Privacy Policy

1. Data controller

SocialBrainAI is published by Optsun Ltd (OPTSUN LTÉE), BRN C14124280, Royal Road, Bon Accueil, 40205, Mauritius, the controller of your personal data. This policy explains what data we collect, why, who we share it with and what your rights are, in accordance with the Data Protection Act 2017 of the Republic of Mauritius.

2. Data we collect

• Account: name, email address, username, country, password (encrypted) or Google / Facebook sign-in (name, email, profile picture).
• Brand and sub-accounts: information about your business, products, website, logos, photos and texts you provide to us.
• Connected social media accounts: access tokens, basic page and account information, statistics on your posts, and messages received if you enable customer replies.
• Creations: posts, images and videos prepared in the app.
• Billing: subscription, top-ups, usage, invoices and claims. Payment details are processed by PayPal and are never stored by us.
• Partner program: partner identity, PayPal payout address, referred customers and commissions.
• Usage: actions in the app, technical and security logs.

3. Purposes and legal bases

We use your data only for the following purposes, each of which relies on a legal basis:

• creating and managing your account, providing the Service (preparing, scheduling and publishing your content, replying to your customers, preparing your ads), tailoring creations to your brand, handling your claims, sending you messages related to your account and paying partner commissions: performance of the contract;
• billing, applying the correct VAT, keeping our accounts and responding to requests from authorities: compliance with a legal obligation;
• ensuring the security of the Service, preventing fraud and abuse, and improving the Service: legitimate interests;
• informing you of our news and offers: legitimate interests where you are a customer (you may object at any time), and your consent in other cases where the law requires it;
• accessing your connected social media accounts and, if you enable it, your customers' messages: consent, which you may withdraw at any time by disconnecting the account concerned.

We never sell your data and do not use it for third-party targeted advertising.

4. Recipients and transfers

We share only the necessary data with the following categories of recipients, who act on our behalf and are bound by confidentiality:

• Hosting provider: servers and databases (see the legal notice).
• Payment service provider: PayPal (subscriptions, top-ups, partner payouts).
• Audience measurement: Microsoft Clarity (Microsoft), which receives browsing data: pages viewed, clicks, scrolling, device type, approximate country. Text in your client area is masked.
• Artificial intelligence service providers: they receive the brand information and instructions needed to produce the creations you request. Your Google sign-in profile (name, email, picture) is not shared with them.
• Email and WhatsApp messaging: technical providers that deliver messages related to your account and, if you enable it, replies to your customers.
• Social networks you connect: Meta (Facebook, Instagram, Threads, WhatsApp), Google (YouTube, Business Profile), TikTok, Pinterest, LinkedIn — only when you connect an account and ask us to publish to it or read your statistics and messages there, within the permissions you grant.
• Authorities: where the law requires us to disclose data to them.

Some recipients are located outside Mauritius, notably in the United States. These transfers are limited to what is strictly necessary and are subject to appropriate safeguards in accordance with the Data Protection Act 2017. You may obtain a copy of these safeguards by writing to us.

5. Google data and “Limited Use”

The use and transfer to any other app of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements.

SocialBrainAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google sign-in data (name, email, picture) is used solely to create and authenticate your account. It is neither sold nor shared, except for a feature you expressly request (for example publishing to your YouTube channel) or where required by law. You can revoke access at any time from your Google account permissions or from your SocialBrainAI workspace.

6. Facebook, Instagram, TikTok and other networks

When you connect an account, we only access the permissions you grant (publishing, statistics, business messages if you enable customer replies). We do not access your contacts or your personal private messages. You can revoke this access at any time from your workspace or from each platform's settings.

7. Retention periods

• Account data: for as long as the account exists. Your contact details may then be kept for up to 3 years after your last activity in order to send you marketing information, unless you object or request their deletion.
• Generated content and brand information: for as long as the account exists; they are deleted when the account is closed or upon request.
• Social media access tokens: until the account concerned is disconnected or your account is closed.
• Invoices and accounting data: 10 years.
• Technical and security logs: 12 months.
• Cookies: 13 months maximum.

Following a deletion request, your personal data is erased within 30 days, except for data we are legally required to keep (invoices and accounting data).

8. Security

Encrypted connections (TLS), encrypted passwords, secured access tokens, servers hosted by a professional hosting provider, and data access limited to authorized personnel.

9. Cookies

The app uses cookies that are necessary for it to work (sign-in, language) and Microsoft Clarity audience-measurement cookies, which help us understand how the site is used (pages viewed, clicks, scrolling) so we can improve it. In your client area, displayed and typed text is masked in these measurements. There are no advertising cookies. These cookies are kept for a maximum of 13 months.

10. Your rights

You have the following rights over your data:

• access: to know whether we process your data and to obtain a copy of it;
• rectification: to have inaccurate or incomplete data corrected;
• erasure: to have your data deleted (see the data deletion page);
• restriction: to request the temporary suspension of certain processing;
• objection: to object to processing based on our legitimate interests and, at any time, to direct marketing;
• portability: to receive the data you have provided to us in a structured, commonly used format, or to have it transmitted to another provider;
• withdrawal of consent: to withdraw any consent you have given at any time, without affecting processing already carried out.

To exercise these rights, write to contact@socialbrainai.com from your account's email address. We will reply within one month.

You may also lodge a complaint with the Data Protection Office of Mauritius.

11. Minors

The Service is reserved for persons aged 18 and over. We do not knowingly collect data relating to minors; if you believe that a minor has provided us with data, write to us and we will delete it.

12. Changes to this policy

We may change this policy, in particular to reflect changes to the Service or to the law. The date of the latest update is shown at the top of the page. In the event of a material change, we will notify you by email or in the app before it takes effect.

13. Language

This policy is drawn up in French and in English, the languages in official use in Mauritius; both versions are equally authentic.

14. Contact