SocialBuddy

Privacy Policy

Protecting your personal data is important to us. This privacy policy informs you, in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR) as well as § 165 of the Austrian Telecommunications Act (TKG 2021), about how we collect, use and protect your data.

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:
SocialBuddy.ai
Alexander Puff (sole proprietorship)
Kalmanstraße 12/2/5
1130 Vienna, Austria
Email: hello@socialbuddy.ai

As we employ fewer than 250 people and the data processing does not pose a particular risk to the rights and freedoms of data subjects, we are not obliged to appoint a data protection officer. For data protection enquiries, please contact the email address above directly.

2. What data we collect

2.1 Registration data

When you create your account, we collect: name, email address and a password (stored encrypted). If you use Google OAuth, we receive your name and email address from Google. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.2 Usage data

While you use our service we process: brand profiles you create (name, website URL, tone of voice, target audience, etc.), generated social media posts (texts, images, videos), uploaded files (PDF, Excel, Word, images), editorial plans and approval decisions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.3 Technical data

When you access our website, the following is automatically collected: IP address (for the duration of the session), browser type and version, operating system, date and time of access. This data is not merged with other data sources. Legal basis: legitimate interest in the security and stability of our service (Art. 6(1)(f) GDPR).

2.4 Email notifications

If you enable email notifications in the settings (opt-in, disabled by default), we use your email address for daily reminders about pending post approvals. You can unsubscribe at any time in the settings or via the link in every email. Legal basis: consent (Art. 6(1)(a) GDPR).

2.5 Payment data

For paid subscriptions, payment data is processed via our payment service provider Stripe (see section 6). We do not store any credit card or bank details ourselves.

3. Purpose of data processing

We process your data for the following purposes:

  • Provision of the service — creating and managing your account, generating social media content, storing your posts and brand profiles (Art. 6(1)(b) GDPR)
  • AI-assisted content creation — transmitting your content to AI services for text, image and video generation (Art. 6(1)(b) GDPR, see section 5)
  • Communication — sending welcome emails, approval reminders and account notifications (Art. 6(1)(b) or (a) GDPR)
  • Security — protection against unauthorised access, misuse and technical disruptions (Art. 6(1)(f) GDPR)
  • Billing — processing payments for paid subscriptions (Art. 6(1)(b) GDPR)

4. Retention period

We store your data only for as long as is necessary for the respective purpose:

  • Account data — until your account is deleted
  • Posts, brand profiles, uploads — until your account is deleted
  • Account deletion — upon a deletion request, your data is retained for a grace period of 30 days (soft delete), after which it is permanently deleted. You can revoke the deletion within this period. You will receive a reminder email 7 days before final deletion.
  • Technical logs — a maximum of 30 days
  • Invoice data — 7 years (statutory retention obligation under § 132 BAO)

5. AI data processing

To provide our core functions, certain data is transmitted to third-party AI providers. Below we transparently inform you about each service used:

5.1 Anthropic (Claude API) — text generation

For generating editorial plans, post texts, brand analyses and text improvements we use the Claude API by Anthropic, PBC (San Francisco, USA). Data transmitted: brand profile information (name, tone of voice, target audience), website texts (for brand analysis), post topics and existing texts (for improvements). Anthropic does not use API data to train its models. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Third-country transfer: USA, safeguarded by the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). Further information: anthropic.com/privacy

5.2 Google (Gemini API) — image generation & editing

For generating post images we use Google Gemini 3.1 Flash Image (Nano Banana 2). For AI image editing we use Google Gemini 2.5 Flash. For video generation we use Google Veo 2.0. Provider: Google LLC (Mountain View, USA). Data transmitted: image prompts (text descriptions), existing images (for editing), video prompts. In accordance with the Google Cloud data protection terms, Google does not use API data to train models. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Third-country transfer: USA, safeguarded by the EU-US Data Privacy Framework (DPF). Further information: policies.google.com/privacy

5.3 OpenAI (DALL-E 3 API) — image generation (fallback)

As a fallback system for image generation, OpenAI DALL-E 3 may be used. Provider: OpenAI, L.L.C. (San Francisco, USA). Data transmitted: image prompts (text descriptions). OpenAI does not use API data to train its models. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Third-country transfer: USA, safeguarded by the EU-US Data Privacy Framework (DPF) and SCCs. Further information: openai.com/privacy

Important note: only the data necessary for the respective generation is transmitted to AI services (e.g. brand name and tone of voice for post generation). Your email address, your password or other account data is never passed on to AI services.

6. Other third parties & processors

6.1 Supabase — database, authentication & storage

We use Supabase (Supabase Inc., San Francisco, USA) for our database (PostgreSQL), user authentication and file storage. All user data (accounts, posts, brand profiles, images) is stored with Supabase. Our Supabase project is configured in the EU region. A data processing agreement (DPA) is in place with Supabase. Third-country transfer: data processing in the EU; company headquarters in the USA, safeguarded by DPF and SCCs. Further information: supabase.com/privacy

6.2 Vercel — hosting

Our website is hosted on Vercel (Vercel Inc., San Francisco, USA). Vercel processes technical access data (IP address, browser information). A DPA is in place with Vercel. Vercel is certified under the EU-US Data Privacy Framework. Further information: vercel.com/legal/privacy-policy

6.3 Resend — email delivery

For sending transactional emails (welcome email, approval reminders, deletion reminders) we use Resend (Resend Inc., USA). Your email address and your name are transmitted to Resend. Sender address: noreply@socialbuddy.ai. A DPA is in place with Resend. Third-country transfer: USA, safeguarded by SCCs. Further information: resend.com/legal/privacy-policy

6.4 Google OAuth — sign-in

You can optionally sign in with your Google account. In doing so, your name and email address are transmitted to us by Google. We do not gain access to your Google password or other Google services. Using Google OAuth is voluntary — you can also sign in via email/password or magic link. Legal basis: consent (Art. 6(1)(a) GDPR). Further information: policies.google.com/privacy

6.5 Stripe — payment processing

For processing paid subscriptions we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Stripe processes payment data (credit card, SEPA direct debit, etc.) as an independent controller or processor. We do not store any payment data ourselves. Stripe is PCI-DSS certified; any transfer to Stripe, Inc. (USA) is safeguarded by the EU-US Data Privacy Framework and Standard Contractual Clauses (see section 8). Further information: stripe.com/privacy

7. Linking social media accounts

You can optionally link your social media accounts (TikTok, Twitter/X, Pinterest, LinkedIn, Instagram, Facebook) with SocialBuddy.ai to enable automatic posting. The OAuth tokens of the respective platform are stored encrypted (AES-256-GCM) in our database. These tokens are used exclusively to publish posts that you have previously approved — nothing is ever posted without your explicit approval. You can disconnect the link at any time in the settings, upon which the stored tokens are deleted immediately. Legal basis: consent (Art. 6(1)(a) GDPR).

8. Data transfer to third countries

Some of our service providers are based in the USA. The transfer of data to the USA is safeguarded by the following mechanisms:

  • EU-US Data Privacy Framework (DPF) — adequacy decision of the European Commission of 10 July 2023. Applies to: Vercel, Google, Anthropic, OpenAI, Stripe.
  • Standard Contractual Clauses (SCCs) — additional contractual safeguards pursuant to Art. 46(2)(c) GDPR with all US service providers.

Payment processing is carried out via Stripe Payments Europe, Ltd. (Ireland); any transfer to Stripe, Inc. (USA) is safeguarded by the mechanisms mentioned above. Our Supabase project is configured in the EU region.

9. Cookies & tracking

We use exclusively technically necessary cookies pursuant to § 165(3) TKG 2021. These cookies are strictly necessary for the operation of our website and do not require consent:

  • Supabase Auth session cookie — maintains your login session (duration: until logout or session expiry)
  • Locale cookie — stores your language setting (DE/EN)
  • Theme cookie — stores your dark/light mode setting

We do not use any analytics, tracking, marketing or social media cookies. No cross-site tracking takes place. Should we use non-essential cookies in the future (e.g. for web analytics), we will obtain your explicit consent beforehand.

10. Data security

We employ technical and organisational measures to protect your data:

  • Encrypted data transmission (HTTPS/TLS) on all pages
  • Row-Level Security (RLS) on all database tables — each user sees only their own data
  • Encrypted storage of OAuth tokens (AES-256-GCM)
  • Password hashing via Supabase Auth (bcrypt)
  • Optional two-factor authentication (2FA/TOTP)
  • Security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
  • SSRF protection for website analyses (private IP ranges blocked)
  • Input validation on all API endpoints (Zod)
  • API authentication on all protected endpoints

11. Your rights

Under the GDPR you have the following rights:

  • Access (Art. 15) — you can request information about the data we store about you.
  • Rectification (Art. 16) — you can request the correction of inaccurate data. You can edit much of the data yourself in the settings.
  • Erasure (Art. 17) — you can request the deletion of your data. In the settings under "Subscription & Credits" you can schedule your account for deletion yourself (30-day grace period with the option to revoke).
  • Restriction (Art. 18) — you can request the restriction of processing.
  • Data portability (Art. 20) — you can request to receive your data in a machine-readable format.
  • Objection (Art. 21) — you can object to the processing of your data where it is based on legitimate interest.
  • Withdrawal of consent (Art. 7(3)) — you can withdraw consent given (e.g. email notifications, Google login) at any time without affecting the lawfulness of processing prior to withdrawal.

To exercise your rights, contact us at: hello@socialbuddy.ai

12. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your data infringes the GDPR. You can contact both the authority responsible for us and the supervisory authority of your place of residence (Art. 77 GDPR).

Austria (responsible authority):

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Web: www.dsb.gv.at

Germany:

The responsible supervisory authority depends on your federal state. An overview can be found at: www.bfdi.bund.de

Switzerland:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern
Phone: +41 58 462 43 95
Web: www.edoeb.admin.ch

13. Changes to this privacy policy

We reserve the right to amend this privacy policy in order to adapt it to changed legal situations or to changes in our service. The current version can always be found on this page. In the event of material changes, registered users will be informed by email.

14. Contact

If you have questions about data protection or wish to exercise your rights, you can reach us at:
Email: hello@socialbuddy.ai

Last updated: June 2026