Privacy Policy — Socialoop
Version of 26.10.2026
Last updated: 26 October 2026
Socialoop (socialoop.me) is an AI assistant for social media: you share your photos and videos with us (via a link to your cloud storage or through our Telegram bot), Socialoop selects the best material, designs posts, writes captions, suggests a publishing plan and, if you allow it, publishes to your Instagram account.
This policy explains what data we process, why, for how long, who we share it with and how to exercise your rights. It covers the Telegram bot, the Socialoop web pages and the Socialoop app on the Meta platform (Instagram / Facebook).
1. Who we are
Controller: OUTLINE, a French SASU with share capital of 1 €, registered with the RCS of Nice under no. 924 870 298, registered office: 102 avenue Saint-Lambert, 06100 Nice, France. Privacy contact: [email protected].
Socialoop is for businesses and professionals only (venues, freelancers, social media managers). It is not intended for anyone under 18.
2. Two different roles
- We are the controller of your account data: Telegram identity, business information, Instagram connection, billing, referrals, support.
- We are a processor (GDPR Article 28) for the content you entrust to us (photos, videos, voice messages), in which other people may appear — your customers, staff or guests. For that content, you (or the business you represent) are the controller; we act only on your instructions, under the Data Processing Agreement (DPA) attached to the Terms.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Telegram identity | Telegram ID, display name and username, language | Telegram, when you start the bot |
| Business information | venue name, industry, country and city (both optional), time zone for posting, services and prices, languages, brand rules (tone, banned words) | you, via the questionnaire |
| Instagram / Facebook connection | professional account ID and name, linked Facebook Page, access token (stored encrypted), expiry date | Meta, when you connect your account |
| Instagram insights | reach, impressions, followers, post performance | Meta (Instagram API), for monthly reports |
| Content sources | link to a Google Drive, Yandex Disk or Dropbox folder | you |
| Content | photos, videos, voice messages, texts and file metadata (date, device, sometimes location) | you or your cloud storage |
| Produced content | carousels, stories, reels, captions, hashtags, plans, edit history | generated by Socialoop |
| Messages | messages to the bot, feedback on content ("publish / fix / skip") | you |
| Support | problem descriptions and screenshots sent via the "Help" button, our team's replies; setup steps completed and errors encountered | you; the service |
| Referrals | who invited you, whom you invited, free months | the service |
| Content notices | name, email address, reason and location of the reported content | the person reporting (socialoop.me/report) |
| Payment (paid phase) | plan, subscription status and dates; Stripe customer ID or, for Telegram Stars payments, the Telegram payment ID and the amount in Stars; for card payments, the country of the card and of the billing address — kept only as a note if they fall under a higher price list than the country of your business | Stripe or Telegram — we never see or store your card number or other card details, except its country |
| Email address (optional) | the address you give in the bot for invoices and reminders about your subscription | you, in the bot |
| Technical logs | internal IDs, errors, timestamps — no names or content | the service |
| Declarations and warnings | what you confirmed in the bot: that you use Socialoop for your work or business, that you hold the rights to your content and the consent of people shown, that neither you nor the business is in an area we don't serve, that you check local law yourself if you skip the country; which version of the Terms you accepted and when; risk warnings we gave you | you, in the bot; the service |
| Country of connection | the country from which you open our pages (connecting Instagram, uploading, account page), as determined by Cloudflare from your IP address; we do not store the address — only a note if the country is Russia or Belarus, or if it falls under a higher price list than the country of your business | Cloudflare |
We do not collect phone numbers in the bot. An email address only if you give it yourself (optional) — for invoices and reminders about your subscription, never for newsletters; you can delete it in the bot at any time. The payment provider may also ask for it for invoicing.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: analysing content, producing and publishing posts, reports | performance of contract |
| Connecting to and publishing on Instagram / Facebook via Meta's official API | performance of contract |
| Invoicing and accounting | legal obligation; performance of contract |
| Emails about your subscription, if you gave an address: a reminder before the free period ends, invoices | performance of contract |
| Referral programme | performance of contract |
| Handling and answering notices of illegal content (Regulation (EU) 2022/2065, Article 16) | legal obligation |
| Demo reminders (up to 5 messages over 14 days, then one after 45 days) | legitimate interest; you can stop them at any time |
| Security, abuse prevention, error detection | legitimate interest |
| Support: helping you if you get stuck during setup (step tracking, alert to our team) | legitimate interest |
| Improving the service using aggregated statistics and your feedback | legitimate interest |
| Checking that the service is not used by businesses or users in areas we don't serve under EU restrictive measures: your declarations, the country of connection and of payment, signs in the material you send (for example prices in roubles) — reviewed by a person, no automatic decision | legal obligation (EU restrictive measures); legitimate interest |
| Applying the price for the country of your business and preventing misuse of regional prices: the country in the questionnaire, the country of connection, of the card and of the billing address; a note to our team if they don't match; if you give a country with a lower price, the previous price keeps applying until it is checked — any price change is decided by a person | performance of contract; legitimate interest |
| Keeping proof of your declarations and of the warnings we gave, including after your account is deleted | legitimate interest: establishing, exercising or defending legal claims (GDPR Art. 17(3)(e)) |
We do not use your content to train AI models, and our AI providers do not either under our contracts with them. We do not sell your data or use it for advertising.
5. Artificial intelligence
Content is analysed by AI models (Claude, by Anthropic) to select images, suggest plans and write texts. No decision with legal effects on you is made solely by automated means. Depending on the mode you choose, each post waits for your approval ("With approval") or you approve the week's or month's posts in one go ("Autopilot"). Socialoop does not generate realistic images of people or places (EU AI Act, Art. 50). Your posts are built from your own photos and videos; we may add licensed mood photos from stock libraries (Unsplash, Pixabay: food, textures, nature, decor), never presented as your work or your customers.
6. Recipients and processors
Your data is accessible to authorised OUTLINE staff (support, the editor who reviews flagged content) and to the following providers under contract:
| Provider | Role | Data location |
|---|---|---|
| netcup GmbH | server, database, temporary storage | European Union (Germany) |
| Anthropic, PBC | AI image analysis and writing (Claude API) | United States — Standard Contractual Clauses |
| Meta Platforms Ireland Ltd | Instagram / Facebook publishing and insights | Ireland / United States — per Meta's policy |
| Telegram (Telegram FZ-LLC) | bot messaging, Telegram Stars payments | outside the EU — per Telegram's policy |
| Cloudflare, Inc. | domain, security, routing of temporary links to images being published | global — Standard Contractual Clauses |
| Google Ireland Ltd | storage of encrypted backups (Google Drive) | Ireland / United States — SCCs / DPF |
| Stripe Payments Europe Ltd (paid phase) | card payments | Ireland / United States |
| Brevo (Sendinblue SAS) | sending emails (reminders, invoices), if you gave an address | European Union (France, Germany, Belgium) |
| Google, Yandex, Dropbox | reading the folders you share with us | depends on the service you choose |
Instagram fetches images to publish from a web address: until publishing, and for at most 24 hours, a copy of each image is reachable on our server through a random, unlisted link that is deleted right after publishing.
For transfers outside the European Union we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses. You can request a copy at [email protected].
We may disclose data to authorities where required by law.
7. Retention
| Data | Period |
|---|---|
| Account (Telegram identity, language, role) | while the account is active, then 30 days |
| Email address | until you delete it in the bot or delete your account |
| Business information, brand guide | while the account is active |
| Instagram / Facebook tokens | until you disconnect or delete your account |
| Working copies of photos and videos | 30 days after publishing; unused material: 60 days. Originals stay in your storage |
| Files of produced posts | 30 days |
| Post texts, plans and statistics | 12 months |
| Demo not followed by a subscription | 30 days |
| Technical logs | 30 days |
| Content notices | 12 months after the decision |
| Billing data | 10 years (French accounting law) |
| Legal record after account deletion: dates of consent and the version accepted, declarations, region notes, risk warnings | 6 years after deletion |
| Backups (encrypted) | daily: 30 days; monthly: 6 months |
8. Security
Server in the European Union (working copies also on OUTLINE work devices, access limited to staff), key-only access, firewall, automatic security updates; encrypted access tokens; plan pages reachable only through long, random, expiring links; backups encrypted before being stored in the cloud; logs without personal data; staff access limited to what is necessary. If a data breach poses a risk, we notify the CNIL within 72 hours and inform you without undue delay.
9. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and may set instructions for your data after your death. To exercise them:
- in the bot: /delete_data (deletion) or /export_data (copy of your data);
- by email: [email protected] (we may ask you to confirm your identity via the bot).
We reply within one month. You can lodge a complaint with the CNIL (www.cnil.fr) or your local supervisory authority.
If you appear in content published by one of our customers, please contact that customer first (the controller); we will assist them, and you can also write to us.
10. Instagram / Facebook data deletion
To delete the data Socialoop obtained through Meta:
- send /delete_data in the bot and confirm — or email [email protected];
- or remove Socialoop's access in Instagram: Settings → Security → Apps and websites (or in Facebook: Settings → Apps and websites); we then delete your Instagram tokens and data within 30 days.
Posts already live on your account stay on Instagram: you can delete them in Instagram or ask us to via the bot.
After deletion we keep only a minimal legal record (section 7): your declarations, the version of the Terms you accepted and the warnings we gave — to defend against claims. Everything else is deleted.
11. Cookies
Socialoop pages use no advertising cookies and no third-party analytics. Only strictly necessary elements may be used; they do not require consent.
12. Changes
We may update this policy. For significant changes we will notify you in the bot at least 15 days in advance.