Legal

Privacy Policy

Version 1.2 · Effective 5 October 2026
Socio Pulse ("we", "us", "our") is operated from Australia. ABN 30 702 476 088. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy covers

Socio Pulse is used by marketing agencies to manage social media content for their clients. That creates two different relationships, and your rights differ depending on which one you are in.

If you are…	Then…
An agency using Socio Pulse	We are the data controller for your account information and how you use the service. This policy governs that relationship directly.
A client of an agency who has been invited to review and approve content	The agency decides what content is created and which of your accounts are connected. We hold and process that information on their behalf. You may contact us directly about it, and we will act - but we will usually also tell the agency, because it is their workspace.
A member of the public who contacts us	We hold only what you send us through the contact form or by email, for as long as section 8 says.

This policy does not cover what a social media platform does with your data. When you connect a Facebook Page, Instagram account, LinkedIn Page or TikTok account, that platform's own privacy policy continues to apply to your relationship with them.

2. What we collect

2.1 Information you give us

Category	Examples	Why
Account details	Name, email address, password (stored only as an Argon2id hash, never as text), timezone, profile photo if you upload one	To create your account, sign you in and address you correctly
Organisation details	Agency name, client business names, timezones, the roles you assign to people	To separate one agency's workspace from another and decide who may do what
Content	Captions, hashtags, links, scheduled times, comments on posts, internal notes, approval decisions and the reasons given	It is the work product - the reason the service exists
Media	Images, video and documents you upload for publishing	To attach to posts and deliver them to the platform you publish to
Billing details	Business name, billing email, plan, payment records. Card numbers are handled entirely by Stripe and never reach our servers.	To charge for the service and issue invoices
Correspondence	What you send through the contact form or by email	To answer you

2.2 Information we collect automatically

• Sign-in and security records - the time of each sign-in, the IP address it came from, and failed attempts. We keep these to detect and stop account takeover; it is not analytics.
• Activity records - an audit trail of significant actions: who created, approved, scheduled, published or deleted something, and when. This is the record that lets an agency prove what a client approved, and it is central to the product.
• Technical logs - errors and system events, needed to keep the service working. Access tokens, passwords and payment details are stripped from logs before they are written, not after.

We do not use third-party analytics, advertising networks, tracking pixels or session-recording tools. There is no Google Analytics, no Facebook Pixel and no advertising cookie on this site or in the application.

3. Information from social media platforms

This section describes exactly what we receive when you connect a social media account, because it is the most sensitive information we hold.

3.1 How a connection is made

You connect an account through the platform's own sign-in screen - Facebook Login, LinkedIn, or TikTok. We never ask for, receive or store your social media password. You choose which Pages or accounts to grant access to, and you can withdraw that access at any time from within Socio Pulse or from the platform's own settings.

3.2 What we receive and store

Data	Why we need it
An access token (and, where the platform issues one, a refresh token)	It is the credential that lets us publish the posts you have approved. It is encrypted with AES-256-GCM before it is stored and is cryptographically bound to the specific account it belongs to, so a copied record cannot be used against a different account. No screen in Socio Pulse displays a token, and no role can retrieve one - including our own administrators.
The account's identifier, name, username and profile picture	So you can tell which of several connected accounts you are posting to
The account type, and what the platform says you are permitted to do with it	To refuse a connection that cannot actually publish - for example a personal Instagram profile, or a Page where your role does not include creating content - at the moment you connect, rather than when a campaign fails
The identifier and permalink of a post we published	To show you that it went live, link you to it, and report failures accurately

3.3 What we do not do

• We do not read your private messages, inbox or direct messages.
• We do not download, store or process your followers' or audience members' personal information.
• We do not read content you did not create in Socio Pulse.
• We do not sell, rent, licence or share platform data with anyone for their own purposes.
• We do not use platform data to build advertising profiles or to train machine learning models.
• We do not scrape, automate a browser against, or otherwise access a platform except through its official, documented API.

We request the narrowest set of permissions that will let us publish what you have approved. Where a platform offers a broader permission that would make development easier but grant access we do not need, we do not request it.

4. How we use information

We use the information described above only to:

• provide the service - create, approve, schedule and publish your content;
• authenticate you and keep accounts secure;
• maintain the audit trail that lets an agency evidence a client's approval;
• notify you about things you asked to be notified about - a post awaiting your approval, a publishing failure, an account that needs reconnecting;
• bill you, and handle payment disputes;
• respond when you contact us;
• detect, investigate and prevent abuse, fraud and security incidents; and
• meet our legal obligations.

We will not use your information for a materially different purpose without telling you first and, where the law requires it, obtaining your consent.

5. Who we share it with

We do not sell personal information. We share it only with the service providers below, each of which processes it on our instructions for the stated purpose.

Provider	Purpose	What they receive	Where
OVH	Application server and database hosting	All application data	Sydney, Australia
Cloudflare (R2)	Storage of uploaded media	Images, video and documents you upload	Cloudflare's global network - see section 6
Resend	Sending transactional email	Recipient name, email address, and the contents of the notification	United States
Stripe	Card payment processing	Billing name, email, and payment details you enter directly with them	United States, Ireland and Australia
Meta, LinkedIn, TikTok	Publishing the content you approved	Only the post you chose to publish, to the account you chose	Per that platform's own policy

We may also disclose information where we are required to by law, where it is necessary to investigate a serious security incident, or to a purchaser in connection with a sale of the business - in which case this policy continues to apply until you are notified otherwise.

Requests from courts, regulators and law enforcement

Governments and law enforcement agencies can compel disclosure of information, and we will comply with a valid, binding request. What we will not do is hand over everything we hold because an agency asked. Every request is handled under a written procedure, and in each case we:

• Check that it is lawful. We confirm the request is properly served, comes from an authority with power to make it, and identifies a legal basis. We do not act on an informal request for customer information.
• Push back where it is not. We object to, narrow, or seek review of a request that is unlawful, overly broad, or vague, including through our lawyers where that is warranted.
• Disclose only the minimum. We give only the specific information the request actually compels, for the people and period it names, and nothing more. Where we can comply with less, we do.
• Write it down. We record every request, what we disclosed, the reasoning, and who approved it, and keep that record.
• Tell you where we can. If a request concerns your workspace, we will notify you so you can seek your own advice, unless we are legally prohibited from doing so or there is a genuine risk to someone's safety.

Content you publish through Socio Pulse also sits on the social media platform you published it to, and those platforms answer such requests under their own policies, which we do not control.

6. Overseas disclosure (APP 8)

Your Socio Pulse account data and database records are held on a server in Sydney, Australia.

7. How we protect it

• In transit - everything travels over HTTPS with HSTS enforced.
• Passwords - hashed with Argon2id. We cannot read your password, and neither can anyone who obtains the database.
• Platform tokens - encrypted with AES-256-GCM and bound to the account they belong to. They are never rendered in any screen, log, export or support tool.
• Separation - every database query is restricted to a single agency's workspace. This is enforced in code and verified by an automated test suite that specifically attempts cross-agency access.
• Least privilege - a designer assigned to three clients can reach those three clients and no others. A client can see their own business only.
• Audit trail - significant actions are recorded with who did them and when.
• Secrets - access tokens, passwords and payment details are removed from logs and error reports before they are written to disk.

No system is perfectly secure, and we do not claim otherwise. We do commit to the measures above, and to telling you promptly if something goes wrong - see section 13.

8. How long we keep it

Information	Kept for
Your account and content	While your account is active
Everything, after you close your account	Deleted within 30 days, except where a law requires us to keep it
Media you delete	Recoverable from the recycle bin for 7 days, then permanently deleted
Social media access tokens	Until you disconnect the account, it expires, or you delete your account. Disconnecting destroys the token immediately.
Audit and approval records	7 years. These are the agency's business record of work performed and approvals obtained, and Australian record-keeping obligations apply to them.
Billing and tax records	7 years, as required by Australian tax law
Security and sign-in logs	12 months
Contact form messages	24 months

9. Your rights

Under the Privacy Act you may:

• Ask what we hold about you and get a copy. Most of it is visible in the application; for anything else, ask and we will provide it within 30 days.
• Correct it if it is wrong. You can edit your own profile directly, or ask us.
• Ask us to delete it - see section 10.
• Withdraw a social media connection at any time, without deleting your Socio Pulse account.
• Opt out of non-essential email. We will still send you service-critical messages such as a security alert or a failed payment notice, because you need those.
• Complain - see section 15.

We do not charge for an access request. If a request is complex enough to involve real cost we will tell you before doing the work, and you can withdraw it.

10. Deleting your data

Full instructions, including how to trigger deletion from the social platform's own settings, are on our data deletion page. In summary:

• Disconnect one social account - do it in Socio Pulse under Social Accounts. The stored token is destroyed immediately and we revoke it with the platform. Your record of previously published posts stays, because it is the agency's business record.
• Remove the app from the platform - for example in Facebook's Settings → Apps and Websites. Meta notifies us automatically, and we destroy the stored tokens and disconnect the affected accounts.
• Delete your own account - in Settings, choose "Delete your account". Your name and email are removed immediately and you lose access to every workspace. Posts you wrote and approvals you gave stay in the agency's records as "Deleted user" (see section 8).
• Close a whole workspace - the owner, in Settings, chooses "Close this workspace". Publishing stops and every social account is disconnected immediately; the content is deleted within 30 days.
• Or ask us - email privacy@sociopulse.com.au from the address on the account, or use the contact form choosing "Delete my data". We confirm within 5 business days and complete within 30 days.

11. Cookies

We use one essential cookie to keep you signed in, and a security token to protect forms. There are no advertising or tracking cookies. The full detail is in our Cookie Policy.

12. Children

Socio Pulse is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.

13. Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. We will tell you what happened, what information was involved, and what you should do - in plain language, promptly, and without waiting until we have every detail.

14. Changes to this policy

We will post any change here with a new version number and effective date. If a change materially affects your rights, we will email account holders at least 30 days before it takes effect.

15. Contact and complaints

For any privacy question or request, contact our Privacy Officer:

• Email: privacy@sociopulse.com.au
• Or use the contact form and choose "Privacy request"

We aim to acknowledge within 5 business days and resolve within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.