Social Magic (“we”, “us”) is a social media management service that publishes content to your connected social media accounts on your behalf. This policy explains what data we collect, how we use and store it, who we share it with, and how you can delete it. Social Magic is operated from Ontario, Canada.
Data we collect
- Account connection data. When you connect a social account (Facebook Pages, Instagram, TikTok, YouTube, LinkedIn, X, Google Business Profile), we receive an OAuth access token and basic profile identifiers (account id, name/handle, avatar) for the account you authorize. We never receive or store your social account password.
- Content you create. Captions, media, scheduling details, and drafts you produce in the app.
- Publishing & analytics data. The posts we publish for you and the public engagement metrics (reach, likes, comments, views) we retrieve for those posts, where you have granted the relevant analytics permission.
How we use your data
- To publish and schedule the content you ask us to post to your connected accounts.
- To show you analytics for the content we published.
- To maintain your connection (refreshing tokens) so scheduled posts succeed.
- We do not sell your personal data, and we do not use it for advertising.
How we store and protect your data
- OAuth access and refresh tokens are encrypted at rest (AES-256-GCM) and are only ever used server-side to act on the account you connected.
- Each customer’s connections and data are isolated to their own workspace.
- Outbound media fetches are restricted to public hosts to prevent server-side request abuse.
Per-platform data use
For each platform you connect, we request only the permissions needed to publish on your behalf (and, where enabled, to read the analytics for posts we published). We use platform data solely to provide these features and in accordance with each platform’s developer terms — Meta Platform Terms, the TikTok Developer Terms, the Google API Services User Data Policy (including its Limited Use requirements), and the LinkedIn API Terms.
AI features and the provider behind them
Some features generate or refine content for you — captions, copy suggestions, and images. To do that we send the material for that specific request to OpenAI, who process it and return the result. Depending on the feature this can include:
- the text you enter, such as a brief, a topic, or a caption you are editing;
- your brand details, such as brand name, tone, and colours, where the feature uses them;
- images, including logos and reference images from your Library, when you ask us to generate something based on them.
OpenAI processes this only to return the result of your request. We do not use your content to train AI models. OpenAI is currently the only AI provider we send your content to; if we add another, we will update this policy and the list below before any of your content is sent to it.
How we share data
We share content with the platform you direct us to publish to. Beyond that, we use a small number of service providers who process data on our behalf, under contract, only to operate the service:
- Supabase — database and file storage.
- Vercel — application hosting.
- OpenAI — the AI features described above.
- Trigger.dev — running scheduled jobs, such as publishing a post at the time you scheduled it.
- Resend — sending service emails and notifications.
- Stripe — subscription billing. Card details go to Stripe directly; we never receive or store them.
- Sentry — error reporting, so we can diagnose faults.
We do not sell your personal data and we do not share it with advertisers.
Data retention and deletion
- You can disconnect any account at any time from Settings. Disconnecting revokes the access token with the platform and immediately deletes that connection together with its posts and drafts, its conversations and messages, and its metrics.
- Media in your Library is kept when you disconnect a single account, because the same image can be used by posts on your other connected platforms. It is removed when you delete it yourself, or when you ask us to delete your account entirely.
- If you remove our app from a platform (e.g. Facebook), the platform notifies us and we delete the data associated with that account.
- To have everything deleted — including your Library media and your account itself — email us at the address below. We will action the request within30 days of receiving it, and sooner where we can.
Where your data is processed
Social Magic is operated from Ontario, Canada. Your data is stored and processed on infrastructure run by the providers listed above, which is located outside Canada, primarily in the United States. While information is outside Canada it may be accessible to the courts, law enforcement, and regulatory authorities of that country under its laws.
Contact
Questions or data requests: privacy@socialmagic.io.