Privacy Policy

Effective Date: April 2026

Overview

This Privacy Policy describes how SocialRouter ("SocialRouter," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with our unified API for social media data extraction (the "Services"). It applies to API customers, dashboard users, visitors, and to data subjects whose public profile information is processed through the Services on behalf of our customers.

This policy is updated regularly to reflect changes in our data processing practices and regulatory requirements.

Global coverage: this policy covers both European (GDPR) and California (CCPA/CPRA) privacy requirements. EU users should focus on GDPR sections; California residents should also review the California Privacy Rights section.

Two Distinct Roles

SocialRouter processes personal data in two different capacities, and the rights and responsibilities differ in each:

As a data controller

For information about our customers (account holders, API users, dashboard visitors), SocialRouter is the data controller. We decide why and how this data is processed.

As a data processor

For data extracted via the API on behalf of a customer (for example, public profile information returned by an extraction request), SocialRouter acts as a data processor. The customer is the controller and is responsible for establishing a lawful basis for the processing, providing notice to data subjects where required, and honoring data subject rights requests in respect of that data.

Data Controller Information

When acting as a controller, SocialRouter is responsible for your personal information:

Name: SocialRouter

Jurisdiction: France (European Union)

Privacy contact: contact form

Supervisory authority:Commission Nationale de l'Informatique et des Libertés (CNIL)

Information We Collect

Account information

When you create a SocialRouter account, we collect:

Email address (for authentication and essential communications)
Name and optional organization name
Password (hashed and encrypted, never stored in plain text) or OAuth provider identifier
API keys generated by you (stored hashed; the plaintext value is shown once at creation)
Account creation and last login timestamps
User unique identifiers (UUIDs)

Usage and billing data

To operate the platform and bill usage accurately, we collect:

Extraction logs (timestamp, target URL, extraction type, provider used, status, latency, credits consumed)
Credit balance and ledger entries
Stripe customer ID and subscription/payment metadata (we never store full card numbers)
Invoice and tax records
Rate-limit and abuse-prevention counters

Payment card data is handled exclusively by Stripe, our PCI DSS Level 1 compliant payment processor. SocialRouter never stores or processes credit card numbers.

Extraction data (processor role)

When you submit an extraction request, the URL you send is forwarded to a third-party data provider, which returns public profile information about the data subjects on that page. This data may include:

Name, headline, job title, employer, location
Public profile URL and avatar URL
Counts of public interactions (likes, comments, follows)
Other public fields exposed by the source platform

Extraction results are stored only for the time strictly necessary to deliver and cache them (see Data Retention). SocialRouter does not enrich this data, does not append contact information (email, phone), and does not use it for any purpose other than fulfilling and caching the customer's request.

Telemetry and security data

To maintain and protect the Services, we collect:

IP address, user agent, and request metadata for security and rate limiting
Error logs and stack traces
Performance metrics and request tracing
Product analytics events (page views, feature usage) via PostHog

How We Use Your Information

Service delivery

Legal basis: Contract performance — Article 6(1)(b) GDPR

Authenticate API requests and manage sessions
Route extraction requests to the appropriate provider and return normalized results
Cache results to deliver faster responses and lower costs
Process subscription payments and credit purchases
Provide the dashboard and account management tools

Service improvement

Legal basis: Legitimate interest — Article 6(1)(f) GDPR

Monitor system performance, reliability, and provider health
Identify and fix bugs and technical issues
Develop new features, providers, and routing strategies
Analyze aggregated usage patterns

Security and abuse prevention

Legal basis: Legitimate interest — Article 6(1)(f) GDPR

Detect and prevent unauthorized access and credential abuse
Enforce rate limits and detect anomalous extraction patterns
Protect platform integrity and customer data
Investigate violations of our Terms of Service

Communications

Legal basis: Legitimate interest — Article 6(1)(f) GDPR

Send transactional emails (password resets, security alerts, billing notifications)
Notify you of incidents, deprecations, or material changes to the Services
Respond to support requests

Legal compliance

Legal basis: Legal obligation — Article 6(1)(c) GDPR

Retain billing records for tax and accounting requirements (typically 10 years in France)
Respond to lawful requests from authorities
Comply with applicable data protection and consumer protection laws

SocialRouter never uses your data for advertising or sells it to third parties. Customer prompts, extraction targets, and extracted data are never used to train AI or machine learning models.

How We Share Your Information

Third-party service providers

We share information with trusted service providers who help us deliver the platform. All processors operate under GDPR-compliant Data Processing Agreements where applicable.

Service	Purpose
Supabase	Database, authentication, and file storage
Stripe	Payment processing, subscriptions, and invoicing
Vercel	Application hosting and CDN
Sentry	Error tracking and performance monitoring
PostHog	Product analytics and usage measurement
Data providers	Third-party scraping services (e.g. Lobstr, Evaboot, PhantomBuster, Captain Data, Apify, BrightData) that execute extractions on our behalf

The full, up-to-date list of data providers is available at /providers. Each request is routed to one provider only; the providers not used for a given request never see the request data.

Legal requirements

We may disclose your information when required by law or to:

Comply with legal processes (subpoenas, court orders)
Respond to lawful requests from government authorities
Protect our rights, property, or safety
Prevent fraud or abuse of the platform

No sale of personal data

SocialRouter does not sell, rent, or trade your personal information to third parties for their marketing purposes.

International Data Transfers

Some of our service providers and data providers are located outside the European Union. When data is transferred outside the EU, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and supplementary measures where required.

Stripe: Payment processing (SCCs, PCI DSS Level 1)
Sentry: Error tracking (SCCs)
Vercel: Hosting (SCCs; EU edge regions preferred where available)
PostHog: Product analytics (EU region hosting where applicable)
Data providers: Forwarded only when you submit an extraction (transfer mechanism varies by provider; see /providers)

Data Retention

While account is active

•Account and billing data retained
•Extraction logs retained for analytics and dispute resolution
•Cached extraction results: up to 24h (configurable per request)

After account deletion

•Personal data deleted within 30 days
•Billing records anonymized, kept for legal retention period
•Backups overwritten within 90 days

Logs and monitoring

Sentry error logs: 90 days
Access and request logs: 30–90 days per infrastructure provider policies
Cached extraction results: TTL set per extraction (default 1h, max 24h)

Data Security

Encryption in transit

TLS for all connections

Encryption at rest

Database and file storage

Row-level security

Isolated per-customer access

API keys are stored hashed; the plaintext key is shown only once at creation
Password hashing using industry-standard algorithms (irreversible)
Session management with automatic timeout controls
Role-based access control (user/admin separation)
Continuous error and security monitoring via Sentry
Data minimization: only essential fields are collected and stored

Your Privacy Rights

Right to access Article 15 GDPR

Access all personal data we hold about you. Log in to view your account, or contact us for a complete data export (provided within 30 days).

Right to rectification Article 16 GDPR

Update or correct your personal information through your account settings. For email changes, contact support.

Right to erasure Article 17 GDPR

Request complete deletion of your account and data. All data is permanently deleted within 30 days. This action is permanent and cannot be undone.

Right to data portability Article 20 GDPR

Receive your data in a structured, machine-readable JSON format upon request.

Right to restrict processing Article 18 GDPR

Request temporary suspension of data processing by contacting us.

Right to object Article 21 GDPR

Object to certain types of data processing — including processing based on legitimate interest — by contacting us.

Right to lodge a complaint

You have the right to file a complaint with your supervisory authority:

CNIL— Commission Nationale de l'Informatique et des Libertés

Website: cnil.fr

3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

Rights of Data Subjects in Extracted Data

If you are a data subject whose information was extracted by a SocialRouter customer (for example, you appeared in a list of likes or comments returned by an extraction), please note:

SocialRouter acts as a data processor for that data; the customer who initiated the extraction is the data controller
We retain extraction results only for short cache windows (see Data Retention) and do not use them for any independent purpose
To exercise rights of access, deletion, or objection, you should ideally contact the customer who initiated the extraction; we are happy to assist you in identifying the relevant controller where possible
You may also contact us directly through our contact form to request blocking of further processing of your data through our cache

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the CCPA and CPRA provide you with additional privacy rights.

Information we collect (CCPA categories)

Identifiers: Email addresses, names, account IDs, IP addresses, API keys
Commercial information: Subscription records, payment history, credit purchases
Internet or network activity: Request logs, error logs, usage analytics
Professional information: Public profile data extracted on behalf of customers

We do not collect sensitive personal information as defined by CCPA (e.g., Social Security numbers, precise geolocation, racial or ethnic origin, biometric data).

Your California privacy rights

Right to know: Request disclosure of what personal information we collect, use, and share
Right to delete: Request deletion of your personal information
Right to correct: Request correction of inaccurate personal information
Right to non-discrimination: We will not discriminate against you for exercising your rights

No sale or sharing: SocialRouter does not sell your personal information and does not share it for cross-context behavioral advertising.

To exercise your California privacy rights, submit a request via our contact form and select "CCPA Request" as the subject. We will verify your identity and respond within 45 days.

Cookies and Tracking

We use a minimal set of cookies, limited to what is necessary to operate the Services and to measure product usage:

Cookie	Purpose	Duration
Supabase auth	Session management for secure login	Session
theme	Light/dark theme preference	1 year
ph_*	PostHog product analytics (anonymous)	1 year

We do not use advertising or marketing cookies, and we do not share cookie data with third-party advertising networks.

Automated Processing

SocialRouter performs automated routing of extraction requests to data providers based on availability, price, and reliability. This routing does not produce legal effects or significantly affect customers under GDPR Article 22.

Children's Privacy

SocialRouter is a developer tool and is not intended for individuals under 16 years of age. We do not knowingly collect data from children. If we discover that a child has created an account, we will terminate the account and delete the data.

Changes to This Privacy Policy

When we update this Privacy Policy, we will:

Update the "Effective Date" at the top of this policy
Display in-app notification upon next login for material changes
Provide at least 30 days notice for material changes

If you don't agree with the changes, you may request account deletion or export your data before the effective date.

Contact Us

For privacy questions or rights requests, please use our:

Contact form

Select "Privacy Request" or "GDPR Request" as the subject for priority handling.

Acknowledgment

Within 48 hours

Full response

Within 30 days