Privacy Policy

1. Introduction

This Privacy Policy describes how SocialCraft AI ("we", "us", "our") collects, uses, and shares your personal information when you use our service.

Chrome Web Store Limited Use: The use of information handled by SocialCraft AI Copilot is limited to providing or improving the extension's disclosed user-facing features and related security, reliability, and legal operations. The use of information received from Google APIs, if any, will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell extension data, use it for personalized advertising, or permit humans to read it except with your specific consent or as necessary for security or legal compliance.

Chrome Extension Limited Use Disclosure

The use of information received from the SocialCraft AI Copilot extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

1. Limited to the disclosed purpose. Data collected through the extension is used strictly to provide the features disclosed at the point of use: LinkedIn profile intelligence, contact tracking, AI-assisted drafting, single-page audits ("Scout"), network import from your own LinkedIn data export, and the LinkedIn Relationship OS. It is never used for any other purpose, including advertising, ad targeting, or building profiles about you beyond those features.
2. No unauthorized third-party transfers. Your data is transmitted only to SocialCraft AI's own backend (over HTTPS, to your authenticated account) and to the sub-processors required to run a feature you request (e.g., hosting, database, and AI providers invoked when you ask for an analysis or draft). It is not sold, licensed, or shared with data brokers, advertising platforms, or any other third party.
3. No unconsented human access. Humans at SocialCraft AI do not read your extension data unless (a) you ask us to (for example, a support request), (b) it is needed for security or abuse investigation, or (c) it is required by law.
4. No advertising or commercial exploitation. We do not use extension data for personalized advertising, transfer it to ad networks or information resellers, or use it to determine creditworthiness or for lending purposes.
5. You stay in control. Nothing runs in the background: the extension only reads pages you are viewing and act on, after an explicit consent gate. You can revoke site access at any time, delete any tracked contact from your account, or delete your account entirely (see Section 5.3 above).
6. Contact. Questions about this disclosure: message @Social_Craft_AI on X.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password
• Profile Information: Company name, profile picture (optional)
• Payment Information: Processed by Stripe (we do not store card details)
• Content: Text prompts, generated content, saved drafts

2.2 Automatically Collected Information

• Usage Data: Features used, generation counts, timestamps
• Device Information: IP address, browser type, operating system
• Cookies: Session management, analytics, and preferences for the web app

2.3 Third-Party Information

If you connect an external service, we may receive the profile, permission, or session information needed to provide that integration. NotebookLM session cookies are not collected automatically: they are user-provided when you paste an export into Product Guru.

• OAuth Data: When connecting social media accounts (profile info, permissions)
• Analytics and marketing tools: Vercel Analytics, Google Tag Manager, MailerLite, and first-party Supabase analytics events. These tools may receive device, usage, page, or signup-event information according to their configurations.
• Chrome extension data: If you install SocialCraft AI Copilot, it stores your SocialCraft access token and a local data-use consent preference in the browser extension's local storage for authentication and consent state. On SocialCraft AI, LinkedIn, X, and Twitter pages—and on any other site after you enable scout access through a one-time Chrome prompt—the extension may process the active page's title, URL, visible content, profile data, saved post text, and interaction log entries (connection, timestamp, and any note you type in the side panel) to provide the feature you request. The extension does not read or transmit LinkedIn message or comment text. When the backend reports that the account is pending deletion, the extension clears that locally stored token; otherwise it remains until sign-out or removal of extension data.

2.4 Chrome Extension Data Flows

The optional SocialCraft AI Copilot Chrome extension runs content scripts on SocialCraft AI, LinkedIn, X, and Twitter hosts. It injects no UI into LinkedIn pages: LinkedIn intelligence, interaction logging, and contact tracking render exclusively in the side panel, driven by the active tab's URL. Before consent, its content scripts only exchange the consent/readiness messages needed to establish the gate; they do not inspect page DOM or extract/transmit page, profile, message, or connection content. On any other site you choose to scout, the extension asks for access through a single one-time Chrome permission prompt when you click "Enable Scout on any site" (revocable at any time in chrome://extensions → Site access); it then injects its bundled core script into that page on demand and reads page content only when you click Scout This Page. It does not request Chrome's cookies permission and does not read Google cookies.

• Authentication: After you sign in to SocialCraft AI, the web app can synchronize a Supabase access token with the extension. The extension stores that token and a local consent preference in chrome.storage.local and sends the token as a Bearer credential only to the authenticated SocialCraft backend. Signing out sends a logout signal that clears the stored token. Before consent, content scripts do not read page/profile/message data or create on-page feature controls.
• Page context: When you click Scout This Page, the extension reads the active page's title, URL, and visible main-content text. That context is kept in the side panel's in-memory state and can be sent to the SocialCraft backend when you request AI Enhance or an audit. You can also hand it into the SocialCraft web app's content generator with "Use in Generator"; it is held in the browser's session storage only until the generator consumes it, is not sent to the backend, and is not stored long-term.
• Profile and post data: When you click Run SWOT or Save this post in the side panel (or use the on-page Save to Vault buttons on X), the extension processes the relevant visible profile or post data on your click and sends it to the authenticated SocialCraft backend for that feature. LinkedIn Relationship Intelligence is rendered in the side panel from a URL-only CRM lookup.
• Personal communications: The extension does not read or transmit LinkedIn message or comment text. Interaction logging is manual and explicit: from the side panel you can log an interaction (connection, timestamp, and an optional note you type) by clicking Quick Log or Log with note. Nothing is captured automatically, and the extension does not independently verify platform delivery.
• Local persistence: The extension does not maintain a browsing-history database and does not persist page content, profile data, post text, or communications in its own storage.

3. How We Use Your Information

We use your information to:

• Provide and improve our service
• Process payments and manage subscriptions
• Generate AI content based on your prompts
• Send transactional emails (receipts, account updates)
• Send marketing emails (with your consent - opt-out anytime)
• Analyze usage patterns and improve features
• Prevent fraud and abuse
• Comply with legal obligations

4. How We Share Your Information

We share your information with service providers only as needed to provide a feature you request, operate the service, secure accounts, process payments, or comply with law:

4.1 Service Providers

• Stripe: Payment processing
• Supabase: Database and authentication
• AI and data-processing providers: Google Gemini, OpenAI, OpenRouter, Perplexity, Firecrawl, Brave Search, ElevenLabs, Hugging Face/Chatterbox, and other providers enabled for a requested generation, analysis, search, scraping, transcription, or voice feature. The data sent depends on the operation you start.
• Media and content providers: Pexels for requested stock-media search and CDN delivery.
• NotebookLM / Google: When you explicitly connect Product Guru, the backend uses the Google session-cookie export you provide to operate the NotebookLM service and synchronize selected Knowledge Vault sources.
• Email providers: Resend for transactional notifications and, where enabled, MailerLite for web-app marketing/signup communications.
• Hosting, infrastructure, and monitoring: Vercel for the web app and analytics, Railway for the backend, Supabase for authentication, database, storage, and edge functions, and Sentry when error monitoring is enabled.
• Social platforms: LinkedIn, X/Twitter, Instagram/Meta, TikTok, Pinterest, and YouTube when you connect an account or request a supported publishing, analytics, or intelligence feature.

4.2 Legal Requirements

• When required by law or legal process
• To protect our rights or property
• To prevent illegal activity

4.3 Business Transfers

• In case of merger, acquisition, or sale of assets

5. Data Storage & Security

5.1 Storage Location

• Data stored on Supabase servers (AWS infrastructure)
• Primary application infrastructure is operated from the United States, while integrated providers may process data in other countries.
• Data is encrypted in transit where supported and protected by the applicable provider's storage controls. OAuth tokens and NotebookLM session cookies are additionally encrypted by the application before storage when the required encryption key is configured; if that key is not configured, the integration is not considered protected by that application-layer encryption control.
• User-uploaded and generated first-party media buckets, and the NotebookLM document vault, are private; the application issues time-limited signed URLs or authenticated server access for authorized operations. Third-party stock-media URLs remain subject to the provider's controls.

5.2 Security Measures

• Authentication, row-level ownership controls, and service-role separation
• Encrypted application handling for OAuth credentials and user-provided NotebookLM session data when the required encryption key is configured
• Private first-party media storage with time-limited signed access URLs
• HTTPS/TLS communications with integrated services where supported
• Operational monitoring and scheduled cleanup jobs

5.3 Data Retention and Account Deletion

• Active accounts: Account data is retained while needed to provide the service or until you delete it.
• Account deletion: When you request deletion, the SocialCraft backend blocks authenticated API access, records the request durably, and schedules the account for purge 30 days after the request. A daily automated cleanup job claims due requests and purges the account's application records, first-party storage objects, NotebookLM temporary files, and Supabase Auth account. Because the worker runs daily, the purge may occur shortly after the 30-day mark. Failed attempts remain marked for retry and are not treated as complete; until a purge succeeds, the account remains in a pending-deletion state. The cleanup process is subject to operational availability and applicable legal or provider-retention exceptions.
• Feature-level caches and temporary processing data may have shorter retention periods and are removed by their applicable cleanup jobs.
• Third-party providers may retain data under their own terms, technical logs, backups, or legal obligations. We request deletion or disconnect provider data where the integration supports it, but cannot control independent provider retention.
• Legal, security, fraud-prevention, tax, and accounting records may be retained for the period required by law or legitimate operational need.

6. Your Rights

6.1 GDPR Rights (EU Users)

• Access: Request a copy of your data
• Correction: Update inaccurate information
• Deletion: Request account and data deletion ("right to be forgotten")
• Portability: Export your data in machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to data processing for marketing purposes

6.2 CCPA Rights (California Users)

• Know what personal information we collect
• Know whether we sell or share your data (we don't)
• Request deletion of your information
• Opt-out of data sales (not applicable - we don't sell data)
• Non-discrimination for exercising your rights

6.3 Exercising Your Rights

Contact us via @Social_Craft_AI on X/Twitter. We will respond within 30 days.

7. Cookies & Tracking

7.1 Cookies We Use

• Essential: Session management, authentication (required)
• Analytics and marketing tags: Google Tag Manager, Vercel Analytics, and MailerLite scripts or events may be loaded according to the web app configuration and your preferences. The current implementation does not use the Google Analytics product directly.
• Preferences: UI settings, language preferences

7.2 Cookie Management

You can control web-app cookies through your browser settings. Disabling essential cookies may affect functionality.

7.3 NotebookLM session-cookie flow

Product Guru is a web-app-only integration. The extension neither requests the Chrome cookies permission nor reads Google cookies. If you connect Product Guru, the cookie export you provide is associated with your authenticated account, encrypted at rest by the backend when the required encryption key is configured, used to activate your NotebookLM session, and removed when you disconnect or when the stored record is invalid or undecryptable. Disconnecting also removes Product Guru state and document metadata and attempts to clean up the linked NotebookLM notebook; Google/NotebookLM may retain independent server-side records under its own policies.

8. Third-Party Services

Our service integrates with third-party platforms including Supabase, Stripe, Vercel, Railway, Resend, MailerLite, Google/Gemini/NotebookLM, OpenAI, OpenRouter, Perplexity, Firecrawl, Pexels, ElevenLabs, Hugging Face, LinkedIn, X/Twitter, Meta/Instagram, TikTok, Pinterest, and YouTube. Their privacy policies, terms, API rules, and retention practices also apply to data they process. We configure these services to support the SocialCraft feature you request, but their independent processing is outside our control.

9. Children's Privacy

Our service is not intended for users under 13 (or 16 in the EU). We do not knowingly collect information from children.

10. International Users

Our primary application infrastructure is in the United States. Depending on the feature and provider configuration, information may be transferred to and processed in other countries. Where applicable, we use contractual, technical, or other safeguards required for international transfers. You may contact us to ask about the safeguards relevant to your request.

11. Changes to This Policy

We may update this policy periodically. Material changes will be notified through the service or by email where reasonably practicable.

12. Contact Us