Your data and your choices

Privacy Policy

Effective 19 September 2026

1. Who operates Sociales

Sociales is operated by Workmatter Enterprise, a sole proprietorship registered in Ghana. In this policy, “Sociales”, “Workmatter Enterprise”, “we”, “us”, and “our” refer to the business operating the service.

Workmatter Enterprise is the data controller when we decide why and how personal data is used, such as account, waitlist, billing, security, and service data. We may act as a data processor when an organisation uses Sociales to manage content and social-platform data on behalf of its customers, brands, or other people.

2. Scope of this policy

This policy applies to the Sociales website, waitlist, application, support, and related services. The public site is currently a waitlist. Sections describing app features apply when those features become available and you choose to use them.

This policy does not replace the privacy policies of social networks, payment providers, identity providers, or other services that you connect to Sociales. Those services decide how they use data in their own systems.

3. Where personal data comes from

We may receive personal data:

directly from you when you join, register, pay, contact us, or use Sociales;
from your organisation, its owners, administrators, team members, clients, or agency partners;
from a social platform, identity provider, calendar provider, or other service that you authorise;
from payment and subscription providers;
from public sources that you ask us to use, such as an RSS feed; and
automatically from your browser, device, and use of the website or application.

4. Personal data we process

Waitlist data

your email address;
a verification token and verification status;
the dates when you joined and when we sent a verification email; and
basic request and security data, such as IP address, browser information, requested page, and request time.

Account and organisation data

name, email address, profile photo, password or sign-in-provider details;
sessions, security events, two-factor authentication, and recovery data;
organisation names, memberships, roles, permissions, invitations, teams, partnerships, and client or brand relationships; and
timezone, language, appearance, notification, and privacy preferences.

Connected social-profile data

platform IDs, usernames, display names, profile photos, profile links, account type, and connection status;
permissions and scopes you grant, provider host or server, and identifiers needed to keep the correct profile connected;
access tokens, refresh tokens, private keys, webhook secrets, and similar credentials—we do not ask for or store your social-platform password; and
provider events, webhook data, sync status, and connection errors.

Content and collaboration data

drafts, posts, captions, threads, articles, stories, reels, carousels, first comments, replies, hashtags, links, locations, schedules, and publishing results;
uploaded images, videos, audio, thumbnails, edits, folders, and other media;
approval requests, versions, reviewer decisions, internal comments, mentions, labels, templates, queues, calendar notes, and activity records;
RSS feed addresses, fetched article details, prompt templates, generated content, and feed settings; and
report settings, exported files, magic-link reports, and the people selected to receive them.

Analytics and technical data

profile and post metrics such as views, reach, reactions, comments, clicks, follower counts, engagement, and publishing performance;
generated comparisons, trends, recommended publishing times, and queue-health information;
IP address, device and browser information, app version, pages used, dates, diagnostics, logs, and fraud or abuse signals; and
support requests, feedback, and communications with us.

5. How and why we use personal data

We use personal data to:

run the waitlist and send requested launch or testing updates;
create accounts, organisations, teams, and access permissions;
connect social profiles and perform actions you request;
create, approve, schedule, publish, edit, delete, and measure content;
provide media, calendar, RSS, reporting, collaboration, and AI features;
process subscriptions, credits, refunds, and billing records;
provide support and send important service notices;
detect misuse, investigate failures, and protect users and the service;
improve reliability and understand how product features perform; and
meet legal obligations and enforce our agreements.

Depending on the activity and applicable law, we rely on:

contract, when processing is needed to provide a service you or your organisation requested;
legitimate interests, such as securing, operating, and improving Sociales, where those interests do not override your rights;
consent, such as optional marketing, optional cookies, or a social-platform authorisation where consent is required; and
legal obligations, such as tax, accounting, fraud prevention, and responding to lawful requests.

6. Organisations, brands, teams, and agencies

Organisation owners control membership, roles, permissions, connected profiles, and content inside their organisation. Other members see only the data their role permits. Activity logs may show who performed an action and when.

A brand owns the social profiles and data in its Brand organisation. A brand may grant an agency delegated access. Sociales records that relationship and applies the permissions chosen by the brand. Ending the relationship removes the agency's delegated access without transferring ownership of the brand's profiles or data.

If your employer, client, brand, or another organisation gives you access, that organisation may control your membership and work data. Contact its administrator first for requests about organisation-controlled data. You can still contact us if you need help.

7. Social platforms and integrations

Connecting a profile sends you to the relevant provider or gives you setup steps. The provider shows the permissions requested. Sociales receives a credential after approval and uses it only for the connected features. Signing in to Sociales does not by itself grant permission to publish to a social profile.

Depending on the integrations you choose, this may involve Google and YouTube, Meta services such as Facebook, Instagram, and Threads, LinkedIn, TikTok, Pinterest, Snapchat, Nextdoor, X, Bluesky, a Mastodon server, Telegram, Discord, Twitch, Tumblr, Microsoft, or another provider shown in the app. We send a provider only the data and commands needed for the action you request.

Social platforms and identity providers are separate controllers for data they process under their own terms and privacy policies. A Mastodon server is operated by its own administrator, who may have separate rules. Review the provider's policy before connecting it.

Our use of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. Google data is used only to provide or improve the user-facing features you request. It is not sold, used for advertising, or used to determine creditworthiness.

If you connect a YouTube channel, Sociales uses YouTube API Services to provide the selected connection features. The YouTube Terms of Service and Google Privacy Policy also apply. You can revoke Sociales' access to Google data through Google's security settings.

8. AI features

Optional AI features may help rewrite captions, suggest hashtags, estimate likely performance, find queue gaps, or create drafts from RSS items. To provide the chosen feature, we may send the prompt and the content, settings, platform information, or analytics needed for that request to an AI service provider acting for us.

We do not sell customer content or allow it to be used to train a provider's general AI models. If a future feature would use data for a different training purpose, we will explain it separately and ask for clear consent before doing so.

AI output is normally shown for review. Content may publish automatically only when an authorised user deliberately enables a supported automation. AI predictions and recommendations are advice only. They do not make decisions that change billing, suspend an account, deny a legal right, or otherwise significantly affect a person.

We may share data with:

social platforms and integrations when you connect them or request an action;
Cloudflare and other infrastructure or database providers that host and protect the service;
Resend or another email provider that delivers our messages;
Polar and its payment partners for subscriptions, payments, and refunds;
AI providers, but only when you use an AI feature and only for the data needed to provide it;
members, brands, clients, and agency partners according to organisation access and permissions;
people you choose to receive reports, exports, approval requests, or shared content;
professional advisers, authorities, or other parties when required by law or needed to protect people, rights, and the service; and
a buyer or successor if Workmatter Enterprise is reorganised, financed, acquired, or sold, subject to appropriate safeguards and required notice.

We require service providers to protect data and use it only for the service they provide to us. We do not sell personal data or social-platform data. We do not share it for cross-context behavioural advertising or with data brokers.

10. Payments and billing

Polar processes subscriptions and purchases. Its payment partners collect payment card or bank details. Sociales receives records such as the customer, product, subscription status, payment status, amount, currency, refund, and transaction identifiers. We do not receive or store complete payment-card numbers.

We also keep plan, credit, reservation, debit, refund, and billing-audit records so balances remain correct, retries do not create duplicate charges, and legal or accounting requirements can be met.

11. Cookies and browser storage

Sociales uses necessary cookies and browser storage for sign-in sessions, security, organisation selection, theme, and preferences. These are needed for the service to work and are not used for advertising.

We do not currently use advertising cookies, cross-site tracking, or session-replay tools. If we add optional product analytics or another non-essential technology, we will update this policy and request consent where required before enabling it.

Identity and social providers may set their own cookies when you visit their sites to sign in or approve a connection. Their policies control those cookies.

12. How long we keep personal data

We keep data only while it is needed for the purposes in this policy. The normal periods below may be extended for an active dispute, security investigation, legal hold, or a legal requirement.

Normal retention periods for Sociales data
Data	Normal period
Unverified waitlist entry	Until you verify it, ask us to remove it, or the waitlist closes
Verified waitlist entry	Until you leave or the waitlist is no longer needed
Temporary connection attempt	About 15 minutes; expired attempts are then removed by scheduled cleanup
Connected-profile credential	While the connection is active; deleted when its last profile is disconnected
Content and media	While the account needs it; normally removed within 30 days after deletion
Social analytics	30 days, 90 days, one year, or two years, according to the active plan
Security and organisation audit logs	Normally two years; an actor's recorded name may remain after their account is deleted so the organisation retains an accurate audit trail
Support communications	Normally two years after resolution
Billing and tax records	For the period required by applicable tax, accounting, and financial laws, normally up to seven years
Deleted account	Active service data is normally removed within 30 days; encrypted backups rotate out within 90 days

For the free Brand plan, we may automatically disconnect social profiles after six months of inactivity and delete the Brand account after one year of inactivity. We will send reasonable notice before account deletion where we have a working contact address.

We may retain a minimal suppression record after you unsubscribe so we do not send you marketing again. Anonymous or aggregated information that cannot identify a person may be kept longer.

13. International data transfers

Workmatter Enterprise is based in Ghana. Our service providers and connected social platforms may process data in Ghana, the United States, Europe, or other countries. Their privacy laws may differ from those where you live.

Where the law requires it, we use recognised transfer safeguards, such as approved contractual terms, adequacy decisions, or another lawful transfer method. You may contact us for more information about safeguards that apply to your data.

14. Security

We use technical and organisational safeguards designed to protect personal data. These include access controls, encrypted network connections, limited access to production systems, and monitoring for misuse.

Connected-account credentials and temporary OAuth secrets are encrypted before storage. They are never returned to the browser after storage and should not appear in logs or audit records. No online service can guarantee complete security.

If a personal-data breach creates a risk that requires notice, we will notify the affected people and relevant authority as required by applicable law.

15. Your privacy rights

Depending on where you live, you may have the right to:

know whether we process your personal data and receive a copy;
correct incomplete or inaccurate data;
delete data that we no longer have a lawful reason to keep;
receive portable data in a commonly used format;
restrict or object to certain processing;
withdraw consent without affecting earlier lawful processing;
object to direct marketing at any time; and
complain to the data protection authority where you live.

Send a request to hello@sociales.app. We may ask for information needed to verify your identity and authority over an organisation. We normally respond within 30 days. If a request is complex or the law permits more time, we will explain the delay.

We will not deny service or treat you unfairly because you exercised a privacy right, though deleting data needed for a feature may make that feature unavailable.

16. Disconnecting services and deleting data

To leave the waitlist, email us from the address you joined with and ask us to delete it.
To stop a social connection, disconnect its last active profile in Sociales and, if desired, revoke Sociales in the provider's connected-app settings.
Removing one profile does not revoke a shared provider connection while another active profile still needs it.
To delete an account, use the in-app account deletion control when available or contact us.

Disconnecting stops new collection from that connection. It does not automatically delete content already published on a social platform; delete that content through Sociales where supported or directly on the platform. The platform may keep its own copy under its policy.

Some records may remain for the periods described above when needed for security, billing, legal claims, another person's rights, or an organisation's valid audit history.

17. Emails and notifications

We send service messages needed for verification, security, billing, publishing, approvals, and account administration. You cannot opt out of essential service messages while using the related service.

Waitlist updates, launch news, and other non-essential messages include an unsubscribe method. You can also change available notification settings or email us. Unsubscribing from marketing does not remove you from necessary service messages.

18. Age requirement

Sociales is a business and professional service for people aged 18 or older. We do not knowingly allow anyone under 18 to create or use an account. Contact us if you believe a person under 18 has provided personal data to Sociales.

19. Changes to this policy

We will update this policy as Sociales develops, service providers change, or legal requirements change. We will publish the new effective date and provide additional notice when a change materially affects your rights or how we use data.

If a new use requires consent, we will ask before using existing data for that new purpose. We will not treat continued silence as consent where clear consent is required.

20. Contact and complaints

For privacy questions or requests, contact Workmatter Enterprise at hello@sociales.app. A current business mailing address is available on request and will be published before the full public launch.

If you are not satisfied with our response, you may complain to the Data Protection Commission of Ghana or the data protection authority where you live.