Skip to main content
Sociocrush
LoginGet Started

Privacy Policy

Last Updated: 4 October, 2026

This Privacy Policy explains how Sociocrush Technologies ("Sociocrush", "we", "us", "our") collects, uses, shares, keeps and protects personal data in connection with Sociocrush - social media management and collaboration platform that enables users and organizations to create, manage, schedule, publish, analyze, and collaborate on social media content, connect third-party accounts, and use AI-powered features when you visit sociocrush.com and related sub-domains (the “Site”), create an account or use the Sociocrush platform and related services (together, the "Service"). It also explains the choices and rights you have, which depend on where you live. For our contractual terms, see our Terms of Service.

1. Who We Are

Legal Entity: Sociocrush Technologies
Brand: Sociocrush
Registered Office: 409, Parvati Park Society, Panmala, Sinhagad Road, Pune 411030, Maharashtra, India
Country: India
Website: sociocrush.com
Privacy Email: support@sociocrush.com
Grievance Officer: Siddhesh Malve
Support Email (Representative EEA and UK): support@sociocrush.com

2. Scope and our role

2.1 Who this Policy covers - Visitors to our website; people who create a Sociocrush account, members, clients and other people invited to a Workspace; people who contact us; and people whose personal data appears in content or data processed through the Service.

2.2 When we decide how data is used - For account, sign-in, billing, support, security, referral, marketing, service-improvement and legal-compliance purposes, Sociocrush decides why and how personal data is processed. For this processing we are the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 and the "controller" under the EU and UK GDPR.

2.3 When we act for our business customers - Businesses and agencies use Workspaces to manage their own brands and their clients' brands. Content, media, client and brand information, website analysis results and social-account data placed in a Workspace by or for a business customer are processed on that customer's behalf and on its instructions. For that data, the customer (usually the Workspace Owner) is the Data Fiduciary or controller, and Sociocrush is its Data Processor or processor. The customer is responsible for giving notice to, and having a lawful basis for, the people whose data it places in the Service. If you have a question or request about such data, please contact the business concerned; we will help it respond. Business customers can request our Data Processing Agreement at sociocrush.com/data-processing-addendum.

2.4 What this Policy does not cover - The social-media platforms you connect (such as Instagram, YouTube or LinkedIn), payment providers acting under their own terms, and third-party websites each have their own privacy policies. Content you publish to a platform is governed by that platform's policy once published.

3. Key terms

  • Personal data: any information about an identified or identifiable individual.
  • Processing: anything done with personal data, such as collecting, storing, using, sharing or deleting it.
  • Workspace: a collaborative area in the Service for managing one or more brands, connected accounts, team members and content. The Workspace Owner is the person or organisation that controls it.
  • Connected Account: a social-media or business account you authorise Sociocrush to access.
  • User Content: as defined in the Terms, including text, captions, images, videos, prompts, comments and schedules.
  • Data Principal (India) and data subject (EEA/UK): the individual the personal data relates to.

4. The Service

Sociocrush is a social-media management and content-management platform designed to help Users plan, create, schedule, publish, analyse and manage social-media content. Depending upon the Subscription Plan, the Service may include - social-media account management, content scheduling and publishing, calendars, AI-generated captions, images, videos and other creative assets, AI content planning and post-idea generation, Brand Brain, analytics and reporting, first-comment scheduling;, social-media account integrations, multiple Brand/Client Workspaces, team collaboration, roles and permissions, approval workflows, client/Brand invitations, content review and approval, media management, notifications, APIs and integrations and other features introduced by Sociocrush from time to time. Feature availability, usage limits and functionality may vary depending on the Subscription Plan.

5. The Data We Collect

5.1 Account and identity data

  • Your name, email address, profile photo and password.
  • Your password is handled by our authentication provider, Clerk. Sociocrush never receives or stores it in readable form.
  • If you sign in with Google, we receive the name, email address and profile picture of your Google account.
  • Account identifiers and records of your sign-ins and active sessions.

5.2 Workspace, team and collaboration data

  • The names of the Workspaces and brands you create or join.
  • Your role and permissions in each Workspace, and which brands you can access.
  • Invitations you send or receive, including the invited person's name and email address.
  • Approval decisions, review comments and other activity within a Workspace.

5.3 Business profile and brand data

  • Business name, description, business type, website address, logo and marketing goals.
  • Brand guidelines, colours, fonts, products and services that you add or confirm.
  • This is mainly business information. It can still identify you if you are a sole trader, creator or personal brand.

5.4 Connected platform data

When you connect a social or messaging account to Sociocrush, we receive and store the following through that platform's API, depending on the platform and the permissions you grant:

  • Access and refresh tokens, which are stored encrypted, and the permissions (scopes) you approved.
  • Your platform username, account identifiers, display name and profile picture.
  • The pages, channels, boards or locations you manage on that platform.
  • Content and activity data needed to provide the Service:
    • posts you create, schedule or publish through Sociocrush, with their publishing status and post identifiers;
    • analytics such as followers, reach, impressions and engagement;
    • comments and messages, where the platform and your permissions allow.
  • Details for each platform are set out in Annex C.

YouTube. Sociocrush uses YouTube API Services.

5.5 Website analysis data (Brand Brain)

When you ask us to analyse a website, our crawler reads a limited number of its publicly accessible pages and collects:

  • page text and metadata, images and logos, colours and fonts;
  • products and services, and links to social-media profiles;
  • contact details published on that website, such as business email addresses, phone numbers and locations.

5.6 Content you upload or create

  • Drafts, captions, hashtags, links, scheduled and published posts, first comments, and content calendars.
  • Images and videos you upload, with their file names, folders and tags.
    • We create optimised copies and thumbnails without embedded metadata.
    • The original file is stored as uploaded, so remove location or other metadata before uploading if you don't want it stored.
  • AI prompts, AI-generated text, images and videos, and any feedback you give on generated content.
  • Your content may include personal data about other people, such as people shown in photos or customers quoted in testimonials.

5.7 Billing and transaction data

  • Billing name, company name, GSTIN and billing address (address lines, city, state, postal code and country).
  • Your plan, subscription status, invoice history, payment status and payment identifiers.
  • AI-credit balances and credit transactions.
  • Card, UPI and bank details are entered directly with our payment processor, Razorpay, and handled by Razorpay. We do not receive or store full card numbers, CVV, UPI PINs or net-banking credentials.

5.8 Referral programme data

  • Your referral code and the number of times your referral link is used.
  • Which Workspace referred which, the referred account's sign-up and onboarding status, and the credits awarded.

5.9 Logs, usage and device data

  • IP address, browser type and version, operating system and device information.
  • Server and error logs, including the time of each request, the pages or functions requested, and error details.
  • Feature usage within the Service, such as posts created, scheduled or failed, and AI credits consumed.
  • If you accept analytics cookies, Google Analytics 4 collects the pages and screens you view, the features you use, how you move through the Service, your approximate location (country and city) and your device and browser type. It does not log or store IP addresses.

5.10 Communications and support data

  • Support requests and any attachments you send us.
  • Feature requests, feedback and emails you send us.
  • Your marketing-email preferences (opted in or out).

5.11 Cookies and similar technologies

  • We use cookies and browser local storage to keep you signed in, remember your active Workspace and brand, store display preferences, and credit referrals.
  • We use Google Analytics 4 cookies to understand how the Service is used, and set them only with your consent where the law requires.
  • We do not currently use advertising or cross-site tracking cookies.
  • Details are in section 11 and Annex B.

5.12 Sensitive information

We do not ask for information about health, religion, political opinions, sexual orientation, biometrics or similar sensitive matters. Content you create or publish may reveal such information, so include it only when you need to.

6. How we collect personal data

  • From you, when you create an account, set up a Workspace or business profile, invite people, upload content, use AI features, contact us or pay.
  • Automatically, through cookies, local storage and server logs when you use the website and Service.
  • From third parties: Google (if you use Google sign-in); social platforms (when you connect an account); Razorpay (payment status); your Workspace administrators (when they invite you or add you to a team); and public websites you ask us to analyse.

7. How We Use Personal Data and Our Lawful Grounds

We process the personal data described in section 5 for the purposes below. Each purpose shows its lawful ground in brackets: first under Indian law, then the legal basis where the GDPR (or UK GDPR) applies. Where we act as a processor for a business customer (section 2.3), we process data on that customer's instructions, and the customer determines the lawful ground.

  • Provide the Service. Create and run your account and Workspaces, authenticate you, and store your content and media. (India: your consent, or data you voluntarily provided for this purpose under DPDP Act s. 7(a). EEA/UK: performance of contract, Art. 6(1)(b).)
  • Connect and manage your social accounts. Connect your accounts, publish and schedule posts, and retrieve analytics, comments and messages from connected platforms. (India: consent given when you authorise the connection. EEA/UK: performance of contract.)
  • Power our AI features. Generate captions, post ideas, content plans, images and videos, and build your Brand Brain, including the analysis of a website you submit. This uses your business profile, website-analysis data, prompts and the content you select. (India: consent; s. 7(a). EEA/UK: performance of contract.)
  • Enable team collaboration. Run Workspace collaboration, invitations and approval workflows, using Workspace and team data and the name and email of people you invite. (India: processing on behalf of the Workspace's business customer; otherwise s. 7(a). EEA/UK: performance of contract for members; legitimate interests, Art. 6(1)(f), in delivering an invitation the inviter requested.)
  • Bill and collect payment. Manage subscriptions and AI credits, issue invoices and comply with tax law, using billing and transaction data. (India: s. 7(a); compliance with Indian tax law. EEA/UK: performance of contract; legitimate interests in complying with Indian law, because Art. 6(1)(c) covers only EU/UK law.)
  • Secure the Service. Prevent fraud and abuse, keep security logs, and investigate and respond to incidents, using technical and account data. (India: compliance with law, including the CERT-In Directions and, once in force, the DPDP Rules; s. 7(a). EEA/UK: legitimate interests in securing the Service; legal obligation where EU/UK law requires.)
  • Support you. Respond to your support requests, using support and account data. (India: s. 7(a). EEA/UK: performance of contract; legitimate interests.)
  • Send service messages. Sign-in emails, Workspace invitations, security alerts and billing notices, using account and contact data. (India: s. 7(a). EEA/UK: performance of contract.)
  • Send marketing communications. Newsletters and product updates, using your name, email and preferences. (India: consent. EEA/UK: consent, or, for existing customers where the law allows, legitimate interests with a right to opt out, such as the UK PECR "soft opt-in".)
  • Improve the Service. Product analytics using usage and technical data, including the analytics data collected by Google Analytics 4. (India: consent where required. EEA/UK: legitimate interests; consent for non-essential cookies, except where the UK statistical-purposes exception applies.)
  • Run the referral programme. Credit the people who refer you and prevent referral fraud, using referral data. (India: consent; s. 7(a). EEA/UK: performance of contract under the programme terms; legitimate interests in preventing referral fraud.)
  • Comply with law. Meet legal obligations, enforce our Terms, and establish, exercise or defend legal claims, using any relevant data. (India: compliance with law; exemptions in DPDP Act s. 17 where applicable. EEA/UK: legal obligation; legitimate interests.)

Where we rely on consent, you can withdraw it at any time (section 19). Withdrawal does not affect processing that happened before it, and some features may stop working.

We do not use personal data to make decisions about you that produce legal or similarly significant effects based solely on automated processing. We do not sell personal data. We do not use your posts, connected-platform data or messages to show you advertising, and we do not use them to train AI models.

8. Connected social-media accounts

8.1 Platforms. We plan to support Instagram, Facebook, Threads, LinkedIn, Reddit, YouTube, Google Business Profile, TikTok, Pinterest, Telegram and Discord, subject to each platform's approval.

8.2 How connection works. You connect an account through the platform's own authorisation screen (OAuth). We never see or store your platform password. The platform shows you the permissions we request, and we can access only what you approve.

8.3 What we access and why. Depending on the platform and the permissions you grant, we access your account's profile information, the pages, channels or boards you manage, the ability to publish and schedule on your behalf, analytics (such as followers, reach, impressions and engagement), and comments and messages. Annex C lists this platform by platform. We use this data only to provide the features you use. We do not sell it, do not use it for advertising, and do not use it to train AI models.

8.4 Tokens. Access and refresh tokens are stored encrypted (AES-256-GCM) and used only by our servers to act on your instructions.

8.5 Disconnecting. You can disconnect an account at any time from Calendar > Connected accounts > Delete. When you do, we delete its stored tokens, stop all scheduled posts to it, and delete other data obtained through that connection within 30 days, except as described in section 17. You can also revoke our access in the platform's own settings; for Google and YouTube, at security.google.com/settings/security/permissions. Disconnecting does not remove posts already published on the platform; those remain subject to the platform's controls.

8.6 Google and YouTube. Sociocrush uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service (youtube.com/t/terms), and Google's Privacy Policy applies to Google's processing (policies.google.com/privacy). Sociocrush's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We delete YouTube data held about you within 7 days of your request, and refresh or delete stored YouTube data at least every 30 days, as YouTube's developer policies require.

8.7 Meta platforms (Facebook, Instagram, Threads). Instructions for requesting deletion of data obtained from Meta platforms are at sociocrush.com/data-deletion.

9. User Content, Brand Brain and website analysis

9.1 Your content - We process User Content to store it, show previews, run approval workflows, generate AI suggestions you request, and publish it where you instruct. You keep ownership of it, as set out in the Terms.

9.2 Other people's data in your content - If your content or Workspace includes personal data about other people (for example customers in photos, testimonials, client contacts or team members), you are responsible for having the right to use it and for giving those people any notice the law requires.

9.3 Website analysis - When you give us a website address for Brand Brain, our crawler visits a limited number of publicly accessible pages of that site. It identifies itself as SociocrushBot, follows the site's robots.txt instructions, and does not access password-protected areas or bypass technical restrictions. It extracts business information such as products, services, colours, fonts, logos and social links, and any contact details published on the site. Only submit a website you are authorised to have analysed. You can delete or regenerate the analysis from Settings > Brand Brain > Delete/Regenerate.

9.4 Images - When you upload an image we create optimised copies and thumbnails without embedded metadata (such as camera details or GPS location). The original file is stored as uploaded. If you do not want location or other metadata stored, remove it before uploading.

9.5 Deleted media - Media you delete is removed from your library immediately and permanently deleted 30 days later.

10. AI features

10.1 What our AI features do - They generate captions, post ideas, content plans, images and videos, and build a Brand Brain profile of your business from your business profile, brand materials and website analysis.

10.2 Providers - We use OpenAI for text, image and Brand Brain generation, and Kling for video + audio generation. To produce a result we send the provider your prompt and the context needed for it: relevant Brand Brain and business-profile information, content you select, and any reference images or media you choose.

10.3 How providers handle this data - Under OpenAI's API terms-https://openai.com/policies/row-privacy-policy/, data sent through the API is not used to train OpenAI's models unless the customer opts in, which Sociocrush has not done; OpenAI may retain it for up to 30 days to monitor abuse. For KLING privacy policy refer https://kling.ai/document-api/guides/protocols/privacy-policy. We do not authorise our providers to use your content to train their models, and we do not use your content to train general-purpose AI or machine-learning models ourselves.

10.4 Automated processing - Brand Brain creates a profile of a business or brand to tailor suggestions. It does not make decisions about individuals that have legal or similarly significant effects. AI output can be inaccurate; review it before you publish

11. Cookies and similar technologies

We use cookies and browser local storage. Annex B lists each one.

  • Strictly necessary: keep you signed in (Clerk authentication cookies), remember your active Workspace and brand, and support sign-up. These cannot be switched off because the Service needs them.
  • Preferences (local storage): remember your theme, sidebar state and which approval comments you have read. They stay in your browser and are not sent to us.
  • Referral: if you arrive through a referral link, a cookie stores the referral code for 30 days so the referrer can be credited.
  • Analytics: Google Analytics 4, provided by Google LLC, to understand how visitors use our website and the Service so that we can improve them. In the EEA we set analytics cookies only with your consent. In the UK we rely either on consent or on the statistical-purposes exception in PECR, which covers measuring how the Service is used, not tracking individuals.
  • Advertising: we do not use advertising or cross-site tracking cookies. You can change your choices at any time as described in our Cookie Policy, and can block or delete cookies in your browser. Blocking strictly necessary cookies will stop you signing in.

12. Payments and billing

Payments are processed by Razorpay Software Private Limited, India. You enter your card, UPI or bank details directly with Razorpay, and Razorpay handles them under its own terms and privacy policy (https://razorpay.com/privacy-policy/). We receive payment status, transaction identifiers and limited payment metadata, and we store the billing details you give us so we can issue invoices and meet tax obligations. Razorpay sends payment receipts directly.

13. Communications and marketing

Service messages. We send messages you need in order to use the Service, such as account verification, sign-in codes, Workspace invitations, security alerts, billing notices and changes to our terms. Our authentication provider Clerk sends sign-in and invitation emails for us. You cannot opt out of service messages while your account is active.

Marketing. We send newsletters and product updates via Resend. Where the law requires consent, we send them only if you opt in. Every marketing email contains an unsubscribe link, and you can also opt out by writing to support@sociocrush.com.

14. How we share personal data

We share personal data only as follows:

  • Within your Workspace: other members and invited clients see information according to the roles and permissions the Workspace Owner sets.
  • With service providers who process data for us under contract, listed in Annex A, such as hosting, database, authentication, AI and email providers.
  • With social platforms, at your direction: when you publish or interact through a Connected Account, the platform receives that content and data and handles it under its own policy.
  • With our payment provider, to process payments.
  • With professional advisers, such as lawyers and accountants, under duties of confidentiality.
  • For legal reasons: where required by law or a valid order of a court, regulator or authority, or where reasonably necessary to protect the rights, property or safety of Sociocrush, our users or others. We assess requests for legal validity and disclose only what is required.
  • In a business transfer: if the business is sold, transferred or incorporated into a company, personal data may transfer to the new owner, which will be bound by this Policy or will notify you of changes.
  • With your consent, for any other purpose we describe when we ask.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not give it to data brokers.

15. International transfers

Sociocrush is based in India. Our main database and file storage are in Singapore (Supabase). Our application runs in the United States (Vercel), and our authentication provider (Clerk) and main AI provider (OpenAI) are in the United States. Kling processes video requests through a Singapore endpoint, and Razorpay processes payments in India. Social platforms process data worldwide. Your personal data will therefore be processed outside your country, including outside India and outside the EEA and UK.

  • India. The DPDP Act permits transfers abroad except to countries the Central Government restricts by notification. We will comply with any such restriction.
  • EEA and UK. India, Singapore and the United States do not have general adequacy decisions. Where we transfer EEA or UK personal data to our service providers, we use the European Commission's Standard Contractual Clauses (with the UK Addendum, or the UK International Data Transfer Agreement), or the EU-U.S. Data Privacy Framework and its UK Extension where the recipient is certified, together with supplementary measures where needed. You can ask for a copy of the relevant safeguards at support@sociocrush.com.

16. Security

We use technical and organisational measures appropriate to the risk, including - encryption in transit (HTTPS, with HTTP Strict Transport Security) and encryption at rest provided by our infrastructure providers, encryption of social-media access tokens with AES-256-GCM, database row-level security and role-based permissions, so users see only the Workspaces and brands they are allowed to access, access to stored media through short-lived signed links, protection of our website-analysis crawler against being used to reach private or internal networks, restricted, credential-based administrative access, and logging to detect and investigate incidents. Sociocrush does not currently hold an information-security certification such as ISO/IEC 27001 or a SOC 2 report. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your login details safe, use a strong password and tell us promptly at support@sociocrush.com if you suspect unauthorised access.

17. How long we keep data

We keep personal data only as long as needed for the purposes in section 7, then delete or anonymise it. Specific periods:

  • Account, Workspace and content data: While your account or Workspace is active; deleted or anonymised within 30 days after you delete your account or the Workspace is closed, except as below.
  • Media you delete: Permanently deleted 30 days after you delete it.
  • Social-media tokens: Deleted when you disconnect the account, when access is revoked, or when you delete your account.
  • Other data from Connected Accounts: While connected; deleted within 30 days of disconnection. YouTube data: refreshed or deleted at least every 30 days and deleted within 7 days of your request.
  • Billing, invoice and tax records: 8 years from the end of the financial year to which they relate, as required by Indian tax law.
  • Security and access logs: 1 year.
  • AI request and response records: 12 months.
  • Support requests: 3 years after closure.
  • Marketing opt-out records: As long as needed to respect your opt-out.
  • Backups: Deleted data remains in encrypted backups for up to 7 days until those backups are overwritten; backups are not used to restore deleted personal data except to recover from an incident.

We may keep data longer where the law requires it, to resolve disputes, to enforce our agreements, or where data is needed to investigate a security incident or fraud. In each case we keep only what is necessary, for only as long as necessary.

18. Disconnecting accounts, deleting data and closing your account

  • Disconnect a social account: see section 8.5.
  • Delete content or media: delete it in the Service; deleted media is purged after 30 days.
  • Close your account: use Settings > Help and Support >Delete my account. Your sign-in access ends immediately. Within 30 days we delete or anonymise your account data, and, for Workspaces you own, the Workspace's content, media, Brand Brain and website-analysis data, Connected Account data and tokens, subject to section 17.
  • Cancelling a subscription stops renewal but does not delete your account or data.
  • Export: before closing your account, download any content you want to keep.

We also ask our service providers to delete the data they hold for us, in line with their contracts.

19. Your rights

Your rights depend on where you live; sections 20 to 22 give the details. In general you can ask us to - tell you what personal data we hold about you and how we use it, and give you a copy, correct, complete or update inaccurate or incomplete data, delete your data, withdraw consent you have given, stop sending you marketing.

How to make a request - Email support@sociocrush.com from the email address on your account, or tell us your account email so we can identify you. We may ask for further information to verify your identity and will use it only for that purpose. You may act through an authorised agent or, in India, a person you nominate; we may ask for proof of their authority.

Timing and cost - We acknowledge requests within 7days and respond within the period the applicable law sets (sections 20–22). Requests are free unless they are manifestly unfounded or excessive.

Exceptions - We may decline or limit a request where the law allows, for example where we must keep data to meet a legal obligation or where a request would reveal another person's personal data. We will explain why. For data we process for a business customer (section 2.3), we will pass your request to that customer and help it respond.

20. Additional information for India

20.1 Applicable law - We process personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are being brought into force in phases, with most obligations and rights commencing on 13 May 2027. We have prepared this Policy to meet those requirements and honour the rights below now.

20.2 Your rights - You can obtain a summary of the personal data we process about you and of the processing, and the identities of the parties we have shared it with, have your data corrected, completed, updated or erased, withdraw your consent, as easily as you gave it, have your grievances addressed by our Grievance Officer (section 28), nominate another person to exercise your rights if you die or become incapable of doing so.

20.3 Timelines - Our Grievance Officer resolves grievances within one month of receipt. Once the DPDP Rules commence we will respond to rights requests and grievances within the period they set (no more than 90 days) and aim to do so within 30 days.

20.4 Complaints to the Data Protection Board - Once the relevant provisions are in force, if you are not satisfied with our response you may complain to the Data Protection Board of India after first using our grievance process.

20.5 Consent managers - Once Consent Managers registered with the Data Protection Board are available, you may be able to give, manage or withdraw consent through one.

21. Additional information for the EEA and the UK

21.1 Controller and representatives - The controller is Sociocrush Technologies (section 2). Our EU and UK representatives are listed in section 2.

21.2 Your rights - Under the GDPR and UK GDPR you have the right to access your data, rectification, erasure, restriction of processing data portability (for data you provided, processed on the basis of consent or contract, by automated means), object to processing based on legitimate interests, object at any time to direct marketing, which we will then stop, withdraw consent at any time and not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (we do not make such decisions).

21.3 Timing - We respond within one month. That period can be extended by up to two more months for complex or numerous requests, in which case we will tell you why.

21.4 Complaints - You may complain to the data protection authority in the EU country where you live or work or where the alleged infringement occurred. In the UK you may complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint). UK residents should first complain to us at support@sociocrush.com; we acknowledge complaints within 30 days and respond without undue delay.

21.5 Transfers - See section 15.

22. Additional information for United States residents

22.1 State privacy laws - Comprehensive state privacy laws, such as the California Consumer Privacy Act, apply only to businesses that meet revenue or volume thresholds. Sociocrush does not currently meet those thresholds. We will update this section, including the categories and rights those laws require, if that changes.

22.2 No sale or sharing - We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use or disclose sensitive personal information for purposes other than providing the Service.

22.3 Your requests - Wherever you live, you can use the rights in section 19.

23. Business Customers and Third-Party Data

Sociocrush may process personal data belonging to individuals whose information is provided by our customers, including customers, clients, employees, followers, commenters and other individuals. Where a customer uses Sociocrush to process personal data on its behalf, the customer may determine the purposes of processing and Sociocrush may process the information according to the customer's instructions, where applicable. Customers are responsible for ensuring that their use of Sociocrush complies with applicable privacy laws and that they have the necessary rights, permissions and notices to process such information. Where required, Sociocrush may enter into a Data Processing Agreement (DPA) with the customer. The Service links to, and integrates with, websites and platforms we do not control. Their privacy practices are governed by their own policies; please read them.

24. Children

The Service is intended only for people aged 18 or over (or the age of majority where they live, if higher), as required by our Terms. We do not knowingly collect personal data from children, meaning anyone under 18 under Indian law. If we learn that we hold a child's personal data, we will delete it and close the account. Please contact support@sociocrush.com if you believe a child has used the Service.

25. Do Not Track and Global Privacy Control

There is no common standard for browser "Do Not Track" signals, so we do not respond to them. We do not use cross-site tracking or sell personal data, so a Global Privacy Control signal does not change our processing today.

26. Personal data breaches

We monitor our systems and have a procedure to detect, investigate, contain and recover from security incidents. If a breach affects your personal data, we will notify you and the authorities where and as the law requires:

  • India: we report cyber incidents to CERT-In within six hours of noticing them, as its Directions require. Once the DPDP Rules commence, we will inform each affected person without delay and report to the Data Protection Board within the periods the Rules set.
  • EEA and UK: we notify the competent supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to people's rights and freedoms, and notify affected individuals without undue delay where the risk is high.
  • Business customers: where we act as processor, we notify the affected customer without undue delay and help it meet its own obligations, as set out in our Data Processing Agreement.

27. Changes to this Policy

We may update this Policy to reflect changes in the Service, the law or our providers. We will change the "Last updated" date. For material changes, we will notify you by email or in the Service at least 15 days before they take effect where practicable, and will ask for fresh consent where the law requires it.

28. Grievance Officer and contact

  • Grievance Officer: Siddhesh Malve
  • Email: support@sociocrush.com
  • Postal address: Sociocrush Technologies, 409, Parvati Park Society, Panmala, Sinhagad Road, Pune 411030, Maharashtra, India
  • Hours: Monday–Friday, 10:00–18:00 IST
  • Response time: Acknowledgement within 7 days; resolution within one month
  • Privacy, Security and support : support@sociocrush.com

Annexes

The following annexes form part of this Policy: Annex A (service providers), Annex B (cookies and local storage) and Annex C (connected-platform data).