Last updated:
This privacy policy (“Policy”) explains how Kodetra Technologies Pvt. Ltd. (“Kodetra”, “we”, “our”, or “us”) collects, uses, and discloses your information when you use our website, socialpatra.com, and the SocialPatra apps. This Policy also applies to all interactions through our support platform and any tools or services provided on the Site (the "Service").
We prioritize your privacy rights and aim to be transparent about our data practices. Kodetra Technologies Pvt. Ltd. is a private limited company registered in Haryana, India, with servers hosted in the United States on Amazon Web Services (AWS). If you have any concerns, please reach out to us at support@socialpatra.com.
We collect the following information when you register and use our services:
When you use the Service we automatically collect:
Apart from the analytics described below, we use only the cookies and browser storage the Service needs to work. We do not run advertising trackers. When you first visit, a cookie banner asks you to accept or reject analytics cookies and session recording; both choices are equal and the Service works the same either way. The full list of cookies and storage keys, with purpose and duration, is on our Cookie Policy.
To change your choice at any time, use Cookie settings in the footer of our public pages. The banner appears again and your new choice replaces the old one. Rejecting stops new analytics collection and deletes the Google Analytics cookies (_ga and _ga_ followed by an ID) from your browser automatically. If any remain, you can remove them in your browser settings.
To find and fix problems and to improve the product, we use Watchlayer, a product analytics and session replay service built and operated by Kodetra Technologies. The data stays with Kodetra and is not shared with any third-party analytics or advertising provider. Watchlayer records how you use SocialPatra: the pages you visit, what you click, scrolling, and performance and error information, and it can replay a session as a screen recording. Text that the app displays on screen, such as the content of your posts, can appear in a replay.
Separately from Watchlayer, we record product events on our own servers for each account: signup, connecting a social account, scheduling a post, publishing, and checkout and subscription outcomes. Each event holds the platform, the plan and a coded reason, and never your email address, post text, IP address or any token. This is not based on consent, so the cookie banner does not control it; our legal basis is legitimate interests, Art. 6(1)(f), in finding and fixing where people get stuck. These events are kept for 90 days and then deleted, are deleted earlier if your account is purged, and are included in your data export.
Fonts and icons are served from our own servers, so no third party receives your IP address or browser details just because a page loads.
We count visits to our public pages ourselves, without cookies or browser storage, to learn how many people visit and which pages they read. When you open a public page, your browser tells our server which page it is and, on the first page you open, which website linked to it.
SocialPatra lets you connect your own social media accounts and pages — including Facebook, Instagram, LinkedIn, Twitter / X, Threads, Bluesky, Mastodon, Reddit, Tumblr, Medium, Dev.to, Hashnode, WordPress, YouTube, Pinterest, Discord, Slack, Telegram, and other supported networks — through each platform's official authorization (OAuth) flow. When you connect an account, we receive and store, on your behalf:
We use this data only to provide the Service to you: publishing and scheduling the content you create, and displaying analytics about your own accounts and posts back to you. Data obtained from a connected platform is never sold, never used for advertising or sales purposes, and never shared with other customers — each customer's data is isolated to their own workspace. We access, use, store, and delete platform data in accordance with each platform's developer terms, including the LinkedIn Marketing API Terms.
TikTok. When you connect TikTok, we ask TikTok for access to your basic profile (display name, username, and avatar) so we can show which account is connected, and for permission to publish videos and photos to your account. We publish only content you have created and chosen to post in SocialPatra, with the privacy and disclosure settings you select, and only after you click Post. We then check the publish status with TikTok so we can tell you when your post is processing, published, or failed; TikTok can take a few minutes to show a new post on your profile. If you use analytics, we also read follower, like, and video counts and the performance of your posted videos to display back to you. We use TikTok data only for these purposes. We keep your TikTok access tokens and account details until you disconnect the account, and your post and analytics records as described under Data Retention below. You can revoke SocialPatra's access at any time, either by disconnecting TikTok in SocialPatra, or in the TikTok app under Settings and privacy, in the section that lists apps and permissions connected to your account. After you revoke access we can no longer post to or read from your TikTok account.
You can disconnect a social account at any time from within the Service, which deletes the stored access credentials for that account and, where the platform supports it, asks the platform to revoke them. You can also remove SocialPatra from the platform's connected-apps settings at any time. Data obtained from a connected platform is retained only for as long as needed to provide the Service (see Data Retention below); you may delete your entire account yourself, or ask us to delete the data of a connected account, by contacting support@socialpatra.com, and we will also delete platform data where the platform itself requires us to do so.
If you use SocialPatra to manage accounts for your own clients (for example as an agency), you decide what is posted and stored for those clients and we act as your processor for that data; see our Data Processing Addendum. When a client owns the workspace and links an agency, the client remains the controller of that workspace's data and the agency acts on the client's instructions.
SocialPatra uses YouTube API Services. By connecting a YouTube channel you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. From YouTube we store your channel ID, channel title and avatar, and the access credentials needed to publish for you, until you disconnect the channel or delete your account. We use this data only to provide the features you ask for, and we do not sell it or use it for advertising. You can revoke SocialPatra's access to your Google account at any time on the Google account permissions page.
When you use AI writing, image or video generation, we send what is needed for that request to the AI provider your workspace uses: your prompt, the context you or your workspace settings add to it (such as brand voice), and any reference image you choose. The generated output comes back and is stored in your workspace. Depending on how your workspace is set up, the provider may be OpenAI, Anthropic, Google (Gemini, Imagen, Veo), Groq, OpenRouter, Stability AI, Luma, Runway or Novita. If you add your own provider API key, requests use that key and the provider's own terms also apply; we keep such keys encrypted (AES-256-GCM).
Text that comes from outside your account, such as items from an RSS feed or a web page you ask us to read, is first checked for prompt-injection attacks by a screening service (Jev by TypeSafe AI). Only that external text is sent to it, not your account details. Please do not put information into prompts that you are not allowed to share with these providers.
Our Service is not directed to anyone under 18. By creating an account you confirm you are 18 or older (or the age of majority where you live). We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at support@socialpatra.com. If we become aware that we have inadvertently collected personal information from a child under 18, we will delete such information promptly.
We do not sell or rent your personal data to third parties. Your information may be shared with:
We keep your account data while your account is active. Some data is removed automatically:
You can download a copy of your data yourself: open Settings → Security → Download your data and enter your password. We prepare a zip with your profile, workspaces, posts, media details, billing records and settings, and email you when it is ready. The download link works for 7 days and the file is then deleted. Passwords, session tokens and the access credentials of your connected accounts are never included. You can request one export every 24 hours. If you cannot sign in, email support@socialpatra.com from your account's address and we will help.
You can delete your SocialPatra account yourself at any time:
Deleting your account immediately and permanently removes your profile, every workspace you own and its posts, media, analytics and connected social accounts, removes you from workspaces you were invited to, cancels your subscription (billing stops at once, without a refund of the current period) and signs you out everywhere. We email you a confirmation. Files are removed from storage on a best-effort basis straight afterwards. Invoices we are legally required to keep for tax purposes are retained for the period the law requires. If you can't sign in, email support@socialpatra.com from your account's address and we will delete it for you.
We use reasonable security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. These include encryption in transit (TLS), one-way hashing of passwords, encryption at rest of the access tokens of your connected accounts and of AI provider keys, short-lived sign-in cookies that are not readable by scripts, request rate limiting, and separating each workspace's data from every other workspace's. No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your personal data we will tell you without undue delay.
While Kodetra Technologies is based in India, our servers and file storage are located in the United States, and some of our service providers (listed on the subprocessor list) process data in other countries. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the transfer relies on the European Union Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), together with the UK International Data Transfer Addendum and the Swiss Federal Data Protection and Information Commissioner (FDPIC) amendments where they apply. Where we use a service provider, the same clauses or an adequacy decision must cover the onward transfer. For the clauses that apply to the data you handle in SocialPatra, see section 6 of our Data Processing Addendum. You can ask us for a copy of the clauses at support@socialpatra.com.
Where the GDPR or UK GDPR applies to you, this table gives each purpose we use your personal data for, the data involved, and the lawful basis under Article 6. The same data is not used for a purpose that is not in the table.
| Purpose | Data | Lawful basis |
|---|---|---|
| Your account and signing in | Name, email address, profile photo, password hash, sign-in session details (browser or app identifier, last use, first part of the IP address) | Contract, Art. 6(1)(b): we cannot give you an account without it. |
| Writing, scheduling and publishing posts to your connected accounts | Content you create, media files, access tokens and account or page details of the networks you connect, engagement data about your posts | Contract, Art. 6(1)(b): this is the service you asked for. |
| Social inbox | Comments and messages other people send to your connected accounts, their public names, your replies | Contract, Art. 6(1)(b), to provide the inbox you turned on. For the other people's data you decide the purpose and are the controller; see the Data Processing Addendum. |
| AI generation | Your prompt, the context your workspace adds (such as brand voice), any reference image you choose, and your own provider API key if you add one | Contract, Art. 6(1)(b): generated on your request. |
| Screening outside text for prompt-injection attacks | Only text that comes from outside your account, such as RSS items or a web page you ask us to read; no account details | Legitimate interests, Art. 6(1)(f): our and your interest in keeping your account and the AI features safe from hostile text. Nothing else is sent. |
| Billing, tax invoices and refunds | Billing name, address, country and GST number (if you give one), subscription, charge, invoice, credit note and refund records, a reference to your saved payment method | Contract, Art. 6(1)(b), to charge and run your subscription. Legal obligation, Art. 6(1)(c), to issue and keep tax invoices and credit notes for the period tax law requires. |
| Service emails | Your email address and the details in the message (account verification, invoices, payment and security notices, failed-post alerts) | Contract, Art. 6(1)(b). Optional account emails (weekly summary, follower milestones) rely on legitimate interests, Art. 6(1)(f), in keeping you informed of your account; each has a switch in Settings and a one-click unsubscribe. |
| Security, abuse prevention and error logs | IP addresses and browser identifiers in server logs, API request records (kept 90 days) and activity records of account and workspace actions | Legitimate interests, Art. 6(1)(f): securing accounts, preventing fraud and abuse, and finding and fixing faults. We keep to what those need. |
| Product events recorded on our servers | Per account: that a signup, connection, scheduling, publish, checkout or subscription step happened, with the platform, plan and a coded reason (kept 90 days) | Legitimate interests, Art. 6(1)(f): finding where people get stuck and fixing it. Not consent-based, so Cookie settings do not switch it off. |
| Counting visits to our public pages | A one-way hash of your IP address and browser details with a daily random value, added to a daily counter | Legitimate interests, Art. 6(1)(f): knowing how many people visit and which pages they read. No cookies, no link between days, and it does not run when Global Privacy Control or Do Not Track is on. |
| Analytics cookies and session recording | Google Analytics 4 cookies (your IP address and browser details go to Google); Watchlayer pages visited, clicks, scrolling and performance data, and replays with form fields masked | Consent, Art. 6(1)(a). Where the law requires opt-in nothing is set until you accept. You can withdraw at any time with Cookie settings in the footer; withdrawing does not affect what was done before. |
| Push notifications in the mobile app | A device token, delivered through Google Firebase Cloud Messaging | Consent, Art. 6(1)(a): you allow notifications on your device and can withdraw in your device settings. |
| Support requests | What you write to us, any file you attach, and your email address | Contract, Art. 6(1)(b), for customers. Legitimate interests, Art. 6(1)(f), to answer people who write to us without an account. |
| Legal claims and legal requests | What the request or claim concerns | Legal obligation, Art. 6(1)(c), where a law requires disclosure; otherwise legitimate interests, Art. 6(1)(f), in establishing, exercising or defending legal claims. |
Where we rely on legitimate interests you can object to that processing, and where we rely on consent you can withdraw it at any time; see Your Rights below. Whether you must give us data: the data for your account, billing and the service itself is needed to provide it; the analytics and push choices are optional and the Service works the same without them.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, please contact us at support@socialpatra.com. We may need to confirm that the request comes from the email address of the account.
We may update this policy from time to time. You can always review the most current version at https://www.socialpatra.com/privacy-policy. If we make significant changes, we will update the date at the top of this page.
For any questions or concerns about this privacy policy, please contact us at:
Use of our services is subject to our Terms of Service and Refund and Cancellation Policy. If you process your clients' data through SocialPatra, our Data Processing Addendum applies. The cookies and storage we use are listed in our Cookie Policy.