Privacy Policy

Last updated: 17 September 2026

IntoSM is a social media management platform operated by Vena Apps Ltd (company number 16928360). This policy explains what we collect, why, who else processes it, and how to get it deleted.

Information we collect

• Account information you give us directly — name, email address, and workspace details.
• Connected account information from the platforms you choose to connect: Facebook, Instagram, Telegram, TikTok, YouTube, Threads, Pinterest and Google Business Profile. This is limited to what the product needs — the account's name and profile image, the posts you publish through us, the comments and messages sent to those accounts, and aggregate metrics such as follower counts, reach and engagement.
• Access tokens issued by those platforms when you authorise a connection. These are encrypted at rest and used only to act on your instructions.
• Content you create in the product — drafts, scheduled posts, and media you upload to your library.
• Operational records needed to run the service, such as activity logs within your workspace and counts of AI requests measured against your plan.

How we use it

Only to provide the service you asked for: publishing and scheduling content to the accounts you connect, bringing their comments and messages into one inbox, showing you analytics for those accounts, managing your workspace and team, and invoicing you.

To be explicit about what we do not do:

• We do not sell your data, or data obtained from a connected platform.
• We do not use it for advertising or ad targeting.
• We do not use it to train machine learning models.
• We do not use platform data for any purpose beyond operating the features you use.

Who else processes it

We use a small number of providers to run the service. Each processes data only on our instructions:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Resend — transactional email, such as your welcome message and invoices.
• Google (Gemini) — the AI features. Text you submit to an AI tool is sent to Google to generate a response.

Beyond these, we share data only with the social platforms you have connected, and only to carry out an action you asked for — publishing a post, or sending a reply.

Platform data

Data we receive from a platform's API is handled in line with that platform's terms, including Meta's Platform Terms and Developer Policies. We keep it only as long as it is needed for the features you use, and delete it when you disconnect the account or close your workspace.

Retention and deletion

You can remove your data at three levels:

• Disconnect one account — from the Platforms page. This deletes the stored access token for it immediately.
• Revoke from the platform — removing IntoSM from the platform's own app settings also ends our access.
• Delete everything — email privacy@intosm.com from your workspace's registered address. We delete the workspace and everything in it — posts, media, connected accounts, messages and analytics — within 30 days, other than records we must keep for accounting purposes.

How we protect your data

These measures apply to everything we hold, and particularly to the access tokens that let us act on your connected accounts — the most sensitive data in the product.

• Encrypted in transit — every connection to IntoSM, and every call we make to a platform's API, runs over HTTPS with TLS 1.2 or higher. No part of the product is served over plain HTTP.
• Encrypted at rest — platform access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, so they are unreadable in a database copy, a backup, or a stray query result. The encryption key is held in the application environment and never in the database, so the two cannot be lost together. The database itself and your uploaded media sit on storage that our hosting providers encrypt at rest.
• Tokens are never exposed — a stored token is decrypted in memory only at the moment we make a call you asked for. It is never sent to your browser, written to a log, or included in an export.
• Workspace isolation — every table holding customer data has row-level security enforced by the database itself, keyed to your workspace. A query made for one workspace cannot return another workspace's rows, even if the application above it were at fault.
• Least privilege inside your workspace — each member holds one of four roles (Owner, Admin, Editor, Viewer). Both the interface and the database policies check that role before any read or write.
• Restricted administrative access — only a small number of our staff can reach production data, using individually issued accounts protected by multi-factor authentication, and only to provision a workspace, answer a support request, or investigate a fault. We do not browse customer content otherwise.
• Minimum permissions — we ask each platform for the narrowest scopes the features need. For YouTube that is permission to upload a video and to read the channel's own metadata and metrics, rather than full account management.
• Incident response — if we discover a breach affecting your personal data, we will notify the affected workspaces and, where the law requires it, the relevant supervisory authority, without undue delay and within 72 hours of becoming aware of it.

Google user data

Connecting a YouTube channel authorises IntoSM through Google OAuth. We request only the ability to upload videos on your behalf and to read that channel's own details and performance metrics. We use that data solely to publish the content you schedule and to show you its analytics inside your workspace.

Connecting a Google Business Profile authorises IntoSM to manage the business locations that Google account has access to. We use that access only to read each location's name, address, rating and review count, and to publish the posts you schedule to the locations you choose.

IntoSM's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not transfer Google user data to third parties except as needed to provide or improve the features you use, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; we do not allow humans to read it except with your explicit consent, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymised; and we do not use it to develop, improve, or train generalised artificial intelligence or machine learning models.

Google user data is protected by the same measures set out above: encrypted in transit, tokens encrypted at rest with AES-256-GCM, isolated per workspace by row-level security, and deleted when you disconnect the channel or close your workspace. You can also revoke our access at any time from your Google Account permissions page.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, have it deleted, or object to how we use it. Write to privacy@intosm.com and we will respond within 30 days.

Contact

Questions about this policy, or requests about your data, go to privacy@intosm.com.