Privacy Policy

SocialBall Privacy Policy Effective date: 26 October 2026 1. Who we are and how to contact us SocialBall is operated by STYFCSD Ltd, company number 16428748, registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Contact [email protected] about privacy, your information or this notice. This notice covers SocialBall account holders and visitors to public SocialBall pages. 2. Information SocialBall handles Account and security information includes your name, email address, password hash, profile address, timezone, preferences, session records and security events. We do not store your password in plain text. Content includes your profile, social links, uploaded photos and videos, captions, drafts, scheduled posts, chosen posting settings, delivery records and platform post identifiers or links. Connected-account information comes from the platforms you authorise. It includes account identifiers, names, avatars where supplied, granted permissions, encrypted access and refresh tokens, expiry and connection status. We do not ask for the password to your social account. Audience information includes profile views and link clicks, form submissions, email sign-ups, profile reports and information people choose to send to a creator. If you use billing or commerce features, relevant records may include plan and payment-provider references, order information and purchase/access history. Payment details entered into a payment provider’s checkout are handled by that provider. Requests to the service also involve technical information such as network addresses and browser headers. Information you send to [email protected] or through Settings is handled to respond to your enquiry or request. 3. Why information is used We use the following legal grounds: • Contract: creating and maintaining your account and providing the profile, publishing and other features you request. • Legitimate interests: protecting accounts and the service, preventing abuse, troubleshooting failures, maintaining delivery records and answering support enquiries. These interests are balanced against your rights and reasonable expectations. • Legal obligations: handling applicable data-protection requests and retaining records where the law requires it. • Consent: optional promotional communications and non-essential tracking where enabled. You can withdraw consent; this does not affect processing already carried out lawfully. Social-platform authorisation lets SocialBall perform the actions and use the permissions shown by that platform. You choose whether to connect an account and which content to send. Authorisation is not permission to publish arbitrary content on your behalf. Providing account details is necessary to create an account. Media and connected-account permissions are needed only for the features that use them. Without them those features may not work. 4. TikTok, Google/YouTube and Meta TikTok: user.info.basic identifies the connected account. video.publish sends your selected video and post settings through Direct Post. video.upload sends your selected video to your TikTok inbox; you must open the notification to continue editing and decide whether to post it or save it in TikTok. This does not automatically save a video in TikTok’s local Drafts folder. Creator information supplies account-specific visibility options, interaction restrictions and maximum duration. SocialBall checks delivery status and shows the result. TikTok retrieves server-held media through a time-limited signed URL on a verified domain. Google/YouTube: SocialBall uses Google authorisation and YouTube API Services to identify your channel and upload the videos and thumbnails you select, with your chosen visibility and audience settings. Google’s privacy policy is https://policies.google.com/privacy. You can remove access at https://myaccount.google.com/permissions. Instagram/Facebook: Meta authorisation identifies the professional account or Page you choose and enables publication of selected media. Meta may retrieve media through time-limited links. Availability depends on account eligibility, permissions and platform approval. SocialBall uses connected-platform data to provide the features you request. It does not sell that data or use it to train general-purpose AI models or target advertising. You can disconnect an account in Social accounts and revoke access in the platform’s own settings. Disconnecting removes SocialBall’s stored connection and tokens. It does not delete content already posted to the platform, your uploaded originals, or SocialBall’s separate delivery history. Manage published content on the platform; contact us about erasure of remaining SocialBall records. 5. Recipients and public content Information is disclosed to the platforms and accounts you choose for publishing. A published profile and publicly shared posts can be seen and copied by their audience. A creator can access information submitted to that creator’s forms or sign-up lists and has their own responsibilities for its use. Cloudflare provides the public connection and configured media services. Where payment features are enabled, Stripe handles the relevant payment processing and associated records. Service providers receive the information needed to deliver the functions you use. We may disclose information where required by law or necessary to investigate abuse or protect rights, subject to applicable law. SocialBall’s own account and content records are held on the server running the service and in its backups. They are not stored solely in your browser. 6. Cookies, storage and tracking An essential session cookie keeps you signed in. Browser storage remembers interface preferences and, on public profiles, a visitor’s tracking choice. A creator’s optional tracking tools are not loaded by the profile’s tracking integration until the visitor accepts its consent prompt. You can decline. To reset a stored choice, clear that site’s storage in your browser. External sites and platforms control their own cookies and privacy notices. 7. Retention, closure and erasure We assess retention by the purpose of each record: providing an active account and requested content; completing or investigating delivery; protecting security; responding to requests or disputes; and meeting applicable record-keeping obligations. Information should not be retained once those purposes no longer justify it. Disconnecting removes the stored connection and tokens. Account closure, where available, hides the profile, cancels pending work and deactivates access; it does not itself complete permanent erasure. Some billing, commerce or shared-workspace relationships must be resolved first. Erasure requests require manual assessment, including records in backups and third-party services. We must explain any records retained for a continuing lawful purpose and any applicable limits. There is no automatic account-erasure or backup-expiry promise in this notice. The absence of an automatic deletion button does not remove your statutory rights. Use Settings or [email protected] to make a request. 8. International processing Connected platforms and infrastructure providers operate internationally, so using them can involve processing outside the UK. Their roles and transfer arrangements depend on the service and relationship involved. Cloudflare’s customer data-processing terms describe transfer provisions, including standard contractual clauses and the UK Addendum where applicable: https://www.cloudflare.com/cloudflare-customer-dpa/. Contact [email protected] for information about the arrangements relevant to your use and copies of applicable safeguards. Provider arrangements must be checked for the services actually used; this notice does not claim that all information stays in the UK. 9. Your rights Depending on applicable law and the processing involved, you can request access, correction, erasure, restriction and portability, and withdraw consent. You can object to processing based on legitimate interests and to direct marketing. Settings includes account export and privacy-request controls; visitors and people unable to sign in can contact [email protected]. We may need to verify identity before disclosing or changing information and must respond within applicable legal time limits, explaining any permitted extension or refusal. You can complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or another competent data-protection authority. 10. Children and changes SocialBall is not intended for children below the minimum age applicable to the service and connected platform. Do not submit children’s personal information without an appropriate legal basis. Contact us if you believe a child’s information has been collected improperly. We will date revised notices and provide appropriate notice before a materially new use of information. Your statutory rights continue to apply.