Shoutly AI — Data Security & Privacy Policy

1. Scope

This Policy applies to:

• The Shoutly AI website (shoutlyai.com) and web application
• Our API and any integrations built on it
• Data obtained through third-party platform APIs when you connect a social media account (Google/YouTube, Meta/Facebook/Instagram/Threads, TikTok, LinkedIn, Pinterest, X, Bluesky, and Google Business Profile) to Shoutly AI

It does not apply to the privacy practices of the third-party platforms themselves (Google, Meta, TikTok, etc.), which are governed by their own privacy policies.

2. Information We Collect

3. How We Use Your Information

We use the information described above to:

1. Provide the core service: generate content, schedule posts, and publish to the social accounts you've connected, on your instruction.
2. Display connected-account identity (name, avatar) so you can confirm which account is linked before publishing.
3. Show analytics and reporting for your own connected accounts inside your Shoutly AI dashboard.
4. Operate, maintain, secure, and improve the platform (debugging, fraud prevention, performance monitoring).
5. Communicate with you about your account, billing, support requests, and material changes to our service or this Policy.
6. Comply with legal obligations.

We do not use data obtained through connected social accounts to serve ads, build advertising profiles, sell to data brokers, determine creditworthiness, or train general-purpose AI models on your connected-platform data without your explicit, separate consent.

4. How We Share Your Information

We do not sell your personal data or the data obtained through connected social platforms. We share data only in the following circumstances:

• Service providers: infrastructure, hosting, and API providers that process data on our behalf under contractual confidentiality and security obligations (for example, our hosting providers and the Outstand unified social API, which we use to route publishing requests to social networks).
• With your direction: when you instruct us to publish content to a connected account.
• Legal requirements: to comply with applicable law, regulation, legal process, or governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice to you and continued protection of your data under an equivalent policy.
• Security and abuse prevention: to investigate and prevent fraud, abuse, or security incidents.

We do not permit humans to read your connected-platform content or data except where necessary for security investigation, legal compliance, or with your affirmative, specific consent.

6. Data Security

We take the following technical and organizational measures to protect your information, including data obtained through connected platform APIs:

• Encryption in transit: all data transmitted between your browser, our servers, and connected platform APIs is encrypted using TLS/HTTPS.
• Encryption at rest: stored credentials (OAuth tokens, API keys) and personal data are encrypted at rest.
• Access controls: access to production systems and user data is restricted to authorized personnel on a need-to-know basis, protected by authentication and role-based permissions.
• Credential isolation: connected-platform OAuth tokens are stored server-side only and are never exposed to the browser or to third parties outside the scope of publishing your content.
• Monitoring & logging: we monitor for unauthorized access attempts and unusual account activity.
• Vendor security: infrastructure providers we rely on maintain independent security certifications (e.g., SOC 2, ISO 27001 as applicable to each provider).
• Incident response: in the event of a data breach affecting your personal information, we will notify affected users and relevant authorities in accordance with applicable law, without undue delay.
• Least-privilege scope requests: we request only the narrowest set of platform permissions required for the specific features described above and do not request scopes for hypothetical future functionality.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we continuously work to protect your information using industry-standard practices.

7. Data Retention & Deletion

• We retain account information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations.
• Connected-platform OAuth tokens and cached platform data are retained only for as long as the connection remains active. If you disconnect an account, we delete the associated access tokens and cached profile/metrics data within 30 days, except where retention is required by law.
• Content you generate but never publish is retained in your account until you delete it or close your account.
• You may request deletion of your account and associated data at any time by contacting us (Section 13) or, where available, using in-app account deletion.
• Upon account deletion, we delete or anonymize your personal data within 30 days, except data we are legally required to retain (e.g., billing records for tax purposes).

8. Your Rights & Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability
• Withdraw consent for a connected platform at any time by disconnecting it in your dashboard or revoking access directly from the platform's own settings (e.g., Google Account permissions, Facebook Business Integrations)

To exercise these rights, contact us using the details in Section 13. Region-specific rights are detailed further below:

9. Children's Privacy

Our platform workspace does not engage with variables or profiles relating to individuals under the age of 18. Suspect profiles are deleted instantly.

10. International Data Transfers

As an India-incorporated company serving customers globally, your data may be processed in India and in the jurisdictions where our infrastructure and service providers operate. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

11. Cookies & Similar Technologies

We employ simple system storage flags to cache local interface settings and stay signed in across active browser loops. Check our Cookie Policy.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you via email or an in-product notice before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.