This policy explains how Shankya AI LLP ("we") handles personal data in SocialPulse, a social media management service for agencies and businesses, under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules.
For your own account data we are the data fiduciary. For content an agency manages for its clients, the agency decides why it is processed and we process it on the agency's instructions.
1.What we collect
We collect only what the service needs. This table lists everything we hold about you.
| Category | What | Why |
|---|---|---|
| Account | Name, email address, password (stored only as a secure hash), role, the version of these terms you accepted and when | To create and secure your account (required) |
| Age | Whether you are 18 or older. For anyone under 18: a parent or guardian’s email, name, relationship and the date they approved | To meet the law on children’s data (required) |
| Sign-in and security | IP address, browser type, sign-in attempts, active sessions, two-factor settings | To keep accounts secure and prevent misuse (required) |
| Workspace and clients | Agency name, contact email, client and brand names, brand profiles (voice, colours, products) | To run your workspace (required) |
| Connected social accounts | Account id and name on the platform, access tokens (encrypted), permissions you granted, and when you connected the account and agreed to this policy; for Facebook and Instagram, also your Facebook user id. Details per platform below | To publish and read results on your behalf (optional) |
| Content and media | Posts, captions, schedules, approvals, designs and brand kits (colours, fonts, logos, guidelines), images and videos you upload. Location and camera data are removed from JPEG, PNG and WebP photos when uploaded; GIFs and videos are stored as uploaded | To create and publish your content (optional) |
| Analytics | Post and account metrics returned by the platforms (likes, reach, follower counts). We do not build profiles of your audience | To report results (optional) |
| AI features | Text you give the AI (drafts, briefs, brand kit), photos you upload or edit with AI (including the area you select), and the results | To provide AI features when you use them (optional) |
| Billing | Plan, amounts, payment and order references, payment status, your UPI ID when you pay by UPI. Card and bank details are entered on Razorpay and never reach us | To take payments and meet tax law (paid plans) |
| Communications | Emails and in-app notifications we send you, your notification settings, delivery problems (for example bounces) | To tell you about your account and posts |
| Privacy records | Consents you give or withdraw, your data requests and complaints | To prove consent and handle your rights |
We do not use advertising or analytics trackers, and we do not sell personal data.
2.How we use it
- To provide the service you signed up for: your workspace, publishing, scheduling, analytics and AI features.
- To keep the service secure: detecting suspicious sign-ins, limiting abuse, keeping audit logs.
- To take payments and keep the financial records tax law requires.
- To email you about your account, billing and posts. Marketing emails are sent only if you opt in, and you can opt out at any time in Settings, Privacy & data.
- To meet legal obligations and respond to lawful requests from authorities.
3.AI features
When you use an AI feature, the text and images you give it are sent to an AI model to produce the result. We use Amazon Bedrock by default, which does not use your inputs to train its models. Images may also be made by the AI image services in the table below, and Google Gemini is a fallback; their terms for business API use apply, and we use only the AI services listed there.
AI results can be wrong. Review them before publishing. AI-generated images may need to be labelled as such under Indian law and platform rules.
4.Data from social platforms
When you connect a social account, the platform asks you to allow SocialPulse to act for that account. We receive only what the permissions you approve allow, and use it only to publish the posts you create or schedule, show you their results and keep the connection working. We ask only for the permissions of the features your workspace uses, and we record when you connected the account, which permissions you were asked for and the version of this policy at the time. We do not sell it, use it for advertising, or let people at SocialPulse read it except to fix a problem you report or where the law requires. If you ask the AI for insights on your results, those results are sent to the AI model as described above.
| Platform | What we receive | How long we keep it |
|---|---|---|
| Facebook Pages and Instagram (Meta) | Your Facebook user id (only to act on a disconnection or deletion request Facebook sends us), the Pages you manage and their access tokens, linked Instagram professional accounts (id, username), and the posts we publish with their results (reach, reactions, comments, followers) | Access tokens: until you disconnect the account or remove SocialPulse on the platform. Account details and results: until you or your workspace delete them, or you delete your account. A deletion request sent through Facebook deletes these accounts at once |
| Your LinkedIn member id and name (LinkedIn’s sign-in profile), an access token, and the results of posts we publish where you allow it (impressions, reactions, followers) | Access tokens: until you disconnect the account or remove SocialPulse on the platform. Account details and results: until you or your workspace delete them, or you delete your account | |
| X (Twitter) | Your account id, username and name, access and refresh tokens, and the posts we publish with their results | Access tokens: until you disconnect the account or remove SocialPulse on the platform. Account details and results: until you or your workspace delete them, or you delete your account |
| YouTube (Google), once available | Your channel id and name, access and refresh tokens, and the videos we upload for you with their results | Access tokens: until you disconnect the account or remove SocialPulse on the platform. Account details and results: until you or your workspace delete them, or you delete your account |
| TikTok, once available | Your TikTok account id and display name, access and refresh tokens, and the videos we post for you with their results | Access tokens: until you disconnect the account or remove SocialPulse on the platform. Account details and results: until you or your workspace delete them, or you delete your account |
You can disconnect an account at any time (Accounts, Disconnect), or remove SocialPulse in the platform's own settings. How to delete this data, and what is deleted when, is on the data deletion page.
Google user data. SocialPulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. SocialPulse uses YouTube API Services to publish to YouTube channels you connect: by connecting one you agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. You can remove SocialPulse's access at any time in your Google Account settings. YouTube connections are not available yet; this applies once they are.
6.Where your data is stored
Your account, workspace content, files and backups are stored in India: Amazon Web Services Mumbai (ap-south-1), backups included; when cross-Region backup copies are enabled, the copies are kept in Hyderabad (ap-south-2), also in India.
These services may process data outside India, as the table above describes: Amazon Bedrock (AWS); Amazon Rekognition (AWS); Black Forest Labs (FLUX); fal.ai; Google (Gemini API); Cloudflare; Grafana Cloud; Sentry; Tavily (web search); Serper (web search); Amazon Bedrock image models (AWS, United States). AI services process your request and keep nothing after it; error reports and monitoring hold technical records with internal ids only. The DPDP Act allows these transfers; we will follow any restriction the Government of India notifies.
7.How long we keep it
- Account, workspace and content: while your account is active, until you or your workspace asks for deletion.
- Connected social accounts: until you disconnect them (their access tokens are deleted at once) or delete your account. A deletion request sent through Facebook deletes the Facebook and Instagram accounts you connected at once.
- Sign-in attempts: 90 days. Sessions: 30 days. One-time links (password reset, verification, invites, guardian approval): 7 days.
- In-app notifications: 180 days. Data sent by social platforms about your accounts: 30 days.
- AI image jobs: about 13 months. AI campaign-planning runs: 7 days.
- Deleted files: removed from storage within 30 days.
- Team audit logs: 2 years. Billing and payment records: 7 years, as tax and accounting law requires.
- Backups: daily backups for 35 days and monthly backups for 12 months, then deleted.
8.Your rights
Under the DPDP Act you can:
- get a summary and a copy of the personal data we hold about you;
- ask us to correct or delete it, and withdraw any consent you gave (as easily as you gave it);
- nominate someone to use these rights for you if you die or cannot;
- raise a complaint with us, and then with the Data Protection Board of India.
Use Settings, Privacy & data when signed in, or write to our grievance officer (below). We aim to complete requests within 30 days. Some data, such as billing records, must be kept by law even after you ask for deletion; content you created for a workspace stays with that workspace without your name.
Step-by-step instructions for deleting your account, disconnecting social accounts and removing SocialPulse from Facebook, Instagram, LinkedIn, X, Google or TikTok are on the data deletion page.
9.Children
SocialPulse is meant for businesses. Anyone under 18 can use it only after a parent or legal guardian approves the account from a link we email them. Until then the account stays locked, and it is deleted if they decline or do not respond within 7 days. We do not track children's behaviour, show them targeted advertising or send them marketing emails. A parent or guardian can ask us to delete the account at any time.
10.Security
Data is encrypted in transit (HTTPS) and at rest (database and file storage). Passwords are stored as one-way hashes and social account tokens are encrypted. Access is limited by role, and changes to roles and access are recorded in audit logs. No system is perfectly secure; if a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.
12.Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. [Counsel to confirm the notice period before a change takes effect]
13.Contact and grievance officer
Grievance officer: [Grievance officer name], [grievance officer email].
Shankya AI LLP, [Registered office address].
We respond to complaints within 30 days. If you are not satisfied, you can approach the Data Protection Board of India.