Privacy Policy

Last updated: August 29, 2026

Social OS ("the Service") is operated by Mattia Francioso, a sole proprietorship trading as Teamoon Agency ("we", "us", "our"), with registered office in Italy. This Privacy Policy describes how we collect, use, and protect your personal data when you use the Service.

1. Data We Collect

When you connect a social media account (Instagram, Facebook, TikTok, YouTube, LinkedIn) to Social OS, we collect:

• OAuth tokens — access tokens and refresh tokens issued by the social platform, used exclusively to publish content and retrieve analytics on your behalf.
• Public profile information — username, display name, and profile picture URL as returned by the platform API.
• Content you create — captions, hashtags, media files, and scheduling preferences you enter in Social OS.
• Account information — email address and name used to sign in to Social OS.

2. How We Use Your Data

• To publish content to your connected social media accounts at the times you schedule.
• To display analytics and performance metrics from your social accounts.
• To authenticate you and manage access to client workspaces.

We do not sell, rent, or share your personal data or social media tokens with third parties.

3. Data Storage and Security

Data is stored on Supabase (hosted on AWS eu-central-1, Frankfurt) and on Vercel infrastructure, inside the European Union. All traffic between your browser, Social OS and the platform APIs travels over TLS.

These are the specific mechanisms that protect the data we hold, including the data we receive from the social platforms:

• Credentials. OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, and are decrypted only in memory, at the moment a publish or a metrics read needs them. They are never logged and never sent to the browser.
• Platform data at rest. The data we obtain with those tokens — video identifiers, titles and descriptions, thumbnails, transcripts and performance metrics — is stored in a managed Postgres database with encryption at rest and daily backups, reachable only from our own server-side code through credentials held in the deployment environment. It is never exposed by a public endpoint.
• Separation between clients. Social OS is a multi-tenant agency tool. Every request is bound to a single client workspace before it reaches the data, and every raw database query goes through a scoping layer that refuses to run without a client identifier. One client's data is never combined with, or made visible to, another.
• Access control. Access requires an authenticated account. Permissions are granted by role, and an account can be restricted to a subset of client workspaces; people who are not on a client see neither its content nor its metrics nor its notifications.
• Generated files. The PDF reports built from platform metrics live in a private storage bucket and are served only through short-lived signed links, checked against the workspace the requester belongs to.

4. Third-Party Platform Data

When you connect a TikTok account, we request the following scopes: user.info.basic, video.list, and video.publish. We use these permissions solely to display your profile information and publish video content you explicitly schedule through Social OS. We do not access your TikTok data for any other purpose.

Similar principles apply to Instagram, Facebook, and LinkedIn connections. We only request the minimum permissions needed to provide the Service.

4.1 YouTube

Social OS uses YouTube API Services. By connecting a YouTube channel to Social OS you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

When you connect a YouTube channel we request these OAuth scopes, and we use each of them for one purpose only:

• youtube.upload — to upload the videos you schedule through Social OS (videos.insert).
• youtube.readonly — to read your channel and the metadata of the videos published from it (channels.list, playlistItems.list, videos.list), so that published content appears in your calendar and reports.
• yt-analytics.readonly — to read the performance metrics of those videos through the YouTube Analytics API, which is what the analytics and monthly reports are built on.

We store the video identifiers, titles and descriptions, thumbnails and performance metrics of the videos published from your channel. We do not use YouTube data for advertising, we do not sell it, and we do not combine the data of one channel with the data of another client.

You can revoke Social OS's access to your YouTube channel in two ways: from Settings → Platforms inside Social OS, or from the Google security settings page at security.google.com/settings/security/permissions.

5. Data Retention

We retain your data for as long as your account is active. If you disconnect a social account, we delete the associated tokens within 24 hours. If you delete your Social OS account, all your data is permanently removed within 30 days.

For YouTube data specifically, we apply the retention rules required by the YouTube API Services Developer Policies:

• If you disconnect your channel inside Social OS, we revoke the token with Google and delete all stored YouTube data immediately, and in any case within 7 days.
• If you revoke access from the Google security settings page instead, we delete all stored YouTube data within 30 days.
• Video titles, descriptions, thumbnails and transcripts are refreshed from the YouTube API at least every 30 days; when a video is no longer available, or your authorization is no longer valid, we delete them instead.
• Aggregated performance metrics are kept for as long as your authorization stays valid, which we verify at least every 30 days, and are deleted when it stops being valid.

6. Your Rights

Under GDPR and applicable Italian law, you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent and disconnect your social accounts at any time.
• Lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

7. Contact

For privacy inquiries, contact us at: privacy@teamoon.it