Privacy policy
Last updated: 28 October 2026.
Borderless Talent Hub Ltd, trading as SocioRelay ("we"), company number 17159522, registered office Office 1101, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW, United Kingdom, is the controller of the account, billing and website data described here. We are registered with the Information Commissioner's Office under number ZC225626. Contact: info@sociorelay.com.
Your app and its content (we are your processor)
Each business's SocioRelay app runs on our servers in the United Kingdom. Your posts, images, settings, topic plans, reports and connected platform logins are stored there so that your app can publish for you. Platform logins and keys are encrypted with a key for your business alone. For that content, your business is the controller and we act as its processor under our Data Processing Terms. We use it only to run your app and help you when you ask. If you connect your own AI account, your drafts go from your app to that provider under your own agreement with them.
Data from social media platforms
When you log in to a platform in your app, you choose which accounts it may use, and the app receives only what it needs to publish for you:
| Platform | What your app receives | What it's used for |
|---|---|---|
| Facebook and Instagram (Meta) | The Pages and Instagram professional accounts you pick (names, ids), permission to publish to them, and their post and page statistics | Publishing your posts; the weekly report |
| Threads (Meta) | Your Threads profile (name, id) and permission to publish | Publishing your posts |
| Your name and profile id, or the company pages you manage, and permission to post | Publishing your posts | |
| X | Your username and permission to post | Publishing your posts |
| TikTok | Your basic profile (display name, id) and permission to upload videos | Sending your videos to TikTok |
| YouTube (Google) | Permission to upload videos and read your channel's statistics | Publishing your Shorts; the weekly report |
| Google Business Profile | Your business locations, their reviews, and permission to post updates and reply to reviews | Posting updates; drafting and posting the review replies you approve |
| Your boards, and permission to create pins | Publishing your pins | |
| Bluesky | Your handle and an app password you create | Publishing your posts |
This data stays in your app, encrypted, and is used only to provide the features you use. We don't sell it, use it for advertising, or use it to train AI models. When you ask the app to draft a reply to a review or a post, the text needed for that draft is sent to the AI provider (see below) only to produce it. When you press Disconnect in Connections, the app deletes that login and asks the platform to cancel it where the platform allows that; closing your account deletes everything (see Deleting your data).
Google: SocioRelay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data to develop, improve or train AI or machine learning models.
YouTube: SocioRelay uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of your data is covered by the Google Privacy Policy. You can remove SocioRelay's access at any time in your Google security settings. YouTube statistics (such as subscriber counts and video views) are kept in your app for at most 30 days and are refreshed each week; when you disconnect YouTube they are deleted straight away.
How we protect your data
We protect personal and sensitive data, including the data platforms such as Google and YouTube share with your app, like this:
- Encrypted in transit: every connection to sociorelay.com, to your app and from your app to the platforms uses HTTPS (TLS).
- Encrypted at rest: platform logins (access and refresh tokens), API keys and passwords stored by your app are encrypted with AES-256-GCM, using a data key for your business alone. Website passwords are stored only as one-way hashes. Backups are encrypted (AES-256) before they leave the server.
- Kept apart: each business's app runs in its own separate container on our UK servers, with its own storage, so one business's app can't read another's data.
- Access control: your app needs your password and a two-step sign-in code. Our servers accept administrator sign-in only with security keys (no passwords), behind a firewall that blocks repeated failed attempts, and they install security updates automatically. Only authorised SocioRelay staff can reach the servers, and only to run the service, keep it secure, or help you when you ask.
- People don't read your platform data: no one at SocioRelay reads data received from Google, YouTube or other platforms, except with your permission (for example when you ask for help), for security reasons, or where the law requires it.
- Kept only as long as needed: platform statistics are kept for at most 30 days, and logins are deleted as soon as you disconnect a platform or close your account (see the table below and Deleting your data).
- If something goes wrong: if a breach affects your data, we tell you without undue delay and report it to the Information Commissioner's Office within 72 hours where required.
What we collect
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, business name, email, password (one-way hashed), company details (legal name, company number, address, website, industry); we may check the company number with Companies House | Your account, licences, invoices and support; knowing who our customers are | Contract; legitimate interest in preventing misuse | While your account is open, then 30 days |
| Billing details, handled by Stripe (we see your plan, payment status, billing address and invoices, never your full card number) | Taking payment, invoices | Contract; legal obligation (tax records) | Invoices: 6 years |
| Licence key, plan, licence status | Checking your plan | Contract | While you subscribe + 12 months |
| Free trial: your email, and a one-way hashed id of your email | Providing the trial and allowing one trial per business | Legitimate interest in preventing misuse of free trials | Hashed ids: 3 years |
| Your app's address and status, and sign-in records for your app (email, time, IP address) | Running and securing your app | Contract; legitimate interest | While your app exists; sign-in records 90 days |
| One-way hashed ids of the social accounts you publish to (never their names or logins) | Limiting a licence to your business's own accounts | Contract; legitimate interest | While you subscribe + 12 months |
| AI credits use (credits, token counts, dates) | Billing and fair use | Contract | 25 months |
| If you use AI credits or AI images: the request the app sends (your business description, topic and notes, or the image description) | Producing the draft or image | Contract | Not stored by us; passed to the AI provider (see below) |
| If you search photos: your search words | Finding photos | Contract | Not stored by us |
| If you use the API: your API keys (one-way hashed), drafts sent through the API until your app collects them, and the webhook addresses you register | Connecting other software you choose | Contract | Drafts: until collected, at most 30 days; keys and webhooks: until you delete them |
| If you use client review links: the posts and images you send for review, and the name and comments your reviewer enters | Letting your reviewer approve posts | Contract | Until 90 days after the decision, or when you close your account |
| If you upload your own music: the sound file, where you said it comes from, and a record of your confirmation that you hold the rights (who, when, a fingerprint of the file) | Adding the music to your videos; dealing with any copyright complaint | Contract; legitimate interest | Music: until you remove it or close your account; the upload record: while your app exists |
| Two-factor sign-in key (encrypted) and hashed recovery codes, if you turn it on | Protecting your account | Contract; legitimate interest | While it's on |
| IP address, login times and actions in your account | Security, fraud prevention | Legitimate interest | Login attempts: 2 days; activity: while the account exists |
| If you use Get help in your app: your message, and details from your app that help us find the problem (app version, plan, which platforms are switched on and connected, recent failed posts with their error messages, and recent warning and error lines from the app's log). Passwords, logins, tokens and keys are removed before anything is sent, and you can see exactly what is sent first | Answering you and fixing problems | Legitimate interest | 2 years |
| Alerts your app emails you (for example a failed post or a login about to expire): a copy, so we can spot problems affecting several customers | Running a reliable service | Legitimate interest | 30 days |
| Messages you send us | Answering you | Legitimate interest | 2 years |
We send account emails (verification, your app's address, receipts for credits, trial reminders, alerts and weekly reports). We won't send you marketing unless you've asked for it. We don't use AI to make decisions about you.
Cookies
The website uses one cookie, sr_session, which keeps you logged in and protects forms against forgery. It's strictly necessary, so we don't ask for consent. We don't use analytics or advertising cookies. Stripe's checkout pages may set their own cookies to prevent fraud.
Who we share it with
- Stripe Payments Europe Ltd: payments and invoices (an independent controller).
- Keygen (Keygen LLC, United States): licence management.
- Hostinger International Ltd: hosts our website, its database and the customers' apps in the United Kingdom.
- Backblaze, Inc.: encrypted backups, stored in the European Union (Netherlands).
- Amazon Web Services: delivers our emails from London.
- Anthropic, PBC (United States): AI drafts, only when you use AI credits.
- OpenAI, L.L.C. (United States): AI images, only when you use them.
- Pexels and Pixabay: photo search (search words only).
- Companies House: when we check a company number.
- Our professional advisers, and regulators or law enforcement where the law requires it.
The AI providers' business terms don't allow them to train their models on this data; they may keep requests for a short time (up to 30 days) to detect abuse. Where data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
Your rights
You can ask for a copy of your data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Email info@sociorelay.com and we'll respond within one month. You can close your account yourself in Settings; see Deleting your data for what happens next. You can complain to the Information Commissioner's Office (ico.org.uk), but we'd appreciate the chance to put things right first.
Children
SocioRelay is a service for businesses. Accounts and apps are for people aged 18 or over, who confirm this when they sign up, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
Changes
We will post any changes here and tell you of significant ones by email.
Questions about this page: info@sociorelay.com.