Privacy Policy

• Account details: the name, email address and password of agency owners, team members and invited clients. Passwords are stored only as a secure hash.
• Agency and client details: what an agency enters about itself and its clients, such as names, logos, contact details, brand notes, plans and invoices.
• Content: posts, captions, comments, photos, videos, library files and tasks.
• Connected social media accounts: what the platform shares when an account is connected (see section 3).
• Payments: the plan, amount, date and the payment service's reference. For online payments through Whish, Whish tells us whether a payment succeeded and the payer's phone number. We never receive card or wallet details.
• Technical data: IP address, browser and sign-in sessions, kept to keep accounts secure, limit abuse and fix problems. Book-a-demo requests keep what the form asks for.

• to provide the Service: store an agency's work, send posts for approval, publish them at the time chosen, and show analytics;
• to send the emails the Service needs, such as invitations, approvals, password resets, billing notices and reminders;
• to bill subscriptions and keep payment records;
• to keep the Service secure, prevent abuse and fix problems;
• to answer you when you contact us.

We don't sell personal data, don't use it for advertising, and don't use third-party advertising or tracking cookies.

When an agency or its client connects a TikTok account, the account holder signs in on TikTok's own page and approves the permissions we ask for. We never see the TikTok password. With those permissions we:

• Read the basic profile (user.info.basic, user.info.profile): the account's name, username and profile picture, to show which account is connected and who a post will go out as.
• Read posting options before each post: the privacy levels, interaction settings and longest video the account allows, so the post form only offers what TikTok accepts.
• Publish (video.publish, video.upload): post the videos and photos the agency or client approved, with the caption and settings chosen, or send them to the account's TikTok inbox as drafts. Nothing is posted without someone choosing to post it.
• Read statistics (user.info.stats, video.list): follower, following and like counts, and the views, likes, comments and shares of posts, for the client's analytics.

We use TikTok data only to provide these features to the agency and its client, never for advertising, and never share it except with the service that connects to TikTok for us (Outstand, below). Access can be removed at any time by disconnecting the account in Social Workflows, or in the TikTok app under Settings and privacy › Security and permissions › Manage app permissions. Instagram and Facebook accounts work the same way, with Meta's permissions.

Only the services that run Social Workflows for us, and only what each one needs:

• Outstand (outstand.so): connects to TikTok, Instagram and Facebook and publishes posts. It holds the access the account holder grants.
• DigitalOcean: our servers, database and file storage.
• Resend: sends the Service's emails.
• Whish (whish.money): takes online payments.
• Google: the AI assistant (Gemini) processes what you ask it and the content it needs to answer; YouTube search finds trending topics. When you import files from Google Drive or Dropbox, they see the files you pick.
• The social media platforms receive the posts you publish to them.

We may also share data when the law requires it, or to protect our users or the Service. If Social Workflows is sold or merged, the data would pass to the new owner under this policy.

Our providers may store and process data outside Lebanon, including in the European Union and the United States. We choose providers that protect it with appropriate safeguards.

• While an account is active, we keep its data so the Service works.
• If a plan ends and isn't renewed, the account is locked and its files are deleted after a period (owners are emailed first). Its other records are kept so the account can come back, until it asks us to delete them.
• When an account is closed, we delete its data within 30 days, except what the law requires us to keep (such as payment records).
• Deleted library files stay in the trash for a while so they can be recovered, then are deleted for good.

Data is sent over encrypted connections, passwords are hashed, and access inside an agency follows the permissions its owners set. No system is perfectly secure, but we work to protect your data and will tell affected users if a breach puts it at risk.

We use only the cookies and browser storage needed to keep you signed in and remember simple preferences. There are no advertising or analytics cookies.

You can see and correct most of your data in the Service. You can also ask us for a copy of your data, to correct or delete it, or to stop a use of it, under Lebanese Law No. 81 of 2018 and the law of the country you live in. Email psst@socialworkflows.com and we'll answer within 30 days. If your data is in an agency's account (for example, as one of its clients), we may pass your request to the agency, which decides about its data.

Social Workflows is for businesses and is not meant for anyone under 18.

If we change this policy in a way that matters, we tell account owners by email or in the Service before it takes effect.

Progressive SARL, Lebanon. Email psst@socialworkflows.com for anything about your privacy.