Privacy Policy

Who we are

SosoAPI is built and operated by VickyAI Limited, based in Hong Kong. We make tools that help individuals and small teams manage social accounts, media, and scheduled publishing. If you have any questions about how we handle your data, you can reach us at the contact address at the bottom of this page. We aim to respond within two business days.

What we collect

We collect only what we need to run the service. Here is a breakdown of each category and why it exists:

• Account information: your email address, display name, and profile avatar. These come from Google when you sign in with Google — we never see your Google password.
• Project Profile: the Project name and profile information, such as voice and target audience, that you provide through supported Project tools or APIs. This is stored as Workspace-scoped Project data.
• Connected social accounts: OAuth access and refresh tokens, account or channel identifiers, handles, profile images, and public account statistics for any platform you connect (Instagram, Threads, Facebook Pages, YouTube, or X). For YouTube this can include channel title, channel ID, subscriber count, view count, video count, approved upload metadata and status, and the YouTube Analytics reports described below. Tokens are stored server-side and never exposed to your browser after the initial OAuth handshake. Database access controls restrict their use to authorized requests for your workspace.
• Workspace posts and media: post text, schedules, publication status, uploaded media stored in Cloudflare R2, and related metadata that you submit through supported Workspace and publishing features. We store these to provide asset management and scheduled publishing.
• Subscription and billing records: if you start a paid plan, Stripe processes your payment details and provides us with identifiers and status needed to operate the subscription, such as the Stripe customer and subscription references, payment state, billing period, and invoice status. Stripe may collect your name, email, billing address, and payment details on its hosted pages under its own privacy policy.

What we don't collect

VickyAI Limited does not receive or store your full payment-card number; Stripe collects and processes card details on its hosted pages. We do not collect precise device location. We do not fingerprint your device or browser. We use PostHog for optional product analytics and masked session replay when you allow them. We do not run advertising pixels, retargeting or cross-site tracking. If you are wondering whether we sell your data to advertisers — we do not, and we have no plans to.

Optional analytics and session replay

You can decline, allow analytics only, or also allow session replay through Privacy preferences in the app. Refusing or withdrawing consent does not restrict product access. Analytics uses opaque user and workspace identifiers, product actions, outcomes and allowlisted diagnostic information. Your choice also applies to optional person-linked backend analytics. Necessary operational and billing records are separate.

Replay masks inputs and private content and excludes media previews, credentials, raw request and response bodies, and console contents. PostHog processes this optional data in the United States. Withdrawing consent stops new collection; it does not by itself delete previously collected data. Contact us to request access or deletion.

Security verification

We use Cloudflare Turnstile to protect forms from automated abuse, including verification that runs in the background. Cloudflare processes security signals to provide this service under its Cloudflare Turnstile Privacy Addendum.

How we use it

We use the data you provide for these purposes:

1. Providing Workspace features. We store and process Project Profiles, posts, media, and related Workspace data to provide the supported Project, Asset, and Scheduled Posts features.
2. Publishing to social platforms. When you ask SosoAPI to post something, your stored OAuth token is used to call the relevant platform API (Instagram, Threads, Facebook Pages, YouTube, or X) on your behalf. For YouTube, this includes the video file, title, description, category, altered-content disclosure, and privacy setting you review. Only the content you approved is sent, and editing a draft does not itself upload it.
3. Providing authorized API access. If you authorize a delegated agent client, it receives responses only for SosoAPI API operations allowed by the capabilities you grant and the request's authorized Workspace scope.
4. Debugging and reliability. We use operational logs to trace errors and fix bugs. We do not use logs for profiling or advertising.
5. Understanding adoption. For each account we record on which days it used SosoAPI, from which kind of client (the web app, the CLI, or the name and version an AI agent such as Claude Code reports) and how many requests it made. We use these records only as aggregate counts; the only usage data sent to our analytics provider is anonymous daily totals that name no account.
6. Billing. We use Stripe-hosted Checkout and Customer Portal to create and manage subscriptions, accept payments, provide invoices, and handle payment status. We use the resulting subscription state to decide which plan and quota apply to your account.

X account data

When you connect X, we store your account ID, username, display name, OAuth access and refresh tokens, granted permissions, and token expiry. We use these to publish only original text Posts and links you approve, verify the exact published Post, and delete a published Post when you explicitly request deletion. We do not request direct-message access. Disconnecting stops new publishing through that connection. You can revoke the app in X Settings → Security and account access → Apps and sessions → Connected apps. SosoAPI data-deletion requests also cover the stored X credentials and account data.

Google and YouTube user data

When you connect YouTube, SosoAPI requests only the Google OAuth permissions needed for the YouTube features you choose to use:

• View your YouTube account: used to identify the channel you connected and show its channel details and statistics.
• Manage your YouTube videos: used only to upload a video and its metadata after you explicitly approve a publish action.
• See, edit, and permanently delete your YouTube videos, ratings, comments and captions: used only to unschedule or delete a video that SosoAPI uploaded, when you cancel or delete that post in SosoAPI or when its upload fails partway, and to post a comment or reply on your videos after you approve its exact text. SosoAPI never deletes videos it did not upload and never changes ratings or captions.
• View YouTube Analytics reports: used to show channel and video performance, including views, watch time, average view duration, likes, comments, and subscriber change.

We do not sell Google user data, use it for advertising, transfer it to data brokers, or use it to train general-purpose AI models. We share it only with infrastructure providers acting on our behalf where necessary to operate and secure SosoAPI, or when required by law. Human access is limited to support, security, or legal needs and is subject to access controls.

SosoAPI's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

SosoAPI uses YouTube API Services. By connecting YouTube, you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. Disconnecting YouTube in SosoAPI deletes the stored tokens. To also revoke SosoAPI's access at Google, use your Google Account permissions page.

How we protect sensitive data

We protect Google and YouTube user data, including OAuth credentials, channel information, analytics and uploaded content, with the following technical safeguards:

• Encryption in transit: the SosoAPI website, App and API use HTTPS with TLS. Our backend also uses HTTPS when exchanging credentials and data with Google APIs.
• Encryption at rest: our Supabase-hosted database uses encrypted storage, including for stored Google access and refresh tokens. Cloudflare R2 encrypts stored media. These protections are provided by our hosting infrastructure.
• Access controls: server-side authorization and database row-level security restrict account and Workspace data to permitted users and services. Delegated clients are limited by the capabilities and Workspace access you authorize.
• Credential protection: Google connection tokens are used by backend services for authorized operations and are not returned in ordinary App or delegated client API responses. Service credentials are kept in server-side secret configuration, separate from the public frontend build.
• Analytics and replay controls: optional session replay masks inputs and private content, and excludes credentials and raw request and response bodies. Optional analytics uses allowlisted fields rather than copying Google API payloads.

Access for support, security and legal needs is restricted to authorized personnel. No storage or transmission method can guarantee absolute security. If you suspect an issue involving your data, contact us using the address below.

Sub-processors

A sub-processor is any third party that processes personal data on our behalf. The table below lists the sub-processors used by the SosoAPI App, what they do, and their service region where applicable. If you have a concern about any of them, reach out and we will do our best to answer.

Your rights

You have control over your data. Here is what you can do and how to do it:

• Access: data SosoAPI stores about your Project Profiles, connected accounts, posts, and assets is available through supported in-app and API operations.
• Correction: you can update Project Profile data through supported Project tools or APIs and update account details in-app.
• Export: if you want a machine-readable copy of your data, email us at the address in the Contact section below. We will prepare an export within 30 days.
• Deletion: you can request account deletion through our Data Deletion page. Requests pause account access immediately. Restore within 7 days or confirm permanent removal now. If you do not restore, automatic removal begins after 7 days and cleanup may take longer. Older requests may follow manual review.
• Disconnect YouTube: an Organization Owner or Admin can go to Workspace → Social accounts → Manage Organization accounts and choose Disconnect on the YouTube account. SosoAPI will remove the stored connection credentials. This does not revoke the shared Google authorization used by another Organization. You can separately revoke SosoAPI access from your Google Account's third-party connections page; that may affect every Organization using that Google authorization.

If you are in the European Union or European Economic Area, you also have the right to object to processing, request restriction, and lodge a complaint with your local data protection authority (DPA). We are committed to resolving privacy concerns directly — please contact us first and give us a chance to address your concern before escalating to a DPA.

Retention

We keep your data for as long as your account is active. Specifically:

• Account and profile data — retained until you delete your account.
• Project Profiles, posts, and assets — retained while your account is active and used to provide supported Workspace features.
• Subscription and billing records — retained while needed to provide the paid service and afterwards where required for accounting, dispute, fraud-prevention, or legal obligations. Stripe separately retains data under its own policies.
• Google OAuth tokens — retained only while the YouTube connection is active. Disconnecting YouTube deletes that connection's stored credentials.
• YouTube API-derived analytics and upload results — retained so you can see publishing and performance history while your SosoAPI account is active. They are removed with the associated personal data when your account deletion is completed.
• Deletion requests — New self-service requests pause access immediately and may be restored for 7 days or confirmed for permanent removal now. If not restored, automatic removal begins after 7 days and cleanup may take longer. Older requests may follow the previous manual-review process and may not have a 7-day deadline. See the Data Deletion page for the request process and scope.
• Server logs — retained according to the operational retention settings for the relevant hosting service.
• Daily usage records — kept while your account is active and deleted with it.
• Aggregate counts — after account deletion, some anonymised aggregate statistics (for example, total posts published) may remain in our analytics. These cannot be linked back to you.

Cookies

We use the minimum number of cookies needed to make the app work.

• Authentication storage: the App stores your Supabase session in browser local storage so you can stay signed in between visits. This is necessary for signed-in features and is separate from optional analytics preferences.
• Cloudflare __cf_bm: a bot-management cookie that Cloudflare may set to protect the service from automated abuse. Cloudflare processes security signals for this purpose.

We store your optional analytics preference so that your choice can be respected. The PostHog browser integration uses memory for its tracking state. You can change your choice using Privacy preferences. We do not use advertising or retargeting cookies.

The SosoAPI website and App share a first-party language preference and, after an explicit choice, an optional analytics preference for this browser. The analytics preference expires after 180 days and contains no account identifier or login token. Existing landing-only choices are not broadened automatically. Session replay requires a separate App choice, and a landing choice cannot opt a signed-in account into tracking. Browser privacy signals keep optional browser analytics off.

Children

SosoAPI is intended for users aged 13 and older, in line with the connected platforms' terms. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account or shared personal data with us, please contact us (see the Contact section below) and we will delete the information promptly.

Changes

We may update this policy as SosoAPI grows or as laws change. When we do, we will bump the "Last updated" date at the top of the page. For material changes — ones that meaningfully affect how we use your data — we will also send an email to all active users at least 7 days before the change takes effect. Continuing to use SosoAPI after a change means you accept the updated policy.

Contact

If you have any question, concern, or request about your privacy, please reach out. We are a small team and we read every email.

Email: [email protected]
Postal region: Hong Kong