Data Handling Disclosure
How we collect, use, store, and protect information across your workspace.
This Privacy Policy explains how ShoMate (“ShoMate,” “we,” “us,” or “our”) collects, uses, stores, and protects information in connection with our AI-powered, multi-tenant social media management platform. By using ShoMate, you agree to the practices described in this policy.
When you register, we collect your name, email address, password (stored in hashed form), and business profile details you provide, including business name, logo, address, phone number, email, website, delivery areas, and opening hours.
When you connect a social media account (Instagram, Facebook, Threads, X, TikTok, or YouTube) via that platform’s official OAuth authorization flow, we receive and securely store access tokens and account identifiers necessary to publish content and retrieve analytics on your behalf. We do not receive or store your social media account password.
We collect media (images and videos) that you upload for AI processing and publishing, along with any captions, hashtags, or titles you edit or approve.
Where you enable the AI Inbox Assistant, we process messages received from your customers on connected platforms in order to identify intent and generate template-based responses using your configured business information.
We automatically collect limited technical data such as log-in timestamps, IP address, browser type, device information, and in-app activity for security, analytics, and service-improvement purposes.
We use collected information to:
We do not sell your personal information or your customers’ information to third parties.
To minimize storage and protect your privacy, uploaded media is retained only as long as necessary to process and publish it.
Once a post has been successfully published, the original uploaded media is automatically and permanently deleted from our systems within twenty-four (24) hours. After deletion, we retain only lightweight metadata associated with the post, including the caption, hashtags, YouTube title, publishing history, platform post identifiers, and analytics. If a post is never published (e.g., abandoned draft), media may be deleted on a comparable schedule as part of routine storage maintenance.
We share information only in the following circumstances:
ShoMate is a multi-tenant platform. Every customer’s users, social accounts, business profile, uploaded media, AI history, analytics, and settings are logically isolated and scoped to that customer’s account. No customer can access another customer’s data, and all system queries are scoped to the authenticated tenant.
We implement administrative, technical, and physical safeguards designed to protect your information, including encryption of access tokens and credentials, access controls, and tenant-scoped data isolation. No system can be guaranteed fully secure; in the event of a data breach affecting your information, we will notify you as required by applicable law.
Depending on your jurisdiction, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You may disconnect any connected social media account at any time from your dashboard, which revokes ShoMate’s access to that account going forward. You may request deletion of your account and associated data by contacting us at the address below, subject to any retention required by law or for legitimate business record-keeping (such as billing history).
We retain account and business profile information for as long as your account remains active, and for a reasonable period thereafter as required for legal, accounting, or legitimate business purposes. Metadata retained after media deletion (per Section 3) is kept to support your publishing history and analytics dashboard, and is deleted upon account closure and deletion request, subject to Section 7.
ShoMate is intended for business use and is not directed at individuals under 18. We do not knowingly collect personal information from children.
Depending on where you and our service providers are located, your information may be processed in a country other than your own. Where required, we implement appropriate safeguards for such transfers in accordance with applicable law.
We may update this Privacy Policy from time to time. Material changes will be communicated via the dashboard or email prior to taking effect. Continued use of ShoMate after such changes constitutes acceptance of the updated policy.
For questions about this Privacy Policy or to exercise your data rights, contact us at privacy@shomate.dev.
This document is a template intended as a starting point and does not constitute legal advice. Depending on where your customers and their end-users are located, you may need to comply with specific regional laws (e.g., GDPR, CCPA/CPRA, or others) that require additional disclosures, a designated Data Protection Officer, or a formal Data Processing Agreement with your AI and hosting providers. This should be reviewed by a licensed attorney before publication.