Service Provider: Studio Kreacja Przemysław Bazanowski, ul. Artura Grottgera 15/11, 63-100 Śrem, Poland, NIP (tax ID) 7851746559, e-mail: office@socialu.ai, website: https://socialu.ai
1. Controller and contact
The controller of data related to running Accounts, payments, handling enquiries, security and its own marketing is Studio Kreacja Przemysław Bazanowski, ul. Artura Grottgera 15/11, 63-100 Śrem, Poland, NIP 7851746559, e-mail: office@socialu.ai, website: https://socialu.ai.
With regard to data entered by Customers into the CRM, recordings, contact lists and campaigns, Socialu usually acts as a processor on behalf of the Customer, under the DPA ("Data Processing Agreement").
2. Categories of data
Identification and contact data, Account and Brand data, transaction, invoicing and technical data and logs, service usage data, communication with support. On the Customer's instruction: lead and audience data, audio and video recordings, transcriptions, campaign data and content.
Recordings or other materials may contain special categories of data; the Customer must have an appropriate legal basis for processing them.
3. Purposes and legal bases
Performance of the Agreement (Art. 6(1)(b) GDPR), legal and tax obligations (point (c)), security, defence of claims and organisational communication (point (f)), and, where appropriate, consent (point (a)).
To the extent Socialu acts as a processor, the purposes and legal bases are determined by the Customer as the controller.
4. Recipients and transfers
Data may be entrusted to the hosting provider OVH (infrastructure in the United Kingdom), the AI providers OpenAI and Anthropic (processing in the USA), the e-mail providers Amazon SES and OVH, and other providers necessary to deliver the features. Stripe and Przelewy24 may act as separate controllers of payment data, depending on the activity.
Transfers to the United Kingdom are based on the applicable European Commission adequacy decision. Transfers to the USA take place using an appropriate mechanism under Chapter V GDPR (relevant DPF certification or SCCs).
5. Retention periods
We keep the data of an active Account for the term of the Agreement and the period necessary to settle it. After deletion of the Account, data in production systems is deleted without undue delay, within 14 days at most; backups are deleted in a cycle of up to 30 days.
Exceptions include, among others, accounting documents required by law and data necessary to establish or defend claims.
6. Rights of data subjects
Data subjects have — within the limits of the GDPR — the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent, as well as the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
If the request concerns data processed by Socialu on behalf of a Customer, it may be necessary to direct it to the relevant Customer acting as controller.
7. Profiling and AI
The Platform uses AI models to generate, classify and analyse materials in accordance with the Customer's instructions. This should not automatically be equated with decision-making producing legal effects within the meaning of Art. 22 GDPR.
8. Public website and cookies
The public website socialu.ai may use Google Analytics, Meta Pixel and Google Ads measurement tools. Those of these technologies that require consent are not launched before it is given.
The list of cookies and similar technologies, their providers and duration is set out in the Cookie Policy.
9. Platform integrations
Google user data (YouTube, Google Business Profile, Google Meet and Calendar, Google Sign-In)
Socialu's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
In particular: we use Google data only for the features you see in the app (publishing, analytics, comments, reviews, Google Meet links and Calendar events for meetings); we do not transfer it to anyone except providers needed to run the service; we do not use it for advertising or to train general AI models; and our staff cannot read it without your permission (except for security purposes and legal obligations).
Google Meet and Calendar: we request only minimal scopes — meetings.space.created (creating new Meet meetings), calendar.events (adding, changing and deleting events for meetings you create in Socialu) plus openid and email (the connected account address). When you send a Google invitation to a guest, the event contains only the title and the Meet link — internal notes (e.g. form answers) stay in Socialu. You can disconnect in the app (Settings → My account → Google Meet & Calendar → Disconnect) — we then revoke access in Google and delete the tokens — or at https://myaccount.google.com/permissions.
YouTube
Socialu uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy.
From YouTube we receive: channel ID and name, the list and statistics of your videos, and comments (if you use the inbox). We send: the videos, titles, descriptions and privacy settings you approve. You can revoke access in the app (Settings → Social media channels → Disconnect) or on the Google security settings page: https://security.google.com/settings/security/permissions. We delete data received from YouTube / Google within 7 days of disconnecting the channel or of a request.
Meta (Facebook, Instagram, Threads)
After you connect an account we receive data of the pages and accounts you select (name, ID, picture, posts, statistics, comments, messages and leads — only when those features are on). You can remove access in the app or in Facebook settings: Settings & privacy → Settings → Apps and websites (https://www.facebook.com/settings?tab=applications). When you remove the app on Facebook, Meta notifies us automatically and we delete the data received from your account — see "Data Retention, Export and Deletion Policy".
Other platforms
LinkedIn, TikTok, Pinterest, X, Bluesky, Snapchat and Google Business Profile — we receive and send data only within the permissions you approve when connecting, and only to publish, show statistics and handle comments. You can disconnect in the app or in the platform's settings.