.

3. How We Use Your Information

To provide the Service (performance of our contract with you): create and run your account, answer API requests, count credits and show your usage.
To bill you (contract and legal obligation): process payments and keep tax and accounting records.
To keep the Service secure and working (legitimate interest): rate limiting, fraud and abuse prevention, debugging and improving the Service.
To contact you about your account (contract): verification codes, password resets, receipts, export notifications and important service changes.
To send product news (legitimate interest or consent, depending on where you live): you can unsubscribe at any time with the link in every such email.
To comply with the law (legal obligation): when required by law or a valid legal request.

4. Who We Share It With

We do not sell your personal information. We share it only with service providers that help us run the Service, under contracts that limit how they can use it:

Hetzner: hosting of our servers and databases in the European Union
Cloudflare: network delivery and security
Stripe: payment processing (Stripe Privacy Policy)
Resend: sending email
Google reCAPTCHA: spam protection on sign-up and password reset forms, only when enabled

We may also disclose information when required by law, to protect our rights or users, or as part of a merger or sale of the business.

5. International Transfers

Our servers are in the European Union. Some of the providers above may process data in other countries, including the United States. Where that happens, the transfer relies on the safeguards those providers offer, such as the EU Standard Contractual Clauses in their data processing terms.

6. Public Social Media Data

The Service retrieves publicly available Facebook and Instagram content when our customers request it. We do not build profiles of individuals, and we do not combine this data across requests. Responses are stored only in our request logs (section 7) and are deleted after 90 days.

If you appear in such content and want it removed from our logs, or want to object to its processing, email privacy@socialapis.io. Our customers are responsible for their own use of the data they retrieve, as set out in our Terms of Service.

7. Data Retention

Account data: kept while your account is open, and deleted or anonymized after you ask us to close it, except where we must keep it by law
API request logs (including request and response bodies): deleted automatically after 90 days
Payment and invoice records: kept for as long as tax and accounting law requires, typically up to 10 years

8. Data Security

All traffic to the website and API is encrypted with HTTPS (TLS)
Passwords are stored as one-way hashes
API keys are sent in request headers, never in URLs
Access to production systems is limited to staff who need it

No system is completely secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

9. Your Rights

Depending on where you live, you may have the right to:

Access a copy of your personal data
Correct inaccurate data
Delete your data
Receive your data in a portable format
Object to or restrict certain processing
Withdraw consent at any time, where we rely on consent

To exercise these rights, email privacy@socialapis.io. We will reply within 30 days. You also have the right to complain to your local data protection authority.

10. Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the "Last updated" date. For material changes, we will also email account holders before they take effect.

12. Contact Us

Privacy requests: privacy@socialapis.io
Support: support@socialapis.io