The short version

We collect what we need to run sumoboat: your account, the posts you write, and the social accounts you connect.
We only post, read or change anything on your social accounts when you (or someone on your team, or an AI assistant you've connected) asks us to.
We don't sell your data, and we don't use your content or your connected accounts' data to train AI models.
Disconnect a social account and we delete its access tokens straight away. Delete your account and we delete your data within 30 days.

Who we are

sumoboat ("sumoboat", "we", "us") is operated by [TODO: company legal name], registered in [TODO: country of incorporation] under number [TODO: company registration number], with its registered address at [TODO: registered address]. We are the controller of the personal data described in this policy.

When a business uses sumoboat to manage its social media, the content and audience data in its workspace belong to that business. For that data we act on the business's behalf.

This policy covers our website (https://sumoboat.com), the sumoboat app, our API and MCP connectors, and our free tools.

What we collect

Information you give us

Account details: name, email address, password (stored only as a salted hash) or your Google sign-in profile, and your profile picture.
Workspace and team: workspace names, brands, teammates you invite, their roles and approval settings.
Content: posts, drafts, threads, captions, comments, images and videos you upload, schedules, and brand assets (logos, colours, fonts) you add or import.
Billing: plan, billing name and address, and invoices. Card details go straight to our payment processor; we never see or store your full card number.
Communications: messages you send to support, survey answers, and waitlist or demo requests.

Information we collect automatically

Usage data: the pages and features you use, actions you take (for example scheduling or approving a post), and timestamps.
Device and log data: IP address, browser, operating system, approximate location derived from your IP, and error logs.
Cookies: strictly necessary cookies to keep you signed in and secure, plus optional analytics cookies only if you allow them. See our Cookie Policy.

Information from third parties

Google, if you sign in with Google: your name, email address and profile picture.
Social networks you connect: see the next section.
Stores and booking tools you connect (for example Shopify, Stripe or Calendly) for sales tracking: orders, revenue and bookings attributed to your posts' tracked links. We don't need, and don't ask for, your customers' payment details.

When you connect a social account (X, LinkedIn, Facebook Page, Instagram, Threads or TikTok), the network asks you to approve specific permissions. We use only what is needed to provide the features you use:

Network	What we access	Why
X	Your profile (id, username, name, picture); permission to post and upload media	Publish and schedule posts and threads you create
LinkedIn	Your name, profile picture and email (OpenID Connect); permission to post as you; if you connect a Company Page, permission to post as the Page	Publish posts you create
Facebook Pages	The list of Pages you manage, Page access tokens, Page engagement data; permission to post to Pages you choose	Publish to the Pages you select and show post performance
Instagram	Your professional account's id, username and profile; permission to publish content; post insights	Publish posts and show post performance
Threads	Your profile; permission to publish	Publish posts you create
TikTok	Basic profile; permission to upload and publish videos and photos	Publish content you create

Access tokens are encrypted before we store them. We never ask for, or store, your social network passwords. You can disconnect an account at any time in Settings → Channels, and you can also revoke our access from the network's own settings. Either way, we stop accessing the account and delete its tokens.

Your use of each network is also governed by that network's own terms and privacy policy. We are not affiliated with, or endorsed by, X Corp., LinkedIn, Meta, or TikTok.

How we use your information

To provide sumoboat: create your account, adapt and publish your posts, schedule them, run approvals, and show what each post earned.
To pick posting times and make suggestions based on your own accounts' past performance.
To process payments and manage your subscription.
To keep sumoboat secure: prevent fraud and abuse, enforce our Terms, and debug problems.
To communicate with you: service and security emails, replies to support, and (only if you agree, and you can opt out any time) product news.
To improve sumoboat using aggregated or de-identified usage data.
To meet legal obligations, such as tax and accounting rules or lawful requests from authorities.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising.

Legal bases (UK, EEA and similar laws)

Contract: to provide the service you signed up for, including publishing to accounts you connect.
Legitimate interests: security, fraud prevention, product analytics on de-identified data, and improving the service, balanced against your rights.
Consent: optional analytics cookies and marketing emails. You can withdraw consent at any time.
Legal obligation: record-keeping, tax and responding to lawful requests.

AI features and AI agents

Some features use AI models, for example drafting captions, suggesting posts, generating images, or summarising what sold. When you use them, the content needed for the request (such as your draft, brand details or post performance) is sent to the AI provider that powers that feature, processed to return a result, and not used by that provider to train its models under our agreements with them.

If you connect an AI assistant (such as Claude, Muse or Grok) to sumoboat through our connector or API, that assistant can read and act on your workspace within the permissions you grant. Nothing is published without the approval rules you set. Data you share in the assistant itself is governed by that assistant provider's privacy policy.

We don't use your content, or data from your connected social accounts, to train AI models.

Google user data

If you sign in with Google, we receive your name, email address and profile picture, and use them only to create and secure your sumoboat account. sumoboat's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, sell it, or use it to train AI models.

Your workspace: teammates and clients you invite can see the content and connected accounts in that workspace, according to their role.
Social networks: when you publish, we send your content to the networks you chose.
Service providers who process data for us under contract and only on our instructions:

Provider	Purpose	Location
Cloudflare, Inc.	Hosting, database, file storage, queues, security and DDoS protection	Global network
Google LLC	Sign in with Google; web fonts on our marketing site	USA
[TODO: payment processor]	Payments and subscriptions	[TODO]
[TODO: email provider]	Transactional and service emails	[TODO]
[TODO: AI model providers]	AI writing and image generation features	[TODO]
[TODO: analytics, if added]	Website analytics, only with your consent	[TODO]

Legal and safety: when required by law, or to protect the rights, safety and property of our users, the public or sumoboat.
Business transfers: if we are involved in a merger, acquisition or sale of assets, your data may transfer, subject to this policy.

International transfers

Our providers may process data outside your country, including in the United States. Where the law requires it, we rely on adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards.

How long we keep it

Account and workspace data: for as long as your account is open.
Social account tokens: until you disconnect the account, revoke access, or delete your account. They are then deleted immediately.
After you delete your account: we delete your personal data and content within 30 days, and it is purged from backups within a further 30 days.
Logs: up to 30 days, unless needed longer to investigate a security issue.
Billing records: as long as tax and accounting law requires (typically up to 7 years).

See Data deletion for how to delete your data.

Your rights

Depending on where you live, you can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. California residents can also ask what personal information we collect and know that we don't sell or share it. We won't treat you differently for using these rights.

Email privacy@sumoboat.com from the address on your account. We reply within 30 days. If you're in the UK or EEA, you can also complain to your data protection authority, such as the UK ICO.

If your data is in a workspace run by a business, we may refer your request to that business.

Security

We encrypt data in transit (TLS) and encrypt social access tokens at rest. We restrict internal access to the people who need it and log access to production systems. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the authorities as the law requires.

Children

sumoboat is for businesses and is not meant for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

Changes to this policy

We'll update this page when our practices change and change the "last updated" date. For material changes we'll tell you by email or in the app before they take effect.

Contact

[TODO: company legal name], [TODO: registered address].
Privacy questions: privacy@sumoboat.com

[TODO: EU/UK representative if required, or remove]