Privacy policy

SocialLite (sociallite.ai) is run by [Legal business name]. It helps local businesses plan, write, approve and send social media posts, and answer the comments, messages and reviews that come back. This page says what we collect, why, who else handles it, and how to have it deleted. Questions go to [privacy contact email].

Who this covers

• Business owners and the people on their team who sign in.
• People who approve posts from a link without signing in.
• People whose comments, messages and reviews reach a business through an account the business connected.
• People who open a business's tracked link or have an offer scanned at a counter.

What we collect

• Your sign-in: name, email address, and a phone number if you add one for approvals. Your role at the business.
• Your business: its name, type, locations, address, website, how it sounds, the photos and videos you upload, posts, schedules, offers and settings.
• Connected accounts: when you connect Facebook, Instagram or Google, we keep the sign-in the network gives us, the account's name, the permissions you granted, and for Facebook the id Facebook gives our app for the person who connected it. We keep that id only to answer deletion requests from Facebook. Sign-ins are encrypted (AES-256-GCM) before they are stored, never shown on screen, and never written to our logs.
• From connected accounts: the business's past posts and their numbers, results for new posts, and comments, messages and reviews with the name shown on them. Businesses in healthcare mode: we never keep the text or sender of a private message. A business can set messages to be deleted after a number of days.
• Tracked links: when someone opens a business's short link we record the time and whether it was a phone or a computer. Not the IP address, not a cookie, not a tracking pixel. Link previews made by Facebook, Instagram, Slack, WhatsApp and search engines are not counted.
• In-person offers: when staff scan an offer at checkout we record the time, the post and the scanner it was scanned with. Nothing about the customer.
• Your website: when an owner gives us their website during setup, we read the homepage and up to four more pages on that same site, as SocialLiteBot. We follow robots.txt and stop at the first sign-in wall, block or bot check.
• Cookies: one to keep you signed in, one to remember which business and location you are looking at, and a short-lived one while you connect an account. No advertising or analytics cookies.

How we use it

• To run the service: plan your week, draft posts and replies, check them against the rules you turned on, send what you approve, and show results.
• To draft posts and replies with an AI model (Anthropic). It gets the text needed for each draft. We don't use your content to train AI models.
• To tell you when something needs you: a post that failed, an account that signed out, a message waiting.
• To keep the service safe and fix what breaks.

We don't sell personal information, and we don't share it for advertising.

Who else handles it

These services handle data for us, only to run SocialLite:

• Supabase: Our database, sign-in and photo storage.
• Vercel: Runs the website and app you use.
• Fly.io: Runs the background worker that sends posts, reads results and brings in messages.
• Anthropic: The AI model that drafts posts and replies. It gets the text needed for each draft.
• Meta (Facebook and Instagram): Where we post, and where comments, messages and results come from, for accounts you connect.
• Google: Your Google Business Profile: posts, reviews and listing numbers, for a profile you connect.
• TikTok: Posting and results, once you connect a TikTok account.
• LinkedIn: Posting and results, once you connect a LinkedIn page.

We also share information when the law requires it, or to protect people from harm.

How long we keep it

• While the business uses SocialLite, until it deletes its data.
• Message text, for as long as the business's retention setting allows.
• When data is deleted, we keep a record that it was deleted: when, what kind, and how many things. Our activity log keeps who did what and when, with the content removed.
• Backups kept by our database host roll over on the host's schedule, and deleted data leaves them as they do.

Deleting your data

An owner can disconnect and delete one network, or delete the whole business's data, from Settings, Your data. Removing SocialLite in your Facebook settings also deletes what we got from Facebook and Instagram through you. Everything is on Deleting your data. You can also write to [privacy contact email].

Security

Account sign-ins are encrypted. Every business's data is kept apart in the database itself, and we test that one business can never read another's. We don't hold any security certification yet.

Health information

We have not signed a business associate agreement with anyone yet. Healthcare offices should not send patient information through SocialLite until one is in place.

Children

SocialLite is for businesses. It is not meant for anyone under 16, and we don't knowingly collect their information.

Changes

When this page changes we update the date at the top, and we tell owners in the app before a change that matters takes effect.

Contact

[Legal business name], [privacy contact email].