Privacy Notice

1. Who we are

1.1 Our group

SocialPostxr is a service provided by Aceman Software Solutions Ltd (company number 12928098), registered at 8 Holtdale Grove, Leeds, England, LS16 7RZ. SocialPostxr Ltd (company number 17077525) is a related company that carries out our sales and marketing.

To be explicit about which company is which: ACEMAN SOFTWARE SOLUTIONS LTD (company number 12928098, registered at 8 Holtdale Grove, Leeds, England, LS16 7RZ) is the controller and is the company you contract with. SOCIALPOSTXR LTD (company number 17077525, registered at 17 Holt Walk, Leeds, England, LS16 7QB, incorporated 9 March 2026) carries out sales and marketing. It is not the controller, and it is not the company you contract with.

1.2 Data Protection Officer

We have not appointed a Data Protection Officer. We are not required to appoint one under Article 37 of the UK GDPR. Privacy questions and requests to exercise your rights go to the contact below, which is monitored by the people responsible for data protection at Aceman Software Solutions Ltd.

2. What we collect

2.1 Information you give us

• Account details: your name, email address and a hashed password.
• Billing details: handled by Stripe. We receive confirmation that a payment succeeded or failed, plus a Stripe customer identifier so we know which account it belongs to. Your card details go directly to Stripe and never reach us.
• Content you create or upload: post text, images and video, brand descriptions, tone and visual-identity notes, target-audience descriptions, campaign briefs, questionnaire answers, and a website address if you ask us to build a brand profile from one.
• Anything you put in a support message: including whatever you choose to tell us in it.
• Social account authorisations: the tokens that let us publish to the accounts you connect.

2.2 Information we collect automatically

• Device and browser information: browser type, operating system, screen size.
• Usage data: pages visited, features used, time spent.
• Log data: IP address, access times, referring URLs.
• Diagnostics: when something breaks, the error and the code path that produced it, tagged with an account identifier that is not your name or email. Request bodies, cookies and authentication headers are not included.

2.3 Your country, and the two different ways we work it out

• On this website: your country comes from a header our CDN has already attached to your request, and is used only to pick which currency to show. No IP address is sent to anyone else and nothing is looked up. We do not store the country; the currency it produces is saved in your own browser, as sy-preferred-currency in the table in section 7, so we do not have to work it out again on every page.
• When you create an account: we offer to detect your country automatically so your currency and settings start out right. This is optional. If you agree, your IP address is sent to Kloudend, Inc. (ipapi.co) to look up the country, and nothing else. If you decline, you pick your country from a list and nothing is sent anywhere. Lawful basis: your consent, Article 6(1)(a) — and you can withdraw it.

2.4 Information we get from others

• Social media platforms: when you connect an account for publishing, we receive the tokens and account identifiers needed to post on your behalf, plus the analytics, comments and messages that come back for the posts we published.
• Our payment processor: confirmation that a payment succeeded or failed.

3. People who appear in images our users upload

Our users upload images to turn into social media posts — a photo of a shop, a team, an event, a customer holding a product. Those images sometimes contain other people. When that happens, we hold personal data about someone we have no relationship with, and we did not get it from them.

3.1 What happens to the image

• It is stored in our database and file storage, hosted by Supabase, Inc.
• It may be sent to OpenAI to be described, edited or used to generate a variation.
• If our user schedules a post using it, it is published to the social media accounts they have connected, through Ayrshare LLC.
• It is deleted from our systems when our user deletes it, or when their account is closed. If it has already been published to a social media platform, deleting it here does not remove it from there — only the account holder or the platform can do that.

3.2 What we do not do

• We do not try to identify you. No facial recognition, no matching against other images, no attempt to work out who you are or link you to anything else. The image is processed as an image.
• We do not build a profile of you or use your image for advertising.
• We do not use it to train AI models, and we instruct our providers not to.

3.3 Who decided to upload it

Our user did. They chose the image, and under our Terms of Service they confirm they have the right to use it. They decide what is uploaded and what gets published; we decide how it is stored and which providers process it. Both of us therefore have obligations to you.

We will not use that split as a reason to send you away. If you contact us we will act on what is ours to act on — deleting the image from our systems, stopping it being processed further — and tell you plainly what only the account holder or the platform can do. If you know who posted the image, asking them as well is usually the fastest route to getting it taken down where it was published.

3.4 Your rights, and how to use them

Most of the rights in section 12 apply to you: you can ask what we hold about you, ask for it to be corrected or deleted, ask us to restrict what we do with it, and object to us holding it at all (Articles 15, 16, 17, 18 and 21). Data portability (Article 20) does not, because it applies only where processing rests on your consent or a contract with you, and neither applies here — you never gave us anything. Email privacy@socialpostxr.com, tell us enough to find the image, and we will act on it.

We do not contact people in this position individually, because we do not know who they are or how to reach them — working it out would mean trying to identify them, which is exactly what we have chosen not to do. Article 14(5)(b) of the UK GDPR allows this notice to serve as the information instead, and that is what it is doing here.

4. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we need a lawful basis for everything we do with your data. Ours are:

• To provide the service you signed up for — creating your account, generating and scheduling posts, publishing them, taking payment. Lawful basis: performance of a contract, Article 6(1)(b).
• To keep the service working, fast and secure — being told when it breaks, seeing where it is slow, blocking attacks and abuse, and replying when you contact us for support. Lawful basis: legitimate interests, Article 6(1)(f).
• To understand how the site is used — analytics. Lawful basis: your consent, Article 6(1)(a). Nothing analytics-related runs unless you turn it on, and you can turn it off again at any time.
• To detect your country when you sign up, if you agree to it. Lawful basis: your consent, Article 6(1)(a). Decline and you choose your country from a list instead.
• To meet legal obligations — keeping accounting records, responding to lawful requests. Lawful basis: legal obligation, Article 6(1)(c).

4.1 Where we rely on legitimate interests

Legitimate interests is the basis we use least, and only where the processing is what you would expect from a service that has to stay up. These are the providers involved and the interest in each case:

• Cloudflare, Inc. — Hosting this site; CDN, TLS, WAF and bot management in front of the API. Keeping the site and the API available and protected from attack, bots and abuse.
• Microsoft Ireland Operations Limited — Sending transactional and support email. Replying to you when you contact us for support. We cannot answer a support request without sending you an email.
• Functional Software, Inc. (Sentry) — Error monitoring and service reliability. Being told when the service breaks, with enough detail to fix it, rather than waiting for someone to report it.
• Grafana Labs — Performance monitoring. Knowing which parts of the service are slow, so we can keep it usable.

5. Whether you have to give us your data

6. Automated processing and AI

SocialPostxr generates social media content automatically from material you supply — your brand details, product descriptions, uploaded images and the prompts you write. This is automated processing, and we would rather describe it plainly than leave you to guess.

• What goes in: brand names and descriptions, tone and visual-identity notes, target-audience descriptions, campaign briefs, questionnaire answers, images you upload, and a website address if you ask us to build a brand profile from one. Your email address is not sent.
• Where it goes: to OpenAI, acting as our processor, which generates draft text and images. Full details are in the subprocessor register.
• What comes out: draft posts and images, presented to you for review.
• You stay in control: nothing is published automatically without your instruction. You can edit or discard anything generated.

7. Cookies and similar technologies

This is everything we store on your device. Nothing in the optional categories is set until you turn it on, and turning a category off deletes what it stored.

You can change your mind at any time using the Cookie settings link in the footer of every page. Our Cookie Policy explains each entry in more detail, and why we do not keep a server-side record of your choice.

If you have analytics turned on, you can also opt out of Google Analytics across all sites with the Google Analytics Opt-out Browser Add-on.

8. Who we share it with

We do not sell your personal data. This section covers everyone else who ends up with any of it, and why.

8.1 Providers who process data for us

Nearly all of these are our processors: each is under a written contract requiring them to act only on our instructions, to keep the data secure, and to delete or return it when we stop using them. There is one exception, Google Fonts, which is a free public service with no contract available — 8.2 explains it. This is the full published register: what each one does, what they receive, the lawful basis, how long they keep it and where. The same table is on our subprocessors page.

We also maintain a fuller register internally, which includes providers that are configured in our systems but that currently receive no personal data. Only the providers that actually receive personal data are published above. We update this notice whenever that changes.

Register last verified against production: 1 August 2026.

8.2 Fonts in the app

When you use the SocialPostxr app, your device loads fonts from Google Fonts (Google LLC, in the United States), and Google receives your IP address along with basic technical details of the request — your browser or device type, and which font files were asked for.

This happens whenever you use the app, not only when you choose a font: the app's text engine loads its own fallback faces from Google as well. Previewing or applying a brand font in the font picker loads more. Our own two brand faces are built into the app and never reach Google.

This is a direct connection from your device to Google. The request does not pass through us and we never see it. Google states that font requests are not associated with a Google account and are not used to build a profile of you. No account identifier of ours is sent. The register above shows the basis we rely on for this transfer, and section 9 explains why it is different from every other row.

8.3 Social media platforms you connect

When you connect an account, we send that platform only the content you have chosen to publish, plus what the platform needs to accept it. We request only the permissions needed to post. What the platform then does with it is governed by that platform's own privacy policy, not ours.

8.4 Partners who referred you

8.5 Legal requirements and business transfers

We may disclose data where we are legally required to, to respond to a lawful request from a public authority, or to establish or defend legal claims. If the business is sold or merged, your data may transfer with it — we will tell you before that happens and explain what choices you have.

9. Sending data outside the UK

Where a recipient is outside the UK and is not covered by UK adequacy regulations, we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the EU Standard Contractual Clauses where that is the instrument the recipient offers. We do not rely on the EU Standard Contractual Clauses on their own, because they are not a valid transfer mechanism for a UK exporter.

In practice that means: UK International Data Transfer Agreement (IDTA) / UK Addendum. Where a provider is in a country the UK has found to provide adequate protection — which includes the EEA — we rely on those adequacy regulations instead and no additional safeguard is needed. The location and the safeguard for each provider is shown in the register in section 8.

You can ask us for a copy of the safeguards we rely on for any specific transfer — email privacy@socialpostxr.com.

10. How long we keep it

• Account and content: for as long as your account is open.
• After you delete your account: we delete or anonymise your personal data. We do this on request, and we do it when we close an account at your instruction — there is no automatic timer running today, so if you want your data gone at a particular point, ask us and we will do it. Anything we are required by law to keep, such as billing records, is kept for the period below and nothing longer.
• Billing and accounting records: six years from the end of the financial year they relate to, because UK tax law requires it.
• Support correspondence: two years from the last message, so we have context if you come back to us.
• Error and performance diagnostics: a limited period set in each provider's configuration, shown per provider in the register in section 8.
• Your cookie choice: six months, then we ask again.

Provider-specific retention is shown in the register in section 8.

11. How we protect it

• Encryption in transit (TLS) and at rest.
• Passwords stored only as salted hashes — we cannot read yours.
• Access to production data limited to the people who need it, and logged.
• A web application firewall and bot management in front of this site and our API.
• Written contracts with every provider that processes personal data on our behalf — with one exception, Google Fonts, explained in 8.2.

No system is perfectly secure, and we will not claim otherwise. If a breach happens that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the law requires it.

12. Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (Article 15).
• Correct anything inaccurate or incomplete (Article 16).
• Delete it, where we have no overriding reason to keep it (Article 17).
• Restrict what we do with it while a dispute is resolved (Article 18).
• Send it elsewhere in a structured, machine-readable format (Article 20).
• Object to processing based on legitimate interests, including any direct marketing (Article 21). See section 4.1 for what we rely on that basis for.
• Withdraw consent at any time, where consent is the basis (Article 7(3)). Withdrawing does not make what we did beforehand unlawful. For cookies, use the Cookie settings link in the footer.

13. Complaining to the ICO

If you think we have mishandled your personal data, please tell us first — we would rather fix it. But you do not have to come to us first, and you can complain to the supervisory authority at any time.

14. Children

SocialPostxr is not for children under 16, and we do not knowingly collect their personal data. If we find that we have, we delete it. If you believe a child has given us their data, tell us at privacy@socialpostxr.com and we will remove it.

15. Changes to this notice

We update this notice when what we do with personal data changes. The version and date at the top of the page tell you which one you are reading. If a change is significant — a new category of data, a new recipient, a new purpose — we will tell you directly by email before it takes effect, and where the change relies on your consent we will ask you for it.

We will not treat your continued use of the site as agreement to anything. If we need your consent, we will ask for it and you can say no.

16. Contact us

• Controller: ACEMAN SOFTWARE SOLUTIONS LTD
• Company number: 12928098
• Registered office: 8 Holtdale Grove, Leeds, England, LS16 7RZ
• Email: privacy@socialpostxr.com

We aim to respond to privacy enquiries within five working days, and always within one month.