Privacy Policy

1. Scope

This Policy applies to personal information we process about users of the Service, including agency account holders, personal-brand users, and client portal users invited by a workspace administrator.

This Policy does not apply to third-party websites, social networks, or services you connect to or link from the Service, except where we specifically describe how we access or process data from those services (for example, Google Calendar). Those third parties have their own privacy policies.

2. Information we collect

We collect information in the following categories:

• Account & profile: name, email address, password (stored in hashed form), workspace name, role, preferences (timezone, date format, landing page), and authentication session data
• Workspace & client data: brand names, package details, deliverables, voice notes, pillars, posts, captions, schedules, tasks, invoices, billing notes, invite records you or your team enter, and optional Google Drive folder links you paste as shortcuts
• Content you upload: images, videos, filenames, and related metadata stored in our cloud storage
• Google Calendar connection data (only if you opt in): Google account email and account identifier; OAuth access and refresh tokens; the calendar you select (id and display name); granted OAuth scopes; connection status; and mappings between Entire Socials scheduled posts and Google Calendar event IDs we create on your behalf
• Usage & device: log data, IP address, browser type, pages viewed, actions taken in the app, and diagnostic information used to secure and improve the Service
• Communications: messages you send us (support requests, feedback)
• Subscription & payment data: if you purchase a paid plan, payment card details and billing address are collected and processed by Stripe, Inc. We do not store your full payment card number on our systems

3. How we collect information

Directly from you when you register, complete forms, upload assets, create posts, or contact support.

From workspace administrators who invite you to a client portal and assign your role.

From Google, when you choose to connect Google Calendar via Google’s OAuth consent screen and authorize the scopes we request.

Automatically through cookies, session tokens, and similar technologies necessary to authenticate you and operate the Service.

From service providers that host infrastructure, authentication, storage, email, analytics, or payment processing on our behalf.

4. How we use information

We use personal information to:

• Provide, maintain, and secure the Service
• Authenticate users and enforce role-based access (agency vs. client portal)
• Store and display your content, calendars, assets, approvals, and billing records
• If you connect Google Calendar: list calendars you can access so you can pick one; create, update, and remove short calendar events that reflect scheduled posts for clients you enable; and keep those events in sync when schedules change
• Operate optional automated features (for example, suggesting content pillars or captions)
• Process subscription payments, renewals, cancellations, and billing-related communications through Stripe
• Send transactional messages (account creation, invites, security notices, billing receipts)
• Respond to support requests and communicate about the Service
• Analyze usage to fix bugs, prevent abuse, and improve features
• Comply with law and protect our rights, users, and the public

5. Google Calendar & Google user data

Entire Socials offers an optional Google Calendar sync feature. Connecting Google is never required to use the rest of the Service. Each user links their own Google account; we do not use one person’s Google connection to sync another person’s calendar.

When you connect, we request only the Google OAuth scopes needed for this feature: OpenID and email (to identify your Google account), calendar.readonly (to list calendars so you can choose one), and calendar.events (to create, update, and delete events on the calendar you selected).

What we access and do with Google data: we read your Google account email/id and calendar list; we write short events (title, description, start/end time) derived from Entire Socials scheduled-post data you already store with us; and we update or delete those events when posts are rescheduled, unscheduled, or removed, or when you turn sync off for a client or disconnect Google.

What we store: encrypted OAuth tokens, your Google account email/id, selected calendar id and name, scopes granted, connection status, per-client sync preferences, and Google event IDs linked to our posts so we can update or delete the correct events.

What we do not do with Google user data: we do not sell it; we do not use it for advertising, retargeting, or credit decisions; we do not use it to train generalized AI/ML models; we do not transfer it to data brokers or unrelated third parties; and we do not use Google Calendar data for any purpose other than providing and improving this user-facing calendar sync feature.

Entire Socials’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Optional Google Drive folder links are a separate shortcut: you (or a client you authorize) may paste a Google Drive folder URL per brand. We store only that URL and open it in a new tab. We do not request Google Drive OAuth scopes, access files in Drive, or use the Google Drive API for this feature. Who can open the folder is controlled by sharing settings in Google Drive, not by Entire Socials.

You can disconnect Google Calendar at any time in the Service (for example under Connect Socials / integrations). Disconnecting deletes our stored tokens and related sync mappings for your connection and stops further Google Calendar API calls for your account. You may also revoke access in your Google Account permissions settings.

If we change how we access, use, store, or share Google user data, we will update this Policy and, where required, obtain your consent before using Google user data in a new way.

6. Legal bases (where applicable)

Where required, we rely on: performance of a contract (providing the Service you signed up for); legitimate interests (security, improvement, fraud prevention); consent (where we ask for it explicitly, such as connecting Google Calendar or certain optional communications); and legal obligation.

7. When we share information

We do not sell your personal information. We share information only as described below:

• Within your workspace: agency users, and client portal users invited to a brand, can see information according to role and visibility settings configured in the Service
• Google: if you connect Google Calendar, we send event create/update/delete requests to Google’s APIs using tokens you authorized, solely to sync scheduled posts to your selected calendar
• Payment processing: Stripe, Inc. receives payment card and billing information you provide at checkout to process subscriptions on our behalf. Stripe’s privacy policy is available at https://stripe.com/privacy
• Other service providers: hosting, database, authentication, storage, email delivery, and analytics vendors who process data under contractual obligations
• Legal & safety: when required by law, court order, or to protect rights, safety, and security
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy or notice to you

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Google Calendar connection data is retained while your connection remains active. When you disconnect, we delete stored OAuth tokens and related event-link mappings for that connection within a reasonable period. Events already created on your Google Calendar remain in Google until you or we delete them through sync (for example when turning sync off for a client) or you remove them in Google Calendar.

When a workspace or client is archived or deleted, we delete or anonymize data within a reasonable period unless retention is required by law or legitimate business needs (for example, billing records).

9. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and secure cloud infrastructure.

Google OAuth access and refresh tokens are stored encrypted and are accessible only through secured server-side processes after authentication checks—not exposed to ordinary client-side app users.

No method of transmission or storage is completely secure. You are responsible for using a strong password and safeguarding your credentials.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you, to opt out of certain processing, or to appeal a denial of a request.

Residents of certain U.S. states (including California, Colorado, Connecticut, Virginia, and others) may have additional rights under state privacy laws. New York residents are protected under New York law, including requirements applicable to businesses that maintain private information.

To exercise your rights, email support@entiresocials.com. We may verify your identity before responding. You may designate an authorized agent where permitted by law.

We will not discriminate against you for exercising privacy rights.

11. Children’s privacy

The Service is not directed to children under 13 (or 16 where applicable), and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact support@entiresocials.com and we will delete it.

12. U.S. operations & international users

We are based in the United States. If you access the Service from outside the U.S., you understand that information may be processed and stored in the U.S. and other countries where our providers operate, which may have different data protection laws than your country.

13. Cookies & similar technologies

We use essential cookies and similar technologies to keep you signed in, remember preferences, and protect the Service. We do not use non-essential advertising cookies on the core application without notice.

You can control cookies through browser settings; disabling essential cookies may prevent you from using the Service.

14. Third-party services

The Service relies on third-party infrastructure (for example, cloud hosting, authentication, and file storage). Those providers process data on our instructions and are contractually required to protect it.

For subscriptions, Stripe, Inc. is our payment processor. Stripe may collect device and fraud-prevention data in addition to payment details. We receive from Stripe limited information needed to manage your account, such as the last four digits of your card, card brand, expiration date, billing email, subscription status, invoice history, and payment success or failure notices. We do not receive or store your complete card number or CVC.

Optional Google Calendar sync is powered by Google APIs and subject to Google’s terms and privacy policy in addition to Section 5 of this Policy. Optional Google Drive folder shortcuts are URLs you paste; we do not access Drive through Google APIs for that feature.

Links to social platforms, Google Drive folders, or other external sites are not controlled by us. You are responsible for sharing those destinations with the right people.

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised Policy on this page and update the “Last updated” date. Material changes may be communicated by email or in-product notice where appropriate.

16. Contact us

Privacy inquiries: support@entiresocials.com

General contact: support@entiresocials.com

Mailing address: New York, NY, United States

Effective date: June 9, 2025