Your privacy is very important to us. This Privacy Policy applies to Social24 CRM (the "Service") operated by SOCIAL 24 LTD, a private limited company incorporated in the United Kingdom ("Social24", "we", "us"), and describes what information we collect, how we use and protect it, and the choices you have. The Service may be made available through partner products owned by Social 24 LTD (such as NanoInfluencer); Social 24 LTD acts as a single data controller for the processing described in this Policy across its products.
We have a few fundamental principles:
• We don't ask you for personal information unless we truly need it to provide the Service.
• We don't share your personal information with anyone except to comply with the law, provide the Service through vetted processors, or protect our rights.
• We don't sell your personal information or your email data.
• We don't store personal information on our servers unless it's required for the ongoing operation of the Service.
Account information: when you sign up, we collect your name and email address. We also collect workspace and team member information you create within the Service.
Usage information: like most website operators, we collect non-personally-identifying information of the sort that web browsers and servers typically make available, such as browser type, language preference, and the date and time of each visit, to better understand how visitors use the Service.
When you connect a Gmail, Outlook, Microsoft 365, or IMAP/SMTP mailbox to the Service, you authorize us (through the provider's official OAuth consent flow, and via our email infrastructure provider Nylas) to access and process the following data from that mailbox, strictly to provide the Service:
• Email messages, headers, snippets, and folder membership (such as Inbox and Sent)
• Message attachments
• Sender and recipient names and email addresses, used to build contact records
• Read/unread state, so that synchronization reflects your mailbox
• The OAuth access and refresh tokens required to maintain the connection
How this data is used: mailbox synchronization and conversation views, contact management and enrichment, outreach and sequence sending on your behalf, reply detection, delivery analytics, and AI-assisted suggestions you explicitly enable. This data is stored in your workspace and is not used to build advertising products, is not sold, and is not shared with third parties except the processors listed below.
Security of credentials: OAuth access and refresh tokens are encrypted with AES-256-GCM before storage. Messages and attachments are stored in access-controlled infrastructure.
Your control: you can disconnect a mailbox at any time, which stops all access and deletes the stored tokens. You can also revoke Social24's access from your Google or Microsoft account security settings. Ingested email data is deleted when you delete the mailbox, following our data retention practices.
Social24's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use personal information only to operate and improve the Service. We disclose potentially personally-identifying information only to employees, contractors, and affiliated organizations that (i) need to know that information to process it on our behalf or to provide services available through the Service, and (ii) have agreed not to disclose it to others. These processors include cloud hosting and storage vendors, our email infrastructure provider (Nylas), email delivery providers, and AI processing vendors strictly for the features you enable.
We will not rent or sell personal information to anyone. Other than as described above, we disclose personal information only in response to a subpoena, court order, or other governmental request, or when we believe in good faith that disclosure is reasonably necessary to protect the property or rights of Social24, third parties, or the public at large.
When you enable AI-assisted features, message content and contact context may be processed by our AI vendor solely to produce the suggestions you requested. This processing is opt-in per feature, and we do not allow vendors to use your data to train their general models.
We use cookies to identify and track visitors, their usage of the Service, and their access preferences, including authentication session cookies. Visitors who do not wish to have cookies placed should set their browsers to refuse cookies, with the drawback that certain features of the Service may not function properly.
We retain your data for as long as your account is active or as needed to provide the Service. When you delete a mailbox or your account, we delete the associated mailbox credentials and ingested data in accordance with our data retention practices, except where retention is required by law.
We take all measures reasonably necessary to protect against unauthorized access, use, alteration, or destruction of potentially personally-identifying information, including encryption of mailbox credentials in transit and at rest.
Our operations are located primarily in the United States, Canada, and Hong Kong. If you provide information to us, the information may be transferred outside of the European Union. By providing personal information to us, you are consenting to its storage and use as described herein. Where the GDPR applies, you have the right to access, rectify, export, and erase your personal data — contact us to exercise these rights.
You must be at least 16 years old to use the Service. We do not knowingly collect information from children under 16. If you are under the age of 16, please do not submit any personal data through the Service.
Although most changes are likely to be minor, we may change this Privacy Policy from time to time at our sole discretion. We encourage you to frequently check this page for changes. Your continued use of the Service after any change constitutes your acceptance of such change.
If you have any questions or comments about this Privacy Policy, or wish to exercise your data rights, please contact [email protected].
Last revised: October 5, 2025