Privacy Policy
Version 2026-10-22. Last updated October 22, 2026.
Effective date: 22 October 2026
This Privacy Policy explains how Social Muse, Nepal ("Social Muse", "we", "us", "our") collects, uses, shares and protects personal data when you visit socialmuse.online, use the Social Muse web application, mobile applications or APIs (the "Service"), or contact us.
If you have questions, or want to use your privacy rights, contact us at support@socialmuse.online or through Help in the app after you sign in.
1. Who is responsible for your data
- We are the controller for the data we collect to run our business: your account, billing, security, support and website data.
- We are a processor for personal data that our customers bring into the Service, such as comments and messages from their followers and leads, or details of their team. For that data, the customer (the workspace Owner) is the controller, and our Data Processing Agreement applies. If you are a follower or lead of one of our customers and have a question about your data, please contact that customer first; we will help them respond.
2. Data we collect
Account data. Your name, email address, password (stored only as a secure hash by our authentication provider, never in plain text), language, theme and notification preferences, your role in each workspace, and your answers to the onboarding questions (such as business type and goals). If you sign in with Google or Facebook, we receive your name, email address and, where the provider shares it, your profile picture; we never receive your password for that provider.
Workspace and team data. Workspace names and settings, invitations (the invited email address, who invited them and the permissions given), members and their permissions.
Content. Text, images, videos, captions, tags, templates, schedules and approvals you create or upload, and AI-generated suggestions you save.
Connected platform data. When you connect a social media account, we receive and store an access token (encrypted, used only on our servers) and the account's basic profile (such as its name, handle and ID). Depending on the platform and the permissions you grant, we also read your posts' performance (such as likes, views and comments) and comments, messages and mentions so you can manage them as leads.
Lead data. Comments, messages and mentions from people who interact with your connected accounts, with the name or handle they use on that platform, and the AI classification and score we give each one.
Research data. Keywords, competitor websites and other inputs you give our research tools, and the public web pages, reviews and posts our AI tools read to answer them.
Billing data. Your plan, subscription status, invoices and every payment attempt (including failed ones), and the billing name, email and country passed to us by our payment partner. Your card details are collected and stored by Dodo Payments, not by us.
Support data. The messages and details you send us through Help or by email.
Device, security and log data. IP address, browser and device type, sign-in times, sessions and devices signed in to your account, and a record of important actions (such as sign-ins, password changes, invitations, permission changes, billing changes and content changes). We never record passwords, tokens or card details in these logs.
Usage data. How the Service is used (such as pages visited and features used). Analytics in your browser is only collected with your consent (see section 9). Our servers also record key account events (such as signing up, starting a trial or plan, and publishing) under your account ID, without your name, email, content or payment details, to understand how the Service is used and to improve it.
3. How and why we use your data
| Purpose | Data used | Legal basis (where GDPR applies) |
|---|---|---|
| Create and run your account and workspaces, publish and schedule content, manage leads, provide AI and research features | Account, workspace, content, connected platform, lead and research data | Performance of our contract with you |
| Take payments, manage subscriptions and trials, prevent payment fraud | Billing data | Performance of contract; legal obligation |
| Keep the Service and accounts secure, enforce plan and device limits, detect abuse, investigate incidents | Device, security and log data | Legitimate interests (security); legal obligation |
| Send service emails and notifications (such as invitations, password resets, payment and publishing notices) | Account data | Performance of contract |
| Answer support requests | Support and account data | Performance of contract; legitimate interests |
| Understand and improve the Service | Usage data | Consent (browser analytics); legitimate interests (account events recorded by our servers) |
| Comply with law, resolve disputes and enforce our Terms | Any relevant data | Legal obligation; legitimate interests |
We do not sell or rent your personal data, and we do not use it for third-party advertising.
4. AI processing
To provide AI features (such as writing captions, replying to comments, scoring leads and running research), we send only the data needed for the action you request to the AI provider selected for the Service: Google (Gemini), Anthropic (Claude), OpenAI or Perplexity. These providers act as our service providers through their API services. We do not use your content to train our own AI models. AI memory (the brand details the AI remembers for you) is kept separately for each workspace and is never shared with other workspaces. We do not put passwords, tokens or payment details into AI requests or AI memory.
5. Google and YouTube data
If you connect a YouTube account, the Service uses YouTube API Services. By connecting it you agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.
Social Muse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use YouTube data only to provide the features you use in the Service (publishing your videos, showing their performance, and managing comments as leads), and we do not transfer it to others except as needed to provide those features, for security, or as required by law.
You can disconnect YouTube at any time from Connected platforms, and you can revoke our access from your Google security settings. When you disconnect, we stop using the stored access token at once and stop collecting new data from that account. You can ask us to delete the data we hold from that account at any time (section 10).
6. Who we share data with
Service providers (subprocessors) that help us run the Service, under contracts that only allow them to use the data to provide their service to us:
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase | Database and sign-in | India (Mumbai) |
| Railway | Hosting of our servers and background processing | Singapore |
| Upstash | Cache and job queue | Singapore |
| Vercel | Hosting of our website and web app | Global network |
| Cloudflare (R2) | Storage of uploaded images and videos | Global network |
| Dodo Payments | Payment processing and merchant of record | Per Dodo Payments' infrastructure |
| Google (Gemini), Anthropic, OpenAI, Perplexity | AI processing | United States |
| Resend | Sending service emails | United States |
| Google Firebase | Push notifications | Global network |
| Sentry | Error monitoring (personal data collection switched off; sensitive fields removed) | European Union (Germany) |
| Mixpanel, PostHog | Product analytics (browser analytics only with consent; account events under your account ID only) | United States |
Social media platforms you connect. When you publish, we send your content to the platforms you choose, and those platforms handle it under their own privacy policies.
Your workspace. Members of a workspace can see the workspace data their permissions allow. The workspace Owner can see the workspace's activity, including actions taken by members.
Legal and safety. We may disclose data if required by law or a valid legal request, or where needed to protect the rights, safety or security of our users, the public or Social Muse.
Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, under the protections of this policy.
7. International transfers
We operate from Nepal, and our providers process data in the countries listed above. When personal data is transferred out of the EU, UK or another region with transfer rules to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and we require our providers to protect the data to the standard of this policy.
8. How long we keep data
| Data | How long |
|---|---|
| Lead comments, messages and mentions | 90 days, then automatically anonymised (the text and the person's details are removed; only the score and classification are kept). Leads you mark as converted can be kept longer at your choice |
| Raw text read by research tools (third-party reviews, comments and posts) | 30 days, then deleted; only counts, themes and short quotes without names or handles are kept |
| Workspace data after a plan ends | Locked for 90 days, then the workspace is deleted from the Service unless a plan is bought again |
| Account data | While your account is open. If you close your account, it is deactivated and sign-in stops; records needed for billing, security, legal and dispute purposes are kept as below, and you can ask us to erase the rest (section 10) |
| Activity and security logs | While the account or workspace exists, and afterwards only as long as needed for security and legal purposes |
| Billing and payment records | As long as tax and accounting law requires |
| Support requests | While your account is open, and afterwards as long as needed to handle any follow-up |
| Backups | Deleted data leaves our providers' backups as those backups expire |
Deleted items are first removed from the Service (no longer visible or usable) and may remain in our database for a limited time so mistakes can be undone, before permanent removal.
9. Cookies and similar technologies
We use strictly necessary storage (for sign-in, security, language, theme and your cookie choice) and, only with your consent, analytics. We do not use advertising or tracking cookies. Details and how to change your choice are in our Cookie Policy.
10. Your rights
Wherever you live, we give you the following rights, based on the strictest standards among the EU and UK GDPR, the California Consumer Privacy Act (as amended by the CPRA), India's Digital Personal Data Protection Act and Nepal's Individual Privacy Act:
- Access your personal data and get a copy of it.
- Correct data that is inaccurate or incomplete. You can update most account details yourself in Account settings.
- Delete your personal data, except where we must keep it by law (for example, billing records).
- Export your data in a commonly used, machine-readable format (portability).
- Object to or restrict certain processing, including processing based on legitimate interests.
- Withdraw consent at any time (for example, for analytics, from "Cookie settings" in the website footer). Withdrawal does not affect processing done before it.
- Not be discriminated against for using your rights.
- Nominate another person to use your rights if you die or become unable to, where Indian law gives you this right.
To use any right, email support@socialmuse.online from the email address on your account, or send a request from Help in the app. We may need to confirm your identity. We respond within 30 days. You also have the right to complain to your local data protection authority.
We do not sell personal data or share it for cross-context behavioural advertising, as those terms are defined in California law.
11. Security
We protect personal data with technical and organisational measures, including encryption in transit, encryption of connected-account tokens at rest, strict separation of each workspace's data, permission checks on every request, required two-step verification for our administrators, and audit logging. No system is completely secure; more detail is on our Security page. If a personal data breach is likely to put your rights at risk, we will notify you and the authorities as the law requires.
12. Children
The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it.
13. Changes to this policy
We may update this policy. If we make material changes, we will notify you by email or in the app before they take effect. The effective date at the top shows when it was last changed.
14. Contact
- Email: support@socialmuse.online
- In the app: Help (available after you sign in)
- Location: Social Muse, Nepal