Privacy Policy

Personal Information

• Account Data: Name, email address, and username when you create an account, sign up via email/password, or sign in via a third-party authentication provider (Google, Apple, Facebook, or Instagram). When you sign in with a third-party authentication provider, we receive only the basic profile information described in section 5 below.
• Profile Information: Business or creator profile data for scheduling and analytics
• Access Tokens: OAuth tokens that allow us to perform operations on your behalf

Platform Data

• Social Media Content: Messages, comments, posts, and other metadata from Instagram or other connected platforms
• Analytics & Engagement: Information about your scheduled content, engagement metrics, etc.

Usage Data

• Log Data: IP address, browser type, operating system, device information, and pages viewed
• Cookies & Similar Technologies: We use cookies to remember preferences, track session data, and analyze usage

Payment Information

If you purchase a subscription, we collect payment information (through a secure third-party processor). We do not store full credit card details on our servers.

Google

When you tap "Continue with Google", Google receives a sign-in request from SociaHive. After you authorize the sign-in, Google sends us a limited profile (the openid email profile scopes): your email address, name, and profile photo URL. We use this information only to create or look up your SociaHive account and to display your name in the app. We do not request access to Gmail, Google Drive, Google Calendar, or any other Google service from the sign-in flow.

Google's handling of your data during sign-in is governed by the Google Privacy Policy.

Sign in with Apple

When you tap "Continue with Apple", Apple authenticates you locally on your device and sends SociaHive a stable user identifier and (on the first sign-in only) your name and email address. Apple does not share your real Apple ID with us, and Apple does not receive your activity within SociaHive. If you choose Hide My Email, we receive an anonymous Apple-managed relay address (ending in @privaterelay.appleid.com) instead of your real email; messages we send to that relay are forwarded to your real inbox by Apple, and you can disable the relay at any time from your Apple ID settings. We store the email or relay address we receive so we can send transactional account messages and let you sign back in.

Apple's handling of your data during sign-in is governed by the Apple Privacy Policy.

Facebook and Instagram

When you connect a Facebook Page or Instagram Professional account, Meta authenticates you and grants us access tokens scoped to the permissions you approve in the consent screen. Meta's handling of your data is governed by the Meta Privacy Policy.

Your control

• Revoke at the provider: You can revoke SociaHive's access at any time from your Google Account permissions page (myaccount.google.com/permissions), your Apple ID settings (Settings > Apple ID > Sign in with Apple), or Meta's Business Integrations page.
• Unlink in SociaHive: Sign-in providers can be unlinked from Settings > Account.
• Account deletion: Deleting your SociaHive account (see section 9 below) removes the email or relay address we received from the provider along with all other account data.

Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Service to function. These include authentication session cookies, CSRF protection tokens, and cookie consent preferences. These cannot be disabled.
• Functional Cookies: Remember your preferences such as selected account, sidebar state, theme, and language settings to provide a personalized experience.
• Analytics Cookies: Help us understand how visitors interact with our website by collecting information anonymously. We use this data to improve our Service. These are only set if you click "Accept All" on our cookie banner.

Managing Your Cookie Preferences

• Cookie Banner: On your first visit, you can choose to "Accept All" or "Reject All" non-essential cookies. Your choice is stored in your browser and remembered for future visits.
• Browser Settings: You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking all cookies may affect the functionality of the Service.
• Clearing Consent: To change your cookie preference, clear your browser's localStorage for sociahive.com or use your browser's cookie management tools.

Third-Party Cookies

We do not use third-party advertising cookies. If we integrate third-party analytics services in the future, they will only be activated with your explicit consent via the cookie banner.

Providers We Use

• OpenAI — used for automation generation, content and caption assistance, message classification, and AI replies.
• Anthropic — used for assistant and generation features.

Both providers process data under their enterprise/API terms. Data submitted through their APIs is not used to train their models.

What Is Sent

• The prompt or instruction you write (for example, a description of an automation you want built).
• Where a feature responds to a conversation, the relevant message text from that conversation, which may include content written by the person messaging you.
• The account context needed to answer — such as post content, automation structure, or engagement figures.

We do not send your password, payment details, OAuth access tokens, or API keys to AI providers.

Your Consent and Control

• Consent first: In the SociaHive mobile app, AI features are gated behind an explicit consent screen that names these providers. No data is sent to an AI provider until you accept it.
• Optional: You can decline and continue using scheduling, the inbox, and the rest of the product. AI features simply stay off.
• Withdrawal: Signing out clears the stored consent on that device, so the disclosure is shown again the next time you sign in. To withdraw consent for your account, or to request deletion of your AI interaction records, contact us using the details in Section 16. Withdrawal stops future processing; it does not undo processing already performed.
• Automated replies: Where you enable AI to reply on your behalf, you remain responsible for the messages sent from your connected accounts. You can disable or pause any AI automation at any time.

Retention

We retain a record of AI interactions (the prompt, the generated output, and related metadata) to operate, debug, and improve the quality of these features. These records are subject to a bounded retention period and are deleted when you delete your account. See Section 9 for full retention and deletion details.

No Automated Decisions With Legal Effect

We do not use AI to make decisions that produce legal or similarly significant effects about you. AI output in SociaHive is content generation and assistance, and is reviewed or configured by you before it is used.

Retention Periods

• Account Data: Retained for the duration of your active account, plus 30 days after account deletion to allow for recovery.
• Connected Platform Data (including Google/YouTube): Content metadata, analytics, and engagement data from connected platforms are retained while your account is active and the platform is connected. This data is deleted within 30 days of disconnecting the platform or deleting your account.
• OAuth Tokens: Access and refresh tokens for connected platforms (including Google/YouTube) are stored only while the connection is active. Tokens are immediately revoked and deleted when you disconnect an account.
• Scheduled Content: Scheduled and published post data is retained for the duration of your account. Drafts in trash are automatically deleted after 30 days.
• Usage & Analytics Data: Aggregated, anonymized usage data may be retained indefinitely for service improvement. Identifiable usage logs are retained for up to 90 days.
• Payment Records: Transaction records are retained as required by tax and financial regulations (typically 7 years), processed securely by our payment provider (Stripe).

Your Deletion Rights

You have the right to request deletion of your data at any time:

• Disconnect a Platform: You can disconnect any connected account (including Google/YouTube) from Settings > Connected Accounts. This immediately revokes our access and queues the associated data for deletion within 30 days.
• Unlink a Sign-in Provider: You can unlink Google or Apple sign-in from Settings > Account. Your SociaHive account remains accessible via email/password or any other linked provider.
• Delete Your Account: You can delete your entire account from Settings > Account > Danger Zone on web, or Settings > Account > Delete Account in the iOS app. We apply a 30-day grace period (per CCPA "right to retract") — during this window you can cancel from the same screen. After 30 days, all your data, connected accounts, flows, scheduled content, and uploaded media (including any email addresses Apple Hide-My-Email relay addresses that sign-in providers shared with us) are permanently and irrecoverably removed. Your subscription is cancelled immediately on request. Compliance audit-log entries are retained for 7 years per the Apple Developer Agreement and SOC 2 retention floor, but are anonymized (your user identifier is removed).
• Request Data Deletion: You may also contact us at [email protected] to request deletion of specific data. We will respond within 30 days.

Google User Data

How we handle data from Google accounts you connect, including retention and deletion, is set out in section 10.

Data we access and why

• Sign in with Google (openid, email, profile): your name, email address and profile photo, used only to create your SociaHive account, sign you in and show your name in the app.
• YouTube (youtube.upload, youtube.readonly): your channel's name, ID and picture, so you can pick the channel; uploading the videos you schedule in SociaHive at the time you choose; and reading your channel and the videos SociaHive published, so we can show their status in SociaHive. If you turn on first comments, youtube.force-ssl is also requested, only to post the comment you wrote under your own video.
• Google Calendar (calendar.calendarlist.readonly, calendar.freebusy, calendar.events.owned): the names of your calendars, so you can choose which ones to check and which one receives bookings; the times you are busy (busy and free times only, never the titles, descriptions or attendees of your events), so your booking page and chat booking step only offer free times; and creating, updating and deleting the event for each booking made through SociaHive on the calendar you chose.
• Google Sheets (spreadsheets, userinfo.email): adding the information your automations collect (for example a lead's name and email) as rows in the spreadsheet you choose, and your email address to show which Google account is connected.

We only request a permission when you connect the feature that needs it, and we use Google user data only to provide or improve those user-facing features.

What we do not do

• We do not sell Google user data, and we do not use or transfer it for advertising, retargeting or interest-based ads.
• We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models.
• We do not transfer Google user data to data brokers or information resellers, or use it to determine credit-worthiness or for lending.
• No person at SociaHive reads your Google user data unless you give us permission (for example in a support request), it is needed for security purposes such as investigating abuse, it is required by law, or it is aggregated and anonymized for internal operations.

Storage and security

Google access and refresh tokens are encrypted (AES-256-GCM) before they are stored, and are only decrypted on our servers to make the API calls described above. We store the IDs of the calendar events and YouTube videos SociaHive created so we can update or remove them. Busy times from Google Calendar are kept for at most 10 minutes. All data is sent over HTTPS. Google user data is stored on our servers in the European Union; your sign-in details (name and email address) are held by our authentication provider, Supabase.

Sharing

We do not share Google user data with third parties, except with the infrastructure providers that host SociaHive under contract and confidentiality obligations, or when required by law. Calendar events SociaHive creates are written to your own Google Calendar.

Retention and deletion

• Disconnect: disconnecting a Google account in SociaHive (Bookings > Calendars, Connected Accounts, or Integrations) revokes our access at Google and deletes the stored tokens; related data is deleted within 30 days.
• Revoke at Google: you can remove SociaHive's access at any time at myaccount.google.com/permissions.
• Delete your account: deleting your SociaHive account deletes all Google user data we hold after the 30-day grace period described in section 9.
• Ask us: email [email protected] to have specific data deleted; we respond within 30 days.

What we read and why

• Store details: your shop domain, store name and currency, used to identify the store and show prices correctly. The access tokens Shopify issues us are stored encrypted.
• Products: titles, descriptions, images, categories, variants, prices and stock status, so your automations and our AI features (see section 7) can show and recommend your products in direct messages and send buyers to the right product.
• Orders placed through our links only: when a buyer clicks a product link SociaHive sent and then places an order, we keep the order number, status, total, currency, the items bought, payment method, tracking details and dates, so you can see the sales your automations produced. We do not store the buyer's name, email address, phone number or address.
• Who linked the store: the Shopify staff account id of the person who connected the store to SociaHive, so other staff of that store see a read-only view.
• Link clicks: a record of each click on a product link we sent, used to match an order to the conversation it came from.

How long we keep it

• Link clicks: deleted automatically 14 days after the click.
• Orders: deleted automatically 400 days after the order was placed.
• Uninstalling the app: the store is disconnected at once. 48 hours later, unless you reinstall first, we delete your store's products, link clicks and orders, and the store record with its access tokens.

Shopify privacy requests

We act on the three privacy requests Shopify sends to apps, and complete each within 30 days:

• Customer data request (customers/data_request): we email the store owner a file listing what we hold for the orders named in the request (order number, status and date; we hold no customer details).
• Customer erasure (customers/redact): we delete the orders named in the request and the link clicks connected to them.
• Store erasure (shop/redact): we delete everything we hold for the store.

Billing

If you subscribe or buy credits from inside the Shopify app, the charge is made through Shopify's billing and appears on your Shopify invoice. We do not receive your payment card details; we keep a record of your plan and its status as Shopify reports it.

What the plugin sends and why

• Store details: your site address, store name, currency and the addresses of your checkout and cart pages, used to identify the store, show prices correctly and send buyers to the right page. The secret the plugin uses to sign its requests is stored encrypted.
• Products: titles, descriptions, images, categories, attributes, variations, SKUs, prices and stock, so your automations and our AI features (see section 7) can show and recommend your products in direct messages and send buyers to the right product.
• Orders placed through our links only: when a buyer clicks a product link SociaHive sent and then places an order, the plugin sends the order number, status, currency, totals (including discount, shipping and tax), the items bought with their options, the payment and shipping method names, whether it needs shipping, and dates, so you can see the sales your automations produced and we can send the order messages you turn on. Orders that did not start from one of our links are never sent.
• The buyer's first name: the first name from the order's billing details, so your order and reminder messages can greet the buyer by name. We store it on that buyer's contact in your SociaHive account, not on the order.
• Plugin health: the plugin, WordPress, WooCommerce and PHP versions, how WooCommerce stores orders, how many updates are waiting to be sent, when the plugin last ran and the last delivery error, so we can tell you when your store stops syncing.

The plugin never sends the buyer's last name, addresses, email address, phone number, IP address or order notes.

Link clicks and the attribution cookie

• Link clicks: when someone opens a product link we sent, SociaHive records the click (which link, which conversation and when), used to match an order to the conversation it came from.
• On your store: the plugin keeps the click id in the WooCommerce session for that visit and, where allowed, in a first-party cookie named sh_c that expires after 7 days, so an order on a later visit still counts. The cookie is a marketing cookie: if your site has the WP Consent API installed, it is set only when the visitor has accepted marketing cookies; without the Consent API it is always set, so if your visitors must agree first, install the Consent API and a cookie banner that supports it. At checkout the click id is saved on the order as _sh_click.

How long we keep it

• Link clicks: deleted automatically 14 days after the click.
• Orders: deleted automatically 400 days after the order was placed.
• First names: held for at most 2 hours while an order is processed, then kept on the buyer's contact until you delete that contact or your SociaHive account.
• Disconnecting the store: when you disconnect the store, from SociaHive or from the plugin, we stop using its data at once. 48 hours later, unless you reconnect first, we delete the store's products, orders and link clicks, and the store record with its secret. We keep only your store's revenue totals and order counts, which contain no order or buyer details, until you delete your account.

Deletion requests

• Store owners: to have data about one of your buyers deleted from SociaHive, delete that buyer's contact in SociaHive, or contact us at [email protected] and we will respond within 30 days.
• On your store: the plugin adds a personal data eraser to WordPress. When you erase a buyer's personal data under Tools > Erase Personal Data, it removes the _sh_click value from the orders placed with that buyer's email address. Data already sent to SociaHive is not erased by this; ask us as described above. The plugin also suggests text for your own privacy policy in the Privacy Policy Guide under Settings > Privacy.