Legal

Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how SocialGrovv Ltd (“SocialGrovv”, “we”, “us” or “our”) collects, uses, shares, and protects personal data when you visit our website or use our dashboard and related services (the “Service”). It applies to visitors, account holders, and anyone who interacts with us. For our contractual terms, see our Terms of Service.

1. Who We Are

SocialGrovv Ltd (company number 17316340), a private limited company incorporated in England and Wales, United Kingdom, is the data controller responsible for the personal data described in this Policy. The UK Information Commissioner’s Office (“ICO”) is our lead supervisory authority. For all privacy questions, requests, and complaints, contact [email protected].

2. Information We Collect

2.1 Account & setup data

• Your email address and password (stored only as a salted hash by Supabase Auth), and the timezone we use for scheduling.
• Series and channel setup you enter in the product: for example channel or series name, topic or niche, tone, catalog voice choice, caption and visual style, and descriptions of fictional characters.

2.2 YouTube

When you connect a YouTube channel, we use Google / YouTube API Services and receive:

• OAuth access and refresh tokens and the scopes you grant. Tokens are stored encrypted in our self-hosted publishing service.
• Channel metadata (such as channel ID, name, and profile picture).
• Schedule and publish status for videos you schedule or publish through SocialGrovv, and status information returned by YouTube.

Your use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy. SocialGrovv’s use of information received from Google APIs adheres to the YouTube API Services terms. You can revoke SocialGrovv’s access at myaccount.google.com/permissions or from the Connections page in your dashboard.

2.3 Content & generated media

Files you upload, stock media you choose, and AI outputs created for you, including voiceovers, captions, thumbnails, and finished videos. Media is stored in our Cloudflare R2 object storage, organised in per-user folders. SocialGrovv does not fetch videos from links you paste; edit tools and AI Captions work only with files you upload.

2.4 AI generation data

Prompts, topics, scripts, character descriptions, generation settings, and the resulting outputs are stored so you can access your generation history. For AI Captions, the video you upload is sent to Google Gemini, which analyses the clip to suggest caption styling. For edit tools that need a transcript, speech-to-text is run on the videos you upload, using OpenAI. See Section 5 for how data is shared with AI providers.

2.5 Billing data

Plan, subscription or trial status, and credit-transaction history. Purchases are sold through Link, a Stripe service, which acts as merchant of record. Stripe calculates and collects applicable sales tax/VAT, processes payments and issues receipts. Your card statement will show LINK.COM* SOCIALGROVV. SocialGrovv does not receive or store your full card number — only a customer/subscription reference and plan information needed to manage your account.

2.6 Usage & device data

Login times, IP address, browser/device information, and application logs used to operate, secure, and troubleshoot the Service.

2.7 Communications

Support requests, content reports, feedback, feature requests, and votes or comments you submit through our in-app feedback board.

2.8 Blocked requests

We do not keyword-scan prompts before generation. If we refuse a request or suspend generation, we may keep a short excerpt for up to 90 days to review abuse.

3. How We Use Your Information & Legal Basis

As a UK company, our primary framework is the UK GDPR and the Data Protection Act 2018. Where the EU GDPR also applies to you, the legal bases below apply equally under that framework. We use the data we collect to:

• Provide the Service — authenticate you, run AI generations, store uploads and generated items, run edit tools, and schedule or publish videos to YouTube when you connect a channel and approve posts. (Performance of contract.)
• Share billing details with Link (Stripe), the merchant of record, and manage trials, subscriptions, and credits. (Performance of contract; legal obligation.)
• Secure the Service — detect and prevent abuse, fraud, and unauthorised access; review reports and enforce our Terms and Acceptable Use Policy. (Legitimate interest; legal obligation.)
• Operate, maintain, and improve the Service, including debugging and performance monitoring. (Legitimate interest.)
• Communicate with you — service notices and, where you have opted in, product updates. (Performance of contract; consent.)
• Comply with law and respond to lawful requests. (Legal obligation.)

We do not use Your Content or AI prompts to serve you advertising, and we do not sell personal data.

4. Third-Party Platforms

SocialGrovv integrates with YouTube only, so you can connect a channel and schedule or publish videos (paid plans). We store OAuth tokens solely to provide the features you authorise, keep them encrypted, and never sell tokens or personal data.

Legacy note: if you previously connected a Facebook account, Meta’s data-deletion callback may remove the related connection record from our database. That does not by itself delete your full SocialGrovv account; see Section 9. For details see our data deletion page.

5. AI-Assisted Features & Sub-processors

Our AI features rely on third-party providers acting as sub-processors. To produce an output, we send the prompts, scripts, character descriptions, reference media, and settings needed for that request to the relevant provider.

Training. SocialGrovv does not train its own AI models on your content. We call third-party model APIs to generate outputs for you. Whether a provider uses API data to train or improve its models is governed by that provider’s terms. AI outputs may be inaccurate — you remain responsible for reviewing them before use.

6. Who We Share Data With

We do not sell personal data. We share data only with:

• Sub-processors listed in Section 5, to run the Service.
• Link (Stripe) — merchant of record for checkout, tax, receipts, subscriptions, refunds, and payments.
• YouTube / Google — when you connect a channel and publish or schedule content.
• Authorities — when legally required (court order, valid law-enforcement request) or necessary to investigate fraud, abuse, or security threats, including content that endangers minors.
• Successor entities — in the event of a merger, acquisition, or sale of assets, subject to this Policy or notice of a new one.

7. International Data Transfers

Our hosting is in the EU (Poland and Ireland). Transfers of UK personal data to the EEA rely on UK adequacy regulations. Some AI providers process data in the United States; for those transfers we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and for EU users the EU Standard Contractual Clauses.

8. Data Security

• YouTube OAuth tokens are stored encrypted in our self-hosted publishing service, and other sensitive secrets we hold are encrypted before storage.
• Traffic between your browser and our servers is protected by TLS.
• Our database uses Supabase Row Level Security (RLS) so that you can access only your own rows; server-to-server jobs use keys that never reach the browser.
• Access to production systems and secrets is limited to authorised personnel on a least-privilege basis.

No system is fully secure, and we cannot guarantee absolute security.

9. Data Retention & Deletion

We keep your personal data for as long as you actively use SocialGrovv.

• Individual items: you can delete generations from the Generations page in the app.
• Account deletion: email [email protected] from the address on your account. After we verify the request, personal data and generated media associated with your account are removed from our systems and R2 storage within 30 days, except where we must retain records.
• Overflow workers: our Azure overflow workers are intended not to keep user data after a job finishes.
• Billing records are retained as long as required by tax and accounting law (and may also be held by Link and Stripe as merchant of record).
• Logs are typically retained for up to 12 months for security and troubleshooting.
• Blocked requests: if a request is blocked by our safety checks, we keep a short excerpt for up to 90 days to review abuse.

10. Your Rights

Under applicable data-protection law — including the UK GDPR and, where relevant, the EU GDPR — you have the right to:

• Access the personal data we hold about you.
• Correct incomplete or inaccurate data.
• Request erasure of your data.
• Object to or restrict certain processing activities.
• Withdraw consent where processing is based on consent, without affecting processing already carried out.
• Lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk, or your local EU data-protection authority if the EU GDPR applies to you.

For access, correction, or deletion requests, email [email protected].

11. Automated Processing

AI features generate content at your request. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated safety checks may block a request that appears to breach our Acceptable Use Policy; you can contact support if you think a block was a mistake.

12. Children

The Service is intended for adults and is not directed to or marketed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Content Reports

To report content or a copyright concern, email [email protected]. We process the information in a report only to review it and respond.

14. Cookies

We use cookies for sign-in and security, as described in our Cookie Policy.

15. Changes to this Policy

We may update this Privacy Policy from time to time. If a change is material, we will provide reasonable notice (for example by email or in-product notice) before it takes effect. The date at the top of this page reflects the last update.

16. Contact

For any privacy-related questions, concerns, or deletion requests, please reach out to us:

Email: [email protected]
We aim to acknowledge privacy requests within 3 days and will respond within the timeframes required by applicable law (typically up to one month under UK GDPR).
SocialGrovv Ltd — registered in England and Wales, company number 17316340.

Related Policies

• Terms of Service
• Acceptable Use Policy
• Refund Policy
• Cookie Policy
• Licenses
• Support