Privacy Policy

1. Who we are

SocialMadeSmart is operated by SOCIAL MADE SMART LTD, a private limited company registered in England and Wales under company number 17480736.

For privacy questions or to exercise your data-protection rights, email privacy@socialmadesmart.co.uk. For customer support use support@socialmadesmart.co.uk; for general company enquiries use hello@socialmadesmart.co.uk.

SocialMadeSmart helps small businesses turn everyday business updates, photographs, voice notes and other working-day moments into social-media content through a conversational service.

SocialMadeSmart Ltd is the controller for personal information used to manage our customer relationships, accounts, billing, security and enquiries. Where a business customer decides why personal information about its customers or other people is used in content, that business is the controller and we act as its processor to the extent that we handle the information only on its instructions. This Privacy Policy does not replace any data-processing contract required for that relationship.

2. When this policy applies

This policy applies when you visit our website, contact us or use SocialMadeSmart. The information we process depends on the features you use, for example whether you communicate through WhatsApp, upload or generate media, connect Instagram or Facebook, or use trial and billing features. LinkedIn content is currently prepared for manual publication: creating it does not itself connect to LinkedIn or send it there.

Not every feature or provider is available to every customer. We update this policy when a new feature or provider materially changes how personal information is used.

3. Information we collect

The information we process depends on how you interact with us. It may include:

• Contact and account information, such as your name, email address, business name and account status.
• Business information, including confirmed details about your services, specialisms, location and communication preferences.
• Messages and history, including business updates, revision requests, support messages and our responses.
• Photographs and other media, including images, screenshots, audio or voice notes, file metadata, transcripts and observations needed to understand the content.
• Content records, including ideas, drafts, variants, revisions, approvals and related media choices.
• WhatsApp information, including sender and message identifiers, message content, media references and delivery or event information.
• Connected-account information, where you connect a supported social-media or business-profile account, including account, page or profile identifiers, authorised permissions, access or refresh tokens, selected channels, scheduling instructions, publishing identifiers, status and error information.
• Trial and billing information, including trial start and expiry, Content Item usage, billing periods, subscription and cancellation status, customer and invoice identifiers, payment status, and records of the Terms and UK-business-use confirmation. If you choose a paid subscription, Stripe collects payment and billing details through its secure pages. We do not receive or store your full payment-card details. Starting the no-card trial does not itself require a Stripe customer record.
• Technical information, such as IP address, request details, authentication information, security events and limited diagnostic logs.
• Emails and enquiries sent to our company, support or privacy addresses.

We have not added advertising pixels or non-essential tracking cookies to the public marketing website. IONOS hosts the website and processes technical visitor information, such as the requested page, access time, browser information and IP-related information, for hosting, security and website statistics. This is separate from tracking code added to our pages. If we introduce non-essential tracking technologies, we will provide any consent controls required by law before they operate.

4. How and why we use information

Where you are an employee or other representative of a business rather than personally a party to our contract, our basis for ordinary account and service communications is our legitimate interest in providing the service to that business. Where we act as a processor for customer-supplied information, the customer determines the lawful basis and instructions for that processing. We do not rely on consent as a blanket basis for the core service. Where consent is the appropriate basis for an optional activity, we will ask for it separately.

5. WhatsApp interactions

When you contact SocialMadeSmart through WhatsApp, Meta processes the message and delivery information needed to carry it over the WhatsApp Business Platform. Meta's own privacy information also applies to your use of WhatsApp.

SocialMadeSmart may receive and store the message, media, sender and message identifiers, event status and relevant business context so that we can provide continuity, avoid processing the same message twice, investigate delivery problems and respond in the correct business account.

6. Photographs, voice notes and AI

We may use photographs to understand a business moment and audio to create a transcript. Relevant text, images, audio, brand references, business context and draft content may be sent to OpenAI's API for language, vision, transcription, image generation or image editing. This includes a customer photograph when the requested task requires analysis or editing of that photograph.

We limit the context sent for a task where reasonably possible. OpenAI's API data controls state that API inputs and outputs are not used to train its models by default unless the customer has opted in, and that retention may apply for abuse monitoring, application state or service operation, depending on the API feature and settings. We do not claim that AI processing is UK-only or subject to zero retention.

AI output is a draft. Customers can review, change, reject or approve it. SocialMadeSmart does not currently use AI to make decisions that have legal or similarly significant effects about people.

Information about other people

A customer may send information about someone else, such as a person in a before-and-after photograph, a recorded voice, a review or a customer message. The customer is responsible for making sure they have an appropriate lawful basis, permission and any notices needed to provide and use that material.

Please do not send confidential, sensitive or unrelated personal information. If you believe your information has been provided to us by a SocialMadeSmart customer and you want to ask about it, contact privacy@socialmadesmart.co.uk.

7. Business Memory

SocialMadeSmart stores confirmed information that helps it work with a business, such as what the business does, relevant services and communication preferences. Selected relevant context may be used in later interactions.

We do not treat every message as a permanent fact or preference. You can ask us to correct or remove inaccurate business context by contacting us.

8. Who we share information with

We use service providers where necessary to operate SocialMadeSmart:

• Railway for application hosting, PostgreSQL data storage, backups and operational logs.
• Cloudflare R2 for private storage of customer photographs, audio, generated and edited images, and publication-ready media. Media needed by a selected publishing platform is made available through controlled delivery links.
• OpenAI for text creation and revisions, language and vision processing, voice transcription, and image generation and editing.
• Meta and WhatsApp for WhatsApp messaging and, when selected and available, Instagram or Facebook account authorisation and approved publishing. Social platforms also process information under their own terms and privacy notices.
• IONOS for the public website, domain services and related technical visitor information.
• Stripe when you use paid-subscription or billing features, including Checkout, invoices, payment-method updates, cancellation and payment-status reconciliation. Stripe acts as a processor for some activities and as an independent controller for activities such as fraud prevention and legal compliance, as explained in its privacy notice.
• Microsoft 365 for company email, support and privacy communications.

We may also disclose information to professional advisers, regulators, courts or public authorities where required by law or reasonably necessary to establish, exercise or defend legal claims.

We do not sell personal information. A platform or payment provider receives information only when the relevant feature is available and used. The providers available through SocialMadeSmart may change, and we will update this policy where a change materially affects personal information.

9. International transfers

Providing the service can involve processing or access in the UK, the European Economic Area, the United States and other countries where our providers or their subprocessors operate. A regional hosting or media-storage setting does not mean that every provider operation or support activity takes place in that region.

Restricted transfers require a lawful transfer mechanism under UK data-protection law. The standard provider terms described in our provider records include, where applicable, adequacy arrangements or standard contractual clauses with the UK Addendum. The mechanism depends on the provider, destination and processing activity; we do not claim that all processing is UK-only or that one mechanism covers every provider. You can contact privacy@socialmadesmart.co.uk to request information about the safeguards relevant to your information and how to obtain a copy.

10. How long we keep information

We keep personal information only for as long as reasonably needed for the purpose for which it was collected. The period depends on the type of information, whether an account or customer relationship remains active, whether the information is needed to provide continuity or security, and whether we must retain it to meet a legal obligation or deal with a claim.

• Account, Business Memory, conversations, content and media may be kept while needed to provide the service and manage the account.
• Enquiries, support and privacy correspondence may be kept while the matter is active and afterwards where needed for follow-up, compliance or legal claims.
• Connection identifiers, permission and grant history, approval records, publishing receipts and security records are retained where needed to maintain connections, establish authorised actions, prevent duplicates, investigate problems or deal with legal claims. Access credentials are encrypted. A new authorisation may create a new grant while preserving earlier grant records.
• Trial and usage history is retained to administer allowances and prevent repeated trials. Payment, invoice and subscription records are retained where needed for accounting, legal obligations, reconciliation or disputes; the period is not the same as ordinary content retention.
• Providers may retain limited copies under their own documented security, backup and legal-retention arrangements.

Trial expiry or cancellation does not automatically erase messages, content, Brand Context or connection history. Deletion requests are assessed through our support contact; there is currently no fixed automatic deletion schedule. The absence of an automatic schedule does not remove our obligation to delete or anonymise information when it is no longer needed.

Deletion and account closure

You may ask us to close an account or delete personal information. We will assess the request, verify identity where necessary and explain if any information must be retained by law or cannot be removed from a third-party platform. Deletion from active systems does not automatically remove copies in backups or retained recovery material. Some manual recovery snapshots are not set to expire automatically and require a separate review and removal process. We do not promise immediate erasure from all backups. Removing information from SocialMadeSmart also does not automatically delete a post already published on a social platform or erase records a payment provider must retain. We will explain the handling of relevant copies when responding to a request.

11. Security

We use technical and organisational measures designed to protect personal information, including authenticated access, business-scoped data controls, private media storage, restricted credentials, environment separation and backups. Access is limited to people and providers who need it for their work. No internet service can guarantee absolute security.

12. Your data-protection rights

Depending on the circumstances and our lawful basis, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where consent is the lawful basis.

To exercise a right, email privacy@socialmadesmart.co.uk. We may ask for proportionate information to verify your identity and protect other people's information.

You also have the right to complain to the Information Commissioner's Office. You can find current guidance and contact routes at ico.org.uk. We would appreciate the opportunity to address your concern first.

13. Children

SocialMadeSmart is a business service and is not designed for children.

14. Changes to this policy

We may update this policy when the service, our providers or legal requirements change. We will show the latest revision date on this page and, where appropriate, notify account holders directly.