Privacy Notice

1. Who we are

1.1 Our group

SocialPostxr is a service provided by Aceman Software Solutions Ltd (company number 12928098), registered at 8 Holtdale Grove, Leeds, England, LS16 7RZ. SocialPostxr Ltd (company number 17077525) is a related company that carries out our sales and marketing.

To be explicit about which company is which: ACEMAN SOFTWARE SOLUTIONS LTD (company number 12928098, registered at 8 Holtdale Grove, Leeds, England, LS16 7RZ) is the controller and is the company you contract with. SOCIALPOSTXR LTD (company number 17077525, registered at 17 Holt Walk, Leeds, England, LS16 7QB, incorporated 9 March 2026) carries out sales and marketing. It is not the controller, and it is not the company you contract with.

1.2 Data Protection Officer

We have not appointed a Data Protection Officer. We are not required to appoint one under Article 37 of the UK GDPR. Privacy questions and requests to exercise your rights go to the contact below, which is monitored by the people responsible for data protection at Aceman Software Solutions Ltd.

2. What we collect

2.1 Information you give us

• Account details: your name, email address and a hashed password.
• Billing details: handled by Stripe. We receive confirmation that a payment succeeded or failed, plus a Stripe customer identifier so we know which account it belongs to. Your card details go directly to Stripe and never reach us.
• Content you create or upload: post text, images and video, brand descriptions, tone and visual-identity notes, target-audience descriptions, campaign briefs, questionnaire answers, and a website address if you ask us to build a brand profile from one.
• Anything you put in a support message: including whatever you choose to tell us in it.
• Social account authorisations: the tokens that let us publish to the accounts you connect.

2.2 Information we collect automatically

• Device and browser information: browser type, operating system, screen size.
• Usage data: pages visited, features used, time spent.
• Log data: IP address, access times, referring URLs.
• Diagnostics: when something breaks, the error and the code path that produced it, tagged with an account identifier that is not your name or email. Request bodies, cookies and authentication headers are not included.

2.3 Your country, and the two different ways we work it out

• On this website: your country comes from a header our CDN has already attached to your request, and is used only to pick which currency to show. No IP address is sent to anyone else and nothing is looked up. We do not store the country; the currency it produces is saved in your own browser, as sy-preferred-currency in the table in section 7, so we do not have to work it out again on every page.
• When you create an account: we offer to detect your country automatically so your currency and settings start out right. This is optional. If you agree, your IP address is sent to Kloudend, Inc. (ipapi.co) to look up the country, and nothing else. If you decline, you pick your country from a list and nothing is sent anywhere. Lawful basis: your consent, Article 6(1)(a), and you can withdraw it.

2.4 Information we get from others

• Social media platforms: when you connect an account for publishing, we receive the tokens and account identifiers needed to post on your behalf, plus the analytics, comments and messages that come back for the posts we published.
• Our payment processor: confirmation that a payment succeeded or failed.

3. People who appear in images our users upload

Our users upload images to turn into social media posts, a photo of a shop, a team, an event, a customer holding a product. Those images sometimes contain other people. When that happens, we hold personal data about someone we have no relationship with, and we did not get it from them.

3.1 What happens to the image

• It is stored in our database and file storage, hosted by Supabase, Inc.
• It may be sent to OpenAI to be described, edited or used to generate a variation.
• If our user schedules a post using it, it is published to the social media accounts they have connected, through Ayrshare LLC.
• It is deleted from our systems when our user deletes it, or when their account is closed. If it has already been published to a social media platform, deleting it here does not remove it from there, only the account holder or the platform can do that.

3.2 What we do not do

• We do not try to identify you. No facial recognition, no matching against other images, no attempt to work out who you are or link you to anything else. The image is processed as an image.
• We do not build a profile of you or use your image for advertising.
• We do not use it to train AI models, and we instruct our providers not to.

3.3 Who decided to upload it

Our user did. They chose the image, and under our Terms of Service they confirm they have the right to use it. They decide what is uploaded and what gets published; we decide how it is stored and which providers process it. Both of us therefore have obligations to you.

We will not use that split as a reason to send you away. If you contact us we will act on what is ours to act on, deleting the image from our systems, stopping it being processed further, and tell you plainly what only the account holder or the platform can do. If you know who posted the image, asking them as well is usually the fastest route to getting it taken down where it was published.

3.4 Your rights, and how to use them

Most of the rights in section 12 apply to you: you can ask what we hold about you, ask for it to be corrected or deleted, ask us to restrict what we do with it, and object to us holding it at all (Articles 15, 16, 17, 18 and 21). Data portability (Article 20) does not, because it applies only where processing rests on your consent or a contract with you, and neither applies here, you never gave us anything. Email privacy@socialpostxr.com, tell us enough to find the image, and we will act on it.

We do not contact people in this position individually, because we do not know who they are or how to reach them, working it out would mean trying to identify them, which is exactly what we have chosen not to do. Article 14(5)(b) of the UK GDPR allows this notice to serve as the information instead, and that is what it is doing here.

4. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we need a lawful basis for everything we do with your data. Ours are:

• To provide the service you signed up for, creating your account, generating and scheduling posts, publishing them, taking payment. Lawful basis: performance of a contract, Article 6(1)(b).
• To keep the service working, fast and secure, being told when it breaks, seeing where it is slow, blocking attacks and abuse, and replying when you contact us for support. Lawful basis: legitimate interests, Article 6(1)(f).
• To understand how the site is used, Google Analytics. Lawful basis: your consent, Article 6(1)(a). Nothing from Google Analytics runs unless you turn it on, and you can turn it off again at any time.
• To count visits to the site, Cloudflare Web Analytics. It runs for every visitor, it sets no cookie and no identifier on your device, and it records only the page you visited, the page you came from, your screen size and how long the page took to load. Because it stores nothing on your device and adds no recipient beyond the Cloudflare that already serves this site, we do not ask for your consent to it. Lawful basis: legitimate interests, Article 6(1)(f).
• To count visits and the steps you take in our tools, Site statistics. It runs for everyone, sets no cookie and no identifier on your device, and is not part of the consent choices above. It keeps an aggregate count and a scrambled one-way form of your internet address, which the backend removes after 30 days. Cloudflare, who host the site, measures the visit counter for us, and you can turn it off with the Cookie settings link in the footer. Lawful basis: legitimate interests, the statistical-purposes exception, Article 6(1)(f).
• To detect your country when you sign up, if you agree to it. Lawful basis: your consent, Article 6(1)(a). Decline and you choose your country from a list instead.
• To measure and target our advertising. Lawful basis: your consent, Article 6(1)(a).
• To meet legal obligations, keeping accounting records, responding to lawful requests. Lawful basis: legal obligation, Article 6(1)(c).

4.1 Where we rely on legitimate interests

Legitimate interests is the basis we use least, and only where the processing is what you would expect from a service that has to stay up. These are the providers involved and the interest in each case:

• Cloudflare, Inc., Hosting this site; CDN, TLS, WAF and bot management in front of the API; web analytics (page views and performance timings, cookieless). Keeping the site and the API available and protected from attack, bots and abuse; and measuring how many people the site reaches, with a cookieless beacon that sets no identifier.
• Microsoft Ireland Operations Limited, Sending transactional and support email. Replying to you when you contact us for support. We cannot answer a support request without sending you an email.
• Functional Software, Inc. (Sentry), Error monitoring and service reliability. Being told when the service breaks, with enough detail to fix it, rather than waiting for someone to report it.
• Grafana Labs, Performance monitoring. Knowing which parts of the service are slow, so we can keep it usable.

5. Whether you have to give us your data

6. Automated processing and AI

SocialPostxr generates social media content automatically from material you supply, your brand details, product descriptions, uploaded images and the prompts you write. This is automated processing, and we would rather describe it plainly than leave you to guess.

• What goes in: brand names and descriptions, tone and visual-identity notes, target-audience descriptions, campaign briefs, questionnaire answers, images you upload, and a website address if you ask us to build a brand profile from one. Your email address is not sent.
• Where it goes: to OpenAI, acting as our processor, which generates draft text and images. Full details are in the subprocessor register.
• What comes out: draft posts and images, presented to you for review.
• You stay in control: nothing is published automatically without your instruction. You can edit or discard anything generated.

7. Cookies and similar technologies

This is everything we store on your device. Nothing in the optional categories is set until you turn it on, and turning a category off deletes what it stored.

Cloudflare Web Analytics also counts your visit, but it sets no cookie and no identifier on your device, so it is not in the table above. It runs for every visitor and is described in section 4.

You can change your mind at any time using the Cookie settings link in the footer of every page. Our Cookie Policy explains each entry in more detail, and why we do not keep a server-side record of your choice.

If you have analytics turned on, you can also opt out of Google Analytics across all sites with the Google Analytics Opt-out Browser Add-on.

8. Who we share it with

We do not sell your personal data. This section covers everyone else who ends up with any of it, and why.

8.1 Providers who process data for us

Nearly all of these are our processors: each is under a written contract requiring them to act only on our instructions, to keep the data secure, and to delete or return it when we stop using them. Three do not act for us: Google Fonts, a free public service with no contract available (8.2 explains it), and Apple and Google, which run their wallets for themselves, under their own privacy terms. This is the full published register: what each one does, what they receive, the lawful basis, how long they keep it and where. The same table is on our subprocessors page.

We also maintain a fuller register internally, which includes providers that are configured in our systems but that currently receive no personal data. Only the providers that actually receive personal data are published above. We update this notice whenever that changes.

Register last verified against production: 15 October 2026.

8.2 Fonts in the app

When you use the SocialPostxr app, your device loads fonts from Google Fonts (Google LLC, in the United States), and Google receives your IP address along with basic technical details of the request, your browser or device type, and which font files were asked for.

This happens whenever you use the app, not only when you choose a font: the app's text engine loads its own fallback faces from Google as well. Previewing or applying a brand font in the font picker loads more. Our own two brand faces are built into the app and never reach Google.

This is a direct connection from your device to Google. The request does not pass through us and we never see it. Google states that font requests are not associated with a Google account and are not used to build a profile of you. No account identifier of ours is sent. The register above shows the basis we rely on for this transfer, and section 9 explains how it differs from most rows.

8.3 Social media platforms you connect

When you connect an account, we send that platform only the content you have chosen to publish, plus what the platform needs to accept it. We request only the permissions needed to post. What the platform then does with it is governed by that platform's own privacy policy, not ours.

8.4 Partners who referred you

8.5 Legal requirements and business transfers

We may disclose data where we are legally required to, to respond to a lawful request from a public authority, or to establish or defend legal claims. If the business is sold or merged, your data may transfer with it, we will tell you before that happens and explain what choices you have.

9. Sending data outside the UK

Where a recipient is outside the UK and is not covered by UK adequacy regulations, we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the EU Standard Contractual Clauses where that is the instrument the recipient offers. We do not rely on the EU Standard Contractual Clauses on their own, because they are not a valid transfer mechanism for a UK exporter.

In practice that means: UK International Data Transfer Agreement (IDTA) / UK Addendum. Where a provider is in a country the UK has found to provide adequate protection, which includes the EEA, we rely on those adequacy regulations instead and no additional safeguard is needed. The location and the safeguard for each provider is shown in the register in section 8.

You can ask us for a copy of the safeguards we rely on for any specific transfer, email privacy@socialpostxr.com.

10. How long we keep it

• Account and content: for as long as your account is open.
• After you delete your account: we delete or anonymise your personal data. We do this on request, and we do it when we close an account at your instruction, there is no automatic timer running today, so if you want your data gone at a particular point, ask us and we will do it. Anything we are required by law to keep, such as billing records, is kept for the period below and nothing longer.
• Billing and accounting records: six years from the end of the financial year they relate to, because UK tax law requires it.
• Support correspondence: kept under our mailbox retention settings, so we have context if you come back to us. The current setting is in our subprocessor register.
• Error and performance diagnostics: a limited period set in each provider's configuration, shown per provider in the register in section 8.
• Your cookie choice: six months, then we ask again.

Provider-specific retention is shown in the register in section 8.

11. How we protect it

• Encryption in transit (TLS) and at rest.
• Passwords stored only as salted hashes, we cannot read yours.
• Access to production data limited to the people who need it, and logged.
• A web application firewall and bot management in front of this site and our API.
• Written contracts with every provider that processes personal data on our behalf. The register also names three that do not act for us: Google Fonts, and Apple and Google for their wallets, explained in 8.1.

No system is perfectly secure, and we will not claim otherwise. If a breach happens that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the law requires it.

12. Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you (Article 15).
• Correct anything inaccurate or incomplete (Article 16).
• Delete it, where we have no overriding reason to keep it (Article 17).
• Restrict what we do with it while a dispute is resolved (Article 18).
• Send it elsewhere in a structured, machine-readable format (Article 20).
• Object to processing based on legitimate interests, including any direct marketing (Article 21). See section 4.1 for what we rely on that basis for.
• Withdraw consent at any time, where consent is the basis (Article 7(3)). Withdrawing does not make what we did beforehand unlawful. For cookies, use the Cookie settings link in the footer.

13. Complaining to the ICO

If you think we have mishandled your personal data, please tell us first, we would rather fix it. But you do not have to come to us first, and you can complain to the supervisory authority at any time.

14. Children

SocialPostxr is not for children under 16, and we do not knowingly collect their personal data. If we find that we have, we delete it. If you believe a child has given us their data, tell us at privacy@socialpostxr.com and we will remove it.

15. Changes to this notice

We update this notice when what we do with personal data changes. The version and date at the top of the page tell you which one you are reading. If a change is significant, a new category of data, a new recipient, a new purpose, we will tell you directly by email before it takes effect, and where the change relies on your consent we will ask you for it.

We will not treat your continued use of the site as agreement to anything. If we need your consent, we will ask for it and you can say no.

16. Contact us

• Controller: ACEMAN SOFTWARE SOLUTIONS LTD
• Company number: 12928098
• ICO registration: ZC211493
• Registered office: 8 Holtdale Grove, Leeds, England, LS16 7RZ
• Email: privacy@socialpostxr.com

We aim to respond to privacy enquiries within five working days, and always within one month.

17. The SocialPostxr Academy (our free tools and calendar)

What we hold.

• Your email address.
• What you type into a tool: your business name, your trade, your town or postcode, and the note you write about your day. If you set them, your brand colours and fonts, and how you like your posts to sound.
• If you add a photo: we remove its hidden details (such as where it was taken), send it to be read so your post can describe it, and do not keep it. We keep only what the tool wrote about it.
• What the tool makes for you, so you can come back to it.
• What you write to us through Ask.
• The sign-in codes and links we email you, kept only as a scrambled copy we cannot read back. With them, the internet address and browser your request came from, so we can stop one person using many email addresses to get more free goes.
• If you take a free go before you give us an email: the internet address your request came from, and a scrambled form of it, so one person cannot take the free go over and over.
• If you lose a free go to an accidental page reload before giving us an email, we can reconnect that work to your profile when you do give an email, matched for a short time by the same internet address. We only ever reconnect a result that has not already been saved to anyone else, and only within that short window, so your work is not lost, but it cannot be used to reach into someone else's.
• A record of what happens in the Academy, with the time each thing happened: when a tool runs, a code is typed, an order is paid, you come back, or you go on to try the app. We also record how far you get before you give us an email, which is that you arrived, that you started, that you gave your trade and your area, that you asked a tool for something, that your result appeared, that we asked for your email and that you typed one in. A line made once we know your address carries a scrambled form of that address, so we can count people rather than clicks. A line made before that carries no address at all. It carries a scrambled form of the internet address your request came from instead, so we can see which steps belong to one visit.
• If you tick the box for occasional emails: the words you agreed to, and when.
• If you buy something: what you bought, the price, when, Stripe's reference for the payment and, where there was one, the sentence you ticked before paying. For something we post to you, also your name and delivery address.

We never see or hold your card details. Payment is taken by Stripe, either on Stripe's own page or, when you pay inside the chat, in a box that Stripe runs inside ours. Either way what you type goes straight to Stripe. If you pay with Apple Pay or Google Pay, your device sends the payment to Apple or to Google, and the card never reaches us there either.

Why we hold it, and the legal basis for each.

• To give you what you asked a tool for, email you the code and the result, and keep your work for you. Lawful basis: performance of a contract, Article 6(1)(b), under our terms.
• To stop abuse of tools that are free and open to anyone, using the internet address, the browser, and short records that slow down repeated requests. Lawful basis: legitimate interests, Article 6(1)(f): keeping the tools free for everyone.
• To reconnect a free go you lost to a page reload, matched for a short time by the same internet address, so your work reaches your profile when you give an email. Lawful basis: legitimate interests, Article 6(1)(f): not losing the work you came to make.
• To read and answer what you send through Ask, and to decide what to build next. Lawful basis: legitimate interests, Article 6(1)(f).
• To count how the Academy is used, so we know which tools help and can keep them working. Lawful basis: legitimate interests, Article 6(1)(f).
• To take payment for what you buy and give it to you. Lawful basis: performance of a contract, Article 6(1)(b). To keep order records for tax and accounting. Lawful basis: legal obligation, Article 6(1)(c).
• To email you occasional ideas, only if you tick the box asking for them. You can stop them at any time. Lawful basis: your consent, Article 6(1)(a). We keep the words you agreed to, and when, so we can show you agreed. Lawful basis: legal obligation, Article 6(1)(c).

The code and result emails are not marketing. We send them because you asked for them.

Who else sees it. The companies that help us run SocialPostxr: our email providers; OpenAI, which runs the model that writes your words and reads your photo; Stripe for payments; and our hosting and error-reporting providers. They act on our instructions, and they are listed in full on our sub-processors page. If you pay with Apple Pay or Google Pay, Apple or Google handles that payment for itself, under its own privacy terms, not on our instructions. What you send through Ask is also emailed to our team, so someone can answer you.

How long we keep it.

• If you never type the code we email you: your details, anything made and anything you sent through Ask are deleted 30 days after your last visit.
• Once you have typed it: your profile and your work, including what you sent through Ask and your choice about occasional emails, are kept for 24 months after your last visit, then deleted.
• The sign-in codes and links, with the internet address and browser kept with them: deleted with your details at the latest.
• The short records that slow down repeated requests, which hold your internet address, a random number for your visit or a scrambled form of your email address: deleted within two days.
• The record of a free go taken before you give us an email: the internet address it came from is removed after 3 days, and the scrambled form of that address after 30 days, when the whole record goes.
• The copy of an Ask message emailed to our team: kept like any support email, under our mailbox retention settings.
• The record of what happens in the Academy: each line is deleted 24 months after the day it was made. If you ask us to delete your data, every line carrying your email address goes straight away. The lines made before you gave us an email carry no address, so we cannot tell which of them were yours; those run their 24 months, and the scrambled internet address on them is removed after 30 days.
• Orders: kept for 6 years for tax and accounting, then deleted. A delivery address is removed when you ask us to erase you, unless the order has not been posted yet, in which case it goes as soon as it ships.

Your rights. You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete it. Email privacy@socialpostxr.com. The rest of this notice, your rights, how to complain to the ICO, and how we protect your information, applies to the Academy in the same way.