Privacy Policy

1. Introduction

Simino Social lets you compose a post once, attach a photo or video, choose which of your connected Facebook Pages, Instagram Business accounts and YouTube channels should receive it, and publish immediately or at a scheduled time.

In this policy, “Simino Social”, “Company”, “we”, “us” or “our” refers to SIMINO LABTEST PRIVATE LIMITED, which also owns the domain this site is served from. The product is made with SmartNetra — The AI Product Builder, the company’s own product tooling rather than a third-party processor, so it receives none of the data described below. “You” means a visitor, account holder, workspace member or other user of the platform.

Related documents: Terms of Service, Delete your data and Security.

2. Information We Collect

Account information: the email address you sign in with, your user identifier, workspace name, workspace membership and role, and your communication preferences.

Content you create: post captions, titles, descriptions, scheduled publish times, target account selections, and the delivery status of each post.

Media you upload: the photo and video files you add to a post, together with technical facts we read from them such as file size, MIME type, image dimensions, video duration, aspect ratio and a content checksum.

Connection information: the identifiers, display names and profile images of the social accounts you connect, and the encrypted credentials described in section 4.

Device and usage data: browser and device type, operating system, IP address, pages viewed, session activity, and diagnostic or error records generated while you use the service.

Support information: messages, attachments and account details you send us when you contact support.

3. Information From Connected Accounts

When you connect a social account, we receive only the information needed to list the account and publish on your behalf:

• Facebook: the Pages you administer, and for each Page its Page ID, name, profile picture and a Page access token.
• Instagram: the Instagram Business or Creator account linked to a Page you administer, and its account ID, username and profile picture.
• YouTube: the channels on your Google account, and for each channel its channel ID, title and thumbnail.

We also store the identifier and permalink that a platform returns after a successful publish, so we can show you where a post went and avoid publishing the same post twice.

We do not read your inbox, direct messages, friends list, contact list, follower list or private posts. We do not download your existing photo or video library from any platform.

4. Access Tokens and Passwords

We never see, receive or store your Facebook, Instagram or Google password. When you connect an account, we send you to the platform’s own website. You type your password there, on their domain, over their connection. The platform then returns an access token to us — a revocable key scoped to the specific permissions you approved.

Those tokens are protected by four independent measures:

• They are encrypted with AES-256-GCM before being written to storage.
• The encryption key is held in our server-side function environment, never in the database, so a copy of the database alone does not reveal a usable token.
• They are stored in a private database schema that is not exposed through our public API and cannot be selected by any signed-in user, including you.
• Row-level security is enabled on that storage with no policy that grants access, so ordinary application credentials are refused even if the other layers were bypassed.

Tokens are decrypted only inside the server-side function that is publishing your post, for the duration of that call. They are never sent to your browser or mobile app.

You can disconnect an account inside Simino Social at any time, which deletes the stored token. You can also revoke our access directly from Facebook Business Integrations or your Google security settings, without visiting our site at all.

5. Media You Upload

Photos and videos you upload are held in a private storage bucket. They are not public, not indexed and not listable. Access is restricted to the workspace that uploaded them.

Facebook and Instagram publish media by fetching it from a URL rather than accepting a file upload. To publish to those platforms we generate a short-lived signed link to your file, valid for a limited period (two hours by default) and unguessable, and pass it to Meta. The link expires on its own; it is not reused and is not shared with anyone else.

YouTube requires the file itself. Videos destined for YouTube are uploaded from your browser or mobile app directly to Google’s upload endpoint. Those bytes do not pass through our servers.

We do not run facial recognition, biometric analysis or content-based advertising profiling on your media.

6. How We Use Information

• Create, authenticate and manage your account and workspace.
• Store drafts, media and schedules until you publish them.
• Check a file against each platform’s published limits before publishing, and tell you in plain language when it will be rejected.
• Publish your posts to the accounts you selected, at the time you chose.
• Retry a failed delivery, and record why a platform refused it.
• Show you the status, platform identifier and link for each delivery.
• Diagnose faults, prevent abuse and keep the service reliable and secure.
• Send service messages such as delivery failures, security alerts and policy notices.
• Comply with legal, tax, regulatory and business obligations.

We do not sell personal information. We do not use your content or platform data to train machine-learning models. We do not use it for advertising or to build advertising profiles.

7. Facebook and Instagram Data

Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies, including the limited-use requirements.

We request only the permissions the publishing feature needs:

• pages_show_list — to list the Pages you administer so you can choose one.
• pages_read_engagement — to read a Page’s name and picture, and to obtain the Page access token used for publishing.
• pages_manage_posts — to create the photo or video post you composed.
• instagram_basic — to identify the Instagram Business account linked to your Page.
• instagram_content_publish — to publish the media container you composed to that account.

We do not transfer Meta platform data to data brokers, advertising networks or monetisation partners. We do not combine it with data from other sources to build profiles. We do not use it for any purpose other than operating the features you asked for.

If you remove Simino Social from your Facebook Business Integrations, the token becomes invalid immediately and any pending posts to that account will fail rather than publish.

8. YouTube API Services and Google Data

Simino Social uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google’s Privacy Policy describes how Google handles data it receives.

We request two Google scopes:

• youtube.upload — to upload the video you composed to the channel you selected.
• youtube.readonly — to list your channels so you can choose one, and to read the title and thumbnail we display.

Simino Social’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We store your channel identifier, channel title, channel thumbnail, an encrypted refresh token and the identifier of each video we upload for you. We store nothing else from your Google account.

Retention and deletion: we keep Google user data only for as long as the channel is connected and your account is active, and we delete or destroy it when that period ends. Section 9 sets out, item by item, how long each piece of Google user data is kept and every way you can have it deleted.

You can revoke our access to your YouTube data at any time from the Google security settings page at myaccount.google.com/permissions, or by disconnecting the channel inside Simino Social. To request deletion of the YouTube data we hold, follow the steps in Delete your data.

9. Retention and Deletion of Google User Data

This section states, specifically and separately from the general retention rules in section 13, how long Simino Social keeps Google user data and how that data is deleted. “Google user data” here means everything we obtain from your Google account through the YouTube API Services scopes listed in section 8.

We hold no other Google user data. We do not copy your existing videos, playlists, comments, subscribers, analytics, Gmail, Contacts, Drive files or Google profile data, and we do not retain a copy of a video after Google has accepted the upload — the file is sent from your browser or mobile app straight to Google’s upload endpoint.

When the retention period for a given type of Google user data expires, we delete or destroy that data. We retain Google user data only for the length of time needed to provide the publishing features described in section 6, unless a longer period is required or permitted by law. Where a limited record must be kept to comply with a legal, tax or accounting obligation, to resolve a dispute or to prevent fraud and abuse, it is kept only for as long as that purpose requires, is not used for any other purpose, and is deleted or destroyed when the purpose ends.

You can have your Google user data deleted in any of these ways:

• Disconnect the channel in Simino Social — open Connections, choose the YouTube channel and select Disconnect. The stored token and channel record are deleted at once.
• Delete individual posts — deleting a post removes the video identifier, link and delivery record we hold for it.
• Request full deletion by email — write to support@siminosocial.com from your registered address with the subject “Delete my account”. We action verified requests on the timeline above and confirm in writing when it is done. Step-by-step instructions are on the Delete your data page.
• Revoke at Google — remove Simino Social at myaccount.google.com/permissions. This invalidates our token instantly. To also erase the connection record we hold, use one of the routes above.

Revoking access or deleting your Simino Social data does not remove videos already published to your YouTube channel. Those belong to your channel and must be deleted on YouTube.

10. Cookies and Local Storage

We use browser local storage to keep your sign-in session so you are not asked to sign in on every page. This is required for the service to function and is not used for advertising or cross-site tracking.

We do not embed third-party advertising trackers, social plugins or cross-site behavioural profiling scripts.

11. Sharing of Information

We share limited information only where it is needed to run the service:

• With the social platforms you connect, when you publish — the caption, title, description, privacy setting and the media itself. This is the whole point of the service and happens only for accounts you selected.
• With other members of your workspace, who can see the workspace’s posts, media and connected accounts. They cannot see your credentials.
• With the service providers listed in section 12, who host and operate our infrastructure under contract.
• With regulators, law enforcement or courts, where required by law.
• In a business transfer, if the company or the product is merged or acquired, subject to this policy continuing to apply.

We do not sell or rent personal information to third parties.

12. Service Providers and Hosting

We rely on a small set of infrastructure providers:

• Supabase — authentication, the application database and private media storage.
• Cloudflare — website delivery and the scheduler that triggers posts at their appointed time.
• Meta Platforms, Inc. and Google LLC — the destination platforms, which receive only what you chose to publish.

These providers process data on our instructions and are not permitted to use it for their own purposes.

13. Data Retention

We retain personal information — including Google user data and Meta platform data — only for the length of time needed to fulfil the purposes set out in section 6, unless a longer retention period is required or permitted by law. When the retention period for a given type of data expires, we delete or destroy it.

Section 9 states the retention and deletion rules for Google user data specifically. When you disconnect a social account, the stored credential for it is deleted at once. When you delete your account, we delete your posts, media, connections and credentials as described in Delete your data, and confirm in writing when it is done.

Limited records may be retained beyond the periods above only where necessary to resolve disputes, prevent fraud or abuse, enforce our agreements, or meet legal, tax and accounting obligations. Those records are kept only as long as that purpose requires, are not used for anything else, and are deleted or destroyed when the purpose ends. Content already published to Facebook, Instagram or YouTube lives on those platforms and must be deleted there.

14. Deleting Your Data

You can request deletion of your data at any time. There are three routes, all described step by step on the Delete your data page:

• Self-service: disconnect an account in Simino Social to delete its stored credential, or delete individual posts and media.
• Full account deletion: email support@siminosocial.com from your registered address with the subject “Delete my account”. We action verified requests within 30 days and confirm by email when it is done.
• Revoke at the platform: remove Simino Social from your Facebook Business Integrations or your Google security settings.

15. Your Rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you may request access to your personal data, correction of inaccurate data, deletion, withdrawal of consent, and grievance redressal.

To exercise these rights, contact support@siminosocial.com. We may ask you to verify control of your registered email address before acting on a request.

16. Security

We use administrative, technical and organisational safeguards including encrypted transmission, encryption of credentials at rest, row-level access control that scopes every record to its workspace, private storage buckets, short-lived signed links, and separation of the credential store from the public API. Our Security page describes these in more detail.

No internet service can guarantee complete security. Protect your email account, since it is what signs you in, and disconnect social accounts you no longer use.

17. International Transfers

Our infrastructure providers operate globally, so your information may be processed outside your country of residence. Where required, we rely on appropriate safeguards and on the contractual commitments those providers make about how they handle data on our behalf.

18. Children

Simino Social is intended for adults operating business or creator accounts. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@siminosocial.com and we will delete it.

19. Changes to This Policy

We may update this Privacy Policy from time to time. The updated policy will be posted on this page with a revised Last Updated date. Where changes are material we will also notify you by email or in the application.

20. Contact Us

Simino Social
SIMINO LABTEST PRIVATE LIMITED
House No-3, Kokila garden phase 1, Pokhariput, Bhubaneswar, Odisha, India 751020
Email: support@siminosocial.com
Phone: +91 9776 919 100

21. Grievance Redressal

For privacy complaints, access requests, correction requests, deletion requests or other data-related queries, contact the Grievance Officer at SIMINO LABTEST PRIVATE LIMITED.

Email: support@siminosocial.com
Phone: +91 9776 919 100

This Privacy Policy is governed by the laws of India. Disputes will be subject to the jurisdiction of competent courts in Bhubaneswar, Odisha, India.