Privacy Policy

Social Freak Ltd (company no. 14659411), Unit 82A, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, UK, operates Social Fetch. We are an independent data controller for account, billing, fraud and security, legal-compliance, affiliate program, product analytics, advertising measurement, and direct customer-relationship information described in this policy. For personal data in customer-instructed API requests and results, we act as the customer’s processor under our Data Processing Addendum. For privacy questions, contact support@socialfetch.dev.

The API returns publicly available data from third-party platforms at request time. That data is returned to you and is governed by those platforms’ terms. For personal data in customer-instructed API requests and results, Social Freak Ltd acts as the customer’s processor; the customer remains controller and is responsible for its instructions and lawful basis. We do not sell that data or use it to train machine-learning models, and disclose it only as needed to provide, secure, and support the Services, including through authorised subprocessors. Each API call creates a database row containing minimal operational fields such as the endpoint, HTTP method and path, status code, credits charged, and any error code. Under standard retention, the row also contains request parameters and limited response previews; those payload fields are not durably stored for zero-retention accounts. Rows are not a permanent archive of platform content. We retain standard operational API logs for approximately 30 days, including request metadata and limited response previews, for support, billing, abuse prevention, and reliability, then delete them. Accounts that have made a purchase can opt into zero retention: live processing still occurs, but we do not durably store request parameters, target URLs, or response previews; minimal operational, billing, security, and reliability metadata remains. Hosted screenshots and similar short-lived media artifacts are retained for approximately 7 days. Where a customer explicitly opts into hosted social-media originals, those objects are retained for approximately 90 days. Objects are then deleted automatically; customers needing longer retention should download and store the bytes themselves. When you call GET /v1/web/ask, the target URL, retrieved page text, and your question are sent to our AI provider to produce the requested answer. We do not permanently store platform content as an archive on your behalf.

You can connect Social Fetch to an AI assistant such as ChatGPT, or another client that supports the Model Context Protocol (MCP), so the assistant can call our tools on your behalf. This section explains what we receive and keep when you do.

What we receive. When you connect, you sign in to your Social Fetch account and choose the workspace the connection may use; we issue a read-only access token tied to your account identifier and that workspace. Each time the assistant calls a tool, we receive only the tool inputs it sends (for example a social-media handle, post or page URL, search term, or result limit), plus request metadata such as the time, tool name, and the client’s user agent. As with all traffic, network information such as an IP address is processed for security and rate limiting. We do not receive your conversation with the assistant, your assistant account, or your name or email address from the assistant provider.

Third-party personal data in results. Results contain publicly available information about the people, accounts, posts and businesses you ask about, such as profile names, handles, biographies, follower counts, posts and comments. We return this to the assistant at request time and do not build a standing archive of it. For this data we act as your processor, as described in the API requests section above and our Data Processing Addendum.

Purposes. We use this information only to authenticate the connection, run the requested lookup, charge credits, enforce limits, prevent abuse, and provide support and reliability. We do not sell it, use it for advertising or behavioural profiling, or use it to train machine-learning models.

Retention and recipients. Requests made through an assistant are logged like any other API request, so the retention periods above apply, including zero retention for eligible accounts. Recipients are the same service providers described in this policy and listed in our public register. The assistant provider receives the results we return and handles them under its own terms and privacy policy, which we do not control.

What we do not want. The tools do not need and are not designed to receive payment card numbers, health information, government identifiers, passwords or API keys. Please do not include them in prompts that may be passed to our tools.

Your controls. You can disconnect Social Fetch in your assistant’s connection settings at any time, which removes the assistant’s stored connection. To have us revoke a connection’s access immediately, or to exercise any of your rights described below, contact support@socialfetch.dev.

We use providers for email delivery, product analytics, and error monitoring. In production this includes SendGrid for email, PostHog US Cloud for product analytics and support chat, and Sentry’s US ingest service for error tracking. Stripe handles payments and may act independently for regulated payment and fraud functions. Provider roles and data scope are listed in our public register.

Advertising. We run paid advertising and measure whether it leads to sign-ups and purchases. For this we use Google Tag Manager, through which we run advertising and measurement tags such as Google Ads, Google Analytics and OpenAI’s advertising measurement. When you sign up or buy, we may send them the event (for example a sign-up, checkout or purchase, with its value and currency), the ad click identifier or campaign details described above, and a SHA-256 hash of your email address. We do not send them your name or API data. These providers handle that information under their own privacy policies and may use it for their own purposes, such as measurement and fraud prevention. You can control personalised advertising in your Google account ad settings, and you can contact us to ask us to stop sending your data to them.

Email. We send service messages (receipts, security notices and account or billing alerts) which you cannot opt out of while you have an account. We also send product and lifecycle emails, such as low-credit reminders and tips for getting started. These include an unsubscribe link, and you can opt out at any time.

Ask AI and documentation chat send documentation questions to third-party AI services so we can answer from our documentation. These features are for documentation help only; they are not a channel for submitting API request payloads or retrieved customer API content. Please do not include personal data in your questions. We may log questions, and questions we cannot answer from the documentation may be reviewed by us to improve it.

Where UK GDPR, the Data Protection Act 2018, or EU GDPR applies, we rely on these legal bases:

• Performance of a contract: providing the Services, accounts, workspaces and billing, and running the affiliate program for approved affiliates.
• Legitimate interests, balanced against your rights: securing the Services, preventing fraud and abuse, product analytics and improvement, measuring our advertising, direct support, and assessing affiliate applications.
• Consent, where the law requires it, for example for certain cookies and similar technologies and for marketing messages where consent is needed. You can withdraw consent at any time.
• Legal obligations: tax, accounting and responding to lawful requests.

We publish at /subprocessors a concise, non-exhaustive register of material service providers we publicly identify. Additional diligence information may be available on reasonable request where legally permitted and subject to applicable confidentiality and contractual restrictions. Our DPA requires us to impose appropriate data-protection obligations on providers that act as our subprocessors. Some payment, authentication, advertising, and source-platform services act independently for their own legal purposes. If you are an affiliate paid in cash, your payout details and amount are shared with PayPal or Wise to send your payment. We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer (for example, a merger), in line with applicable law.

We are established in the UK. EEA-to-UK transfers currently benefit from the European Commission’s renewed UK adequacy decision through 27 December 2031. Providers may process data in the United States and other countries. For onward restricted transfers we use the approved mechanism applicable to the vendor and service configuration; see the public register or contact us for information about the applicable mechanism where legally permitted and subject to applicable confidentiality and contractual restrictions.

We retain account and billing information while your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. A workspace’s activity log is shown to its owners and admins, and its entries are deleted after 90 days (12 months for Scale workspaces). Until then, entries keep the acting person’s email address and role as recorded when they were made, including after that person leaves the workspace. We retain standard operational API logs for approximately 30 days, including request metadata and limited response previews, for support, billing, abuse prevention, and reliability, then delete them. Accounts that have made a purchase can opt into zero retention: live processing still occurs, but we do not durably store request parameters, target URLs, or response previews; minimal operational, billing, security, and reliability metadata remains. Hosted screenshots and similar short-lived media artifacts are retained for approximately 7 days. Where a customer explicitly opts into hosted social-media originals, those objects are retained for approximately 90 days. Objects are then deleted automatically; customers needing longer retention should download and store the bytes themselves. Billing, commission and payout records are kept for as long as the law requires for tax and accounting purposes, which in the UK is generally six years. Affiliate applications are kept while you are in the program and for a reasonable period afterwards. Advertising click identifiers are kept for up to 90 days. Workspaces you close are deleted after the 30-day restoration window described in our Terms of Service. Aggregated or anonymised statistics may be kept longer for operations and reporting.

Depending on your location, you may have rights to access, rectify, erase, or export personal information; object to or restrict certain processing; withdraw consent where processing is consent-based; and lodge a complaint with a supervisory authority (in the UK, the Information Commissioner’s Office). To exercise these rights, contact support@socialfetch.dev. We may need to verify your request, and we will respond within one month. You can object to direct marketing at any time by using the unsubscribe link in our emails or contacting us.

We use technical and organisational measures to protect personal information, including TLS for data in transit, hashed API key storage, optional two-factor authentication (authenticator-app codes and backup codes) for every account, and encryption at rest for identity-provider client secrets. No method of transmission or storage is completely secure. See our Security page for an overview of our practices.

We notify affected customers without undue delay and, where feasible, within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data, providing available information in phases where necessary. The DPA describes the information and assistance provided to affected customers.

The Services are not directed at children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the revised version here and adjust the “Last updated” date. For material changes, we will provide additional notice where appropriate (for example, by email or in-product notice).