YOUR DATA

Privacy policy

Last updated October 30, 2026

Social Setlist (“we”, “us”) is a tool for writing, scheduling and publishing posts to your social media accounts. This policy explains what we collect, why, who we share it with, and how you can remove it. Some features described here may not be available yet.

What we collect

Waitlist. If you join the waitlist, we keep your email address so we can tell you when your invite is ready. Nothing else is collected there, and we only use it for that.
Account details. Your name, email address and profile image when you sign up. Sign-in is handled by our authentication provider.
Connected social accounts. When you connect an account (for example Facebook Pages and linked Instagram business accounts through Meta, or a Threads profile), we store the account’s ID, name and profile picture, and the access token that lets us act on your behalf. Tokens are encrypted at rest.
Content you create. Drafts, scheduled and published posts, media you upload (and the descriptions, or “alt text”, you or the AI write for it), templates, and your Brand Voice profile.
Performance data. If you use analytics, follower counts and post performance figures from your connected accounts.
Billing. Payments are processed by our payment processor. We do not store your card number.
Technical data. Basic logs and network information (such as IP address) used to keep the service secure and prevent abuse.

Cookies and analytics

On our public pages (not inside the signed-in app) we use Google Tag Manager to run measurement tools. What runs depends on your choice in the cookie banner:

Before you choose, or if you reject non-essential cookies: Google Analytics runs in a limited mode. It sets no cookies on your device and receives only basic information about the visit, such as the page address. The Facebook (Meta) Pixel does not load at all.
If you accept analytics cookies: Google Analytics uses cookies to understand how visitors use the site, so we can improve it.
If you accept marketing cookies: the Meta Pixel loads, so we can measure our advertising (for example, that someone joined the waitlist) and show relevant ads on other sites.

Strictly necessary cookies, such as keeping you signed in and remembering your cookie choices, are always on. You can change your choices at any time from the cookie banner, and rejecting non-essential cookies does not limit what you can do on the site.

How we use it

To connect your accounts and publish or schedule the posts you create.
To show your accounts, calendar, post history and analytics.
To draft captions in your voice, and to describe your photos (captions and alt text), when you use AI assistance. Your request, your Brand Voice profile and, only when you choose to include them, the photos attached to your post are sent to our AI model provider to produce that result. Photos are resized before they are sent, and the AI is instructed not to identify people in them.
To run your subscription, provide support, and protect the service.

We do not sell your personal data, and we do not use it for advertising.

We do not use your photos, captions or Brand Voice profile to train AI models. Our AI provider processes them to return the result you asked for, under its terms for business customers.

Data from Meta (Facebook, Instagram and Threads)

Data we receive from Meta about your Pages, Instagram business accounts and Threads profile is used only to provide Social Setlist features to you: connecting the account, publishing and scheduling your posts, and showing your performance. We do not sell it, share it with data brokers, or use it for advertising. You can disconnect an account at any time from the Accounts page, which deletes the stored token and account record.

Comments and messages (the inbox)

When you connect a Facebook Page, an Instagram account or a Threads profile, Social Setlist shows the comments and replies people leave on your posts, and the direct messages sent to your Facebook and Instagram accounts, in your inbox, so you can read them, reply, hide or delete them where the network allows it, like Facebook comments, and mark conversations done. To do this we store, for each comment, reply or message: its text, the name or username and account ID that Meta gives us for the person who wrote it, the time it was sent, and how many attachments it had (not the attachments themselves). We also look up the post a comment is on, and the name of someone who messages you, from Meta when you open a conversation.

How long we keep them: a conversation is kept for 12 months after its last message, then deleted automatically. Disconnecting the account deletes its conversations immediately, and comments you delete (here or on Facebook, Instagram or Threads) are removed from the inbox.
What we do not do: we do not sell comments or messages, use them for advertising, send them to AI models, use them to train anything, or write their text into our logs.
Who can see them: only the people in your Social Setlist workspace, and only for the accounts in the project they are working in.

Who we share it with

We share data only with providers that help us run the service, and with the platforms you choose to connect:

Authentication and hosting providers.
A database provider.
A payment processor.
An email delivery provider, which sends service emails such as a warning that a connected account needs reconnecting.
Error monitoring and background job providers, which help us keep the service running.
An AI model provider, when you use AI drafting or photo descriptions. Photos are sent only when you choose to include them.
Meta and any other social platform you connect, to publish and read performance data on your behalf.

We may also disclose information if required by law.

How long we keep it

We keep your data while your account is active. Disconnecting a social account removes its stored token, its record and its inbox conversations immediately. Inbox conversations are also deleted automatically 12 months after their last message. If you ask us to delete your account, we delete your data as described below.

Data deletion

You can remove your data at any time:

Disconnect a social account. In Social Setlist, open Accounts and choose Disconnect. The stored token, the account record and the comments and messages stored for that account are deleted immediately.
Remove the app from Facebook, Instagram or Threads. In Threads, open Settings, then Account, then Website permissions, and remove Social Setlist. In your Facebook account settings, open Business Integrations (or Apps and Websites), find Social Setlist, and remove it. This revokes our access on Meta’s side.
Delete everything. To delete your Social Setlist account and all data we hold about you, email support@socialsetlist.com from the address you signed up with. We will delete your data and confirm by email within 30 days.

Facebook, Instagram and Threads users: following steps 1 and 2 removes the data Social Setlist received from Meta. Email us for step 3 if you also want your account deleted.

Your choices and rights

You can ask to access, correct or delete your data at any time by emailing us. Depending on where you live, you may have additional rights under local law.

Security

Access tokens are encrypted at rest, traffic is sent over HTTPS, and access to your workspace requires signing in. No system is perfectly secure, but we work to protect your data.

Children

Social Setlist is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy. We will change the date above when we do.

Contact

Questions about privacy? Email support@socialsetlist.com.