Privacy policy

Information we collect

We collect information you provide when you request access, create an account, join a workspace, contact us or use the service. This can include your name, email address, profile image, business and workspace details, account role, subscription details, messages, and the images, videos, ad copy and other content you upload. Uploaded content may contain information about other people.

When an administrator connects Meta or Shopify, we receive information permitted by that connection. Depending on the connected service and features used, this includes account and business identifiers, Facebook Page and Instagram account names and images, advertising accounts and campaigns, ad sets, ads, creative content and media identifiers, available post engagement counts, and Shopify shop and product-catalog information. We store authorization credentials to operate the connection. We do not receive your Meta or Shopify password.

We also receive technical information needed to operate and secure the service, such as IP addresses, browser and device information, request logs, errors, session information and records of account activity. Our authentication and payment providers process information needed to sign you in and manage subscriptions. Payment-card information entered into a payment provider's checkout is handled by that provider.

How we use information

We use information to provide accounts and shared workspaces, prepare and store creative content, connect the services you select, perform actions authorized by workspace users, display available advertising information, manage subscriptions, respond to requests, investigate errors, prevent misuse and meet applicable legal obligations.

Creative records include their creator and revision history. Authorized members of the relevant workspace can access information made available within that workspace. Workspace administrators control membership and integration settings.

Saving a draft does not authorize us to publish or activate an advertisement. Supported advertising changes require a separate review and confirmation from an authorized workspace administrator.

Services and people we share information with

We use service providers to operate Cult Social, including Clerk for authentication, Vercel for application hosting, Neon for databases, Cloudflare for media storage and processing, and Stripe for billing where enabled. These providers receive information needed for their services.

When you connect Meta or Shopify, information passes between Cult Social and the connected service to carry out the actions you authorize. Each connected service also handles information under its own privacy policy and terms. Content you authorize for publication may become accessible through the destination platform according to that platform's settings.

We may disclose information to professional advisers, where required or authorized by law, to address fraud or security incidents, or in connection with a proposed business transaction subject to appropriate confidentiality protections.

Overseas processing

Cult Social uses cloud infrastructure and service providers that may process information outside Australia. Processing locations depend on the provider and service configuration, and can include the United States and other countries where our providers operate. We consider privacy and security protections when selecting providers and arranging access to information.

Cookies and local storage

We and our authentication provider use cookies and similar storage to support sign-in, security and service operation. Cult Social also stores interface preferences, unsaved-draft recovery information and upload-resumption information in your browser. Clearing browser storage can remove those local recovery records. Your browser controls can restrict cookies or storage, but doing so may prevent parts of the service from working.

Storage, security and retention

We use access controls, workspace isolation, encrypted connections and other technical measures to protect information. Access to private media uses authorized, time-limited links. No online service can guarantee absolute security.

We retain information for as long as reasonably needed to provide the service and for applicable security, recordkeeping and legal purposes. Relevant factors include an active account or workspace, an unresolved request or advertising operation, billing obligations and disputes. Backups and operational logs may remain for a limited period after removal from active systems. When information is no longer required, we take reasonable steps to delete or de-identify it.

Access, correction and deletion

Contact info@cultsocial.io to request access to, correction of, or deletion of personal information held by Cult Social. Include the account email address and workspace name, and describe the request. Do not send passwords, access tokens or payment-card details. We may ask for information needed to verify your identity and authority. If a legal exception applies, we will explain what we can do and why any information must be retained.

A workspace administrator can disconnect Meta or Shopify in the integration settings to stop future use of that connection. Disconnecting does not delete advertisements, posts or products already held by the connected platform, and it is not the same as requesting deletion of a Cult Social workspace and its records. You can also remove Cult Social's access through the connected platform's settings.

For a Meta-related deletion request, contact the address above and identify the connected account or workspace. Meta may also send a deletion request through its supported integration process. We will review the request, verify the relevant account and remove information where required. Deleting information from Cult Social does not delete information independently held by Meta or other third parties.

info@cultsocial.io

Privacy complaints

Send a privacy complaint to info@cultsocial.io, describing the concern and how to contact you. We will investigate and aim to respond within 30 days. If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints.

OAIC privacy complaints

Changes to this policy

We may update this policy as the service or our practices change. The published policy will show its effective date. We will provide additional notice where a material change or applicable law requires it.