Privacy Policy — Socialoop
Last updated: 15 October 2026 (draft)
Socialoop (socialoop.me) is an AI assistant for social media: you share your photos and videos with us (via a link to your cloud storage or through our Telegram bot), Socialoop selects the best material, designs posts, writes captions, suggests a publishing plan and, if you allow it, publishes to your Instagram account.
This policy explains what data we process, why, for how long, who we share it with and how to exercise your rights. It covers the Telegram bot, the Socialoop web pages and the Socialoop app on the Meta platform (Instagram / Facebook).
1. Who we are
Controller: OUTLINE, a French SASU with share capital of 1 €, registered with the RCS of Nice under no. 924 870 298, registered office: 102 avenue Saint-Lambert, 06100 Nice, France. Privacy contact: privacy@socialoop.me.
Socialoop is for businesses and professionals only (venues, freelancers, social media managers). It is not intended for anyone under 18.
2. Two different roles
- We are the controller of your account data: Telegram identity, business information, Instagram connection, billing, referrals, support.
- We are a processor (GDPR Article 28) for the content you entrust to us (photos, videos, voice messages), in which other people may appear — your customers, staff or guests. For that content, you (or the business you represent) are the controller; we act only on your instructions, under the Data Processing Agreement (DPA) attached to the Terms.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Telegram identity | Telegram ID, display name and username, language | Telegram, when you start the bot |
| Business information | venue name, industry, city, services and prices, languages, brand rules (tone, banned words) | you, via the questionnaire |
| Instagram / Facebook connection | professional account ID and name, linked Facebook Page, access token (stored encrypted), expiry date | Meta, when you connect your account |
| Instagram insights | reach, impressions, followers, post performance | Meta (Instagram API), for monthly reports |
| Content sources | link to a Google Drive, Yandex Disk or Dropbox folder | you |
| Content | photos, videos, voice messages, texts and file metadata (date, device, sometimes location) | you or your cloud storage |
| Produced content | carousels, stories, reels, captions, hashtags, plans, edit history | generated by Socialoop |
| Messages | messages to the bot, feedback on content ("publish / fix / skip") | you |
| Referrals | who invited you, whom you invited, free months | the service |
| Payment (paid phase) | plan, subscription status, Stripe customer ID | Stripe — we never see or store your card details |
| Technical logs | internal IDs, errors, timestamps — no names or content | the service |
We do not collect phone numbers or email addresses in the bot (unless you email us; the payment provider may ask for them for invoicing).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: analysing content, producing and publishing posts, reports | performance of contract |
| Connecting to and publishing on Instagram / Facebook via Meta's official API | performance of contract |
| Invoicing and accounting | legal obligation; performance of contract |
| Referral programme | performance of contract |
| Demo reminders (up to 5 messages over 14 days, then one after 45 days) | legitimate interest; you can stop them at any time |
| Security, abuse prevention, error detection | legitimate interest |
| Improving the service using aggregated statistics and your feedback | legitimate interest |
We do not use your content to train AI models, and our AI providers do not either under our contracts with them. We do not sell your data or use it for advertising.
5. Artificial intelligence
Content is analysed by AI models (Claude, by Anthropic) to select images, suggest plans and write texts. No decision with legal effects on you is made solely by automated means. Depending on the mode you choose, each post waits for your approval ("With approval") or you approve the monthly plan ("Autopilot"). Socialoop does not generate realistic images of people or places: only your own photos and videos are used (EU AI Act, Art. 50).
6. Recipients and processors
Your data is accessible to authorised OUTLINE staff (support, the editor who reviews flagged content) and to the following providers under contract:
| Provider | Role | Data location |
|---|---|---|
| netcup GmbH | server, database, temporary storage | European Union (Germany) |
| Anthropic, PBC | AI image analysis and writing (Claude API) | United States — Standard Contractual Clauses |
| Meta Platforms Ireland Ltd | Instagram / Facebook publishing and insights | Ireland / United States — per Meta's policy |
| Telegram (Telegram FZ-LLC) | bot messaging | outside the EU — per Telegram's policy |
| Cloudflare, Inc. | domain, security, temporary links to images being published | global — Standard Contractual Clauses |
| Stripe Payments Europe Ltd (paid phase) | card payments | Ireland / United States |
| Google, Yandex, Dropbox | reading the folders you share with us | depends on the service you choose |
Instagram fetches images to publish from a web address: for a few minutes, a copy of each image is reachable through a random, unlisted link that is deleted right after publishing.
For transfers outside the European Union we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can request a copy at privacy@socialoop.me.
We may disclose data to authorities where required by law.
7. Retention
| Data | Period |
|---|---|
| Account (Telegram identity, language, role) | while the account is active, then 30 days |
| Business information, brand guide | while the account is active |
| Instagram / Facebook tokens | until you disconnect or delete your account |
| Working copies of photos and videos | 30 days after publishing; unused material: 60 days. Originals stay in your storage |
| Files of produced posts | 30 days |
| Post texts, plans and statistics | 12 months |
| Demo not followed by a subscription | 30 days |
| Technical logs | 30 days |
| Billing data | 10 years (French accounting law) |
| Backups | 30 days maximum |
8. Security
Server in the European Union, key-only access, firewall, automatic security updates; encrypted access tokens; plan pages reachable only through long, random, expiring links; logs without personal data; staff access limited to what is necessary. If a data breach poses a risk, we notify the CNIL within 72 hours and inform you without undue delay.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and may set instructions for your data after your death. To exercise them:
- in the bot: /delete_data (deletion) or /export_data (copy of your data);
- by email: privacy@socialoop.me (we may ask you to confirm your identity via the bot).
We reply within one month. You can lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.
If you appear in content published by one of our customers, please contact that customer first (the controller); we will assist them, and you can also write to us.
10. Instagram / Facebook data deletion
To delete the data Socialoop obtained through Meta:
- send /delete_data in the bot and confirm — or email privacy@socialoop.me;
- or remove Socialoop's access in Instagram: Settings → Security → Apps and websites (or in Facebook: Settings → Apps and websites); we then delete your Instagram tokens and data within 30 days.
Posts already live on your account stay on Instagram: you can delete them in Instagram or ask us to via the bot.
11. Cookies
Socialoop pages use no advertising cookies and no third-party analytics. Only strictly necessary elements may be used; they do not require consent.
12. Changes
We may update this policy. For significant changes we will notify you in the bot at least 15 days in advance.