Privacy Policy

1. Who is responsible

SocialNow, Amstelstraat 43G, 1017 DA Amsterdam, the Netherlands, Chamber of Commerce 77146301, is the controller for the data of visitors and account holders. For the data an account holder puts into their own workspace (their own customers, contacts, orders and team members) the account holder is the controller and SocialNow is the processor; section 12 applies to that.

Questions, requests and complaints about privacy: info@socialnow.nl. We respond within one month.

2. What we process

On the website we only process what you leave yourself:

• Name, e-mail address and phone number when you contact us through the form, e-mail or WhatsApp
• Name, e-mail address, country and (if you fill it in) phone number when you go to the demo through the welcome notice, so we can contact you about SocialNow later
• Company name and project information with a request or quote
• The content of your message

In SocialNow OS we additionally process:

• Your account: name, e-mail address, profile picture and how you sign in (Google, e-mail code, sign-in link or password); we never see your password itself
• Your workspace: company name, industry, website, branding (logo, colours, fonts, tone of voice) and everything you fill in yourself
• Team members: e-mail address, name and role of the people you invite
• What you create in the OS: pieces, texts, images, documents, campaigns and the chat conversations with Milo
• Payments: the credit bought and the payment status; card details go straight to Stripe and never reach us
• Technical data: IP address, browser and time, only for security, rate limiting and troubleshooting
• Your language choice and your agreement to the terms (version and time)

Data from sources you connect yourself, only for your own workspace:

• Odoo: customers, contacts, leads, orders, invoices and products, as your Odoo environment supplies them
• Meta (Facebook and Instagram): page and ad data, statistics and the posts you publish through the OS
• Google (Ads, Analytics, Business Profile): campaign statistics and account data
• The keys and tokens you enter for this are stored encrypted and never shown again

3. Purposes and legal bases

We use data only for these purposes, each with a legal basis under article 6 GDPR:

• Answering your question or request and preparing a quote: performance of (entering into) a contract
• Making the OS work for you: signing in, showing your workspace, creating content and documents, reading connected sources: performance of the contract
• Invoicing and processing payments: performance of the contract and legal obligation (tax retention duty)
• Security, preventing abuse and fixing errors: legitimate interest
• Informing you about changes to the OS, the terms or this policy: performance of the contract
• Marketing to existing customers about similar services: legitimate interest, always with an opt-out

4. Your data and personal contact

Your data belongs to you. You control your own workspace, the tools you connect and the instructions you give.

We do not track your behaviour or record your screen. We do not use your business data for our own product development. Feedback comes from personal contact.

Necessary security and error logs keep the system safe and working. Support access is limited to authorised people and is logged.

Software as a tool. The software connects your tools into a personal or custom system tailored to your wishes. SocialNow is the service layer on top of the software. Your data and your own connections remain under your control.

Previously collected usage data is no longer consulted. You can request erasure at info@socialnow.nl.

5. Who helps us (processors)

These parties process data on our behalf, under a data processing agreement or the provider's standard GDPR terms:

• Google Firebase (Google Ireland Ltd): signing in with Google, e-mail code or sign-in link; account data
• Vercel Inc.: hosting of socialnow.nl, the OS and the API, storage of your workspace (Vercel Blob, EU region where possible), and visitor statistics for socialnow.nl (Vercel Web Analytics, without cookies)
• PostHog Inc. (EU data centre Frankfurt): measurement of the A/B test on the socialnow.nl homepage, without cookies and without IP address; only which variant was shown and which button was clicked
• Hostinger: sending e-mail from info@socialnow.nl, such as sign-in codes, invitations and notifications
• Stripe Payments Europe Ltd: payments for credit; for card details Stripe is an independent controller
• GitHub Inc.: hosting of socialnow.nl (GitHub Pages)
• AI providers (section 6) for creating texts and images at your request

6. Artificial intelligence

The OS creates texts, images and analyses with language and image models. For that we send the data needed for your request (your story, your branding, the relevant figures) to a model provider. We currently use Google (Gemini, via Google Cloud Vertex AI or the Gemini API) and, depending on the chosen render option, Higgsfield or OpenAI for images.

These providers process the data only to produce the response. We choose contracts and settings under which your input is not used to train their models. Model output can contain errors; check what you publish.

Milo, the assistant in the OS, only sees the data of your own workspace and what you share in the conversation yourself.

7. Transfers outside the EU

Some providers are based in the United States or process data there (Vercel, GitHub, Stripe, Google, OpenAI). Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses with additional measures. Where possible we choose storage and processing in the EU.

8. Retention

We keep data no longer than needed:

• Contact details of a request without an order: at most two years after the last contact
• Data from the demo sign-up: at most two years, or shorter if you ask us to erase it
• Account and workspace data: as long as your account exists; after deletion erased from active systems within thirty days and from backups within ninety days
• Data from connected sources: only while the connection exists; disconnecting erases the copied data and the key
• Chat conversations with Milo and created pieces: as long as your account exists, unless you delete them earlier
• Invoices and payment data: seven years (tax retention duty)
• Technical logs (IP address, error messages): at most thirty days
• Your agreement to the terms: as long as your account exists, plus the statutory limitation period

9. Cookies and local storage

Socialnow.nl sets no tracking cookies. We count visits with Vercel Web Analytics: which page, from where, which country and which kind of device. This happens without cookies and without storing anything in your browser; your IP address is not kept and a visitor cannot be followed across days. On the Dutch homepage we test two versions of the top of the page. Which version you see is decided by our server with a code that changes daily and cannot be traced back to your IP address; nothing is stored in your browser for this. Which version was shown and which button you click is sent to PostHog in Frankfurt without your IP address. The legal basis is our legitimate interest in seeing how the site is used. In your browser (localStorage) we only remember that you have seen the notice about the terms, and in cookies on socialnow.nl which language and country you chose and whether you allowed measurement in the OS.

• __session: keeps note that you are signed in (55 minutes, or 30 days if you tick 'keep me signed in')
• sn-taal and sn-land: your language and country choice (one year)
• Firebase storage in your browser for signing in and remembering your sign-in link address
• Local storage for preferences such as your chosen theme, and for drafts not yet saved

SocialNow OS uses functional cookies and storage, and measures usage only if you allow it:

10. Security

We take appropriate technical and organisational measures:

• All connections run over https; the API only accepts requests from the app itself
• Keys and tokens of connected sources are stored encrypted and never shown again; only the server can use them
• Passwords are managed by Google Firebase and are not readable by us; sign-in codes work once and expire after fifteen minutes
• Every workspace is strictly separated; the code that accesses storage can only reach its own workspace
• Rate limiting on sign-in and API requests, and logging of admin actions
• Access by the SocialNow team is limited to what is needed and is logged
• In the event of a data breach that poses a risk we notify the Dutch Data Protection Authority within 72 hours and inform those affected

11. Your rights

Under the GDPR you have the right to:

• Access to your data and a copy of it
• Correction of inaccurate data
• Erasure ('right to be forgotten')
• Restriction of processing
• Transfer of your data in a common file format (data portability)
• Objection to processing based on legitimate interest, including necessary security and marketing
• Withdrawal of consent given, without affecting what was processed before

In the OS you see under Account which data we hold about you, you can change your name and language, disconnect your sources and delete your account with its workspaces. For everything else e-mail info@socialnow.nl; we may ask you to confirm your identity. You can also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

12. When you are the controller: your customers in the OS

If you put data of your own customers, leads or team members into the OS, or connect your Odoo, Meta or Google, you are the controller for that data and SocialNow processes it on your behalf. Until 19 September 2026 this section held a summary that called itself a data processing agreement. Five bullet points are not an agreement within the meaning of Article 28(3) GDPR, which requires a fixed list of subjects that was not in it. There is now a full data processing agreement at socialnow.nl/verwerkersovereenkomst, covering the instruction binding, the sub-processors, the security measures, transfers, audit and what happens to your data at the end. That agreement applies, and this is what it comes down to:

• We process this data only to make the OS work for you and according to your instructions through the OS
• We only engage the processors in sections 5 and 6 and inform you on this page about changes; you can object by ending your account
• We take the measures in section 10, help you with data subject requests and with a data protection impact assessment, and report a data breach affecting your data without undue delay
• When your account ends we erase the data as in section 8, unless the law requires us to keep it
• You make sure you have a legal basis to give us this data and inform your own customers where needed

13. Children

SocialNow OS is meant for businesses. We do not target people under 16 and do not knowingly process their data. If we notice we did, we erase it.

14. Automated decision-making

The OS makes suggestions and drafts, but takes no decisions with legal or similarly significant effects for you without human involvement. Publishing, sending and paying only happen on your explicit action.

15. Changes

We may change this policy, for example for a new feature or provider. The current version is always at socialnow.nl/privacy with the date at the top. For a change that affects your rights we ask for your agreement again in the OS and inform account holders by e-mail.

16. Outside the EU: the United Kingdom, Switzerland and the United States

SocialNow is established in the Netherlands and works with clients and visitors from more countries. Where another regime applies, the following applies alongside the rest of this policy.

• We do not sell personal information and do not share it for cross-context behavioural advertising. We never have and do not intend to; that is also why there is no 'Do Not Sell or Share' control on our site, because there is nothing to switch off
• Right to know which categories of personal information we collect, from where, for what and with whom we share it: that is in sections 2, 3 and 5
• Right to a copy of the specific information we hold about you
• Right to deletion, and right to correction of inaccurate information
• Right to limit the use of sensitive personal information: we collect no sensitive categories within the meaning of the CPRA
• Right not to be discriminated against for using any of these rights: we do not offer a different price or a lesser service to anyone who makes a request
• An authorised agent may make a request on your behalf; we will ask for proof of that authorisation
• Requests: info@socialnow.nl. We acknowledge within ten working days and respond within 45 days, with a 45-day extension where needed

United Kingdom: if you are established in the UK, the UK GDPR and the Data Protection Act 2018 apply. Your rights are the same as above. A complaint goes to the Information Commissioner's Office (ico.org.uk). Transfers from the UK to us rest on the UK adequacy regulations for the EEA; if data subsequently leaves the EEA, the UK International Data Transfer Addendum to the standard contractual clauses applies.

Switzerland: if you are established in Switzerland, the Federal Act on Data Protection applies. Your rights are equivalent; your complaint goes to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

United States, California: if you are a California resident, the CCPA as amended by the CPRA gives you a number of rights which we expressly confirm below.

17. Making a complaint

If you have a complaint about how we handle your data, e-mail info@socialnow.nl first. We reply within ten working days, with a person, not a form.

If we cannot resolve it together, you can always go to a supervisory authority. In the Netherlands that is the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). If you live in another EU Member State you may also go to the authority of your own country; it is equally competent. Outside the EU: see section 16.