Privacy Policy

Social Assembly is an AI coaching platform for content creators, operated from South Africa. In the language of the Protection of Personal Information Act 4 of 2013 (“POPIA”), we are the responsible party for the personal information described here.

• Responsible party: [Company legal name — owner to supply], trading as Social Assembly
• Legal status: [Legal status — owner to supply]
• Registration number: [Registration number or “not registered” — owner to supply]
• Physical address: [Physical address — owner to supply]
• Phone: [Phone number — owner to supply]
• Email: support@socialassemblyhq.com

Our information officer is responsible for how we handle personal information and for answering requests and complaints about it.

• Name: [Information officer’s full name — owner to supply]
• Email: [Information officer’s email — owner to supply]
• Phone: [Phone number — owner to supply]
• Address: [Physical address — owner to supply]

• Account information — your name, email address and a securely hashed password. We never see your password in plain text.
• Consent record — the date and time you accepted this policy and the Terms, and which version you accepted.
• Coaching profile — your answers to our onboarding interview, plus your niche, platforms, audience and goals. This is what allows the coaching to be about you rather than generic.
• Content you submit for review — videos and images you upload for a pre-post audit.
• Voice recordings — when you answer by voice instead of typing, we transcribe the audio to text.
• Conversations — your messages with the coach and the coaching history built from them.
• Connected social accounts — if you choose to connect Instagram or TikTok, we receive your handle, follower and engagement figures, and post-level metrics. We do not receive your social account password.
• Payment records — subscription status and transaction references. Card details are handled by our payment provider and never reach our servers.
• Your IP address — used to limit abuse and spam (rate limiting and, once switched on, a bot check), and recorded in our hosting and security logs.
• Technical and usage data — device and browser type, the features you use, and logs of AI model usage (volume, latency and cost) used to operate and price the service.
• Visitor statistics — page views, referring site, country and device type, counted without cookies. Visitors are counted with a short-lived anonymous value that is discarded within 24 hours, so we cannot identify you from these statistics.

• To deliver the service you asked for — video audits, chat coaching, content plans and monetisation advice.
• To personalise coaching to your niche, audience and goals.
• To meter usage against your plan and to bill you.
• To keep the service secure and to prevent abuse and spam.
• To understand and improve how the product performs.

We rely on your consent, on the performance of our contract with you, on our legal obligations (for example, keeping payment records) and on our legitimate interest in keeping the service secure, as our lawful bases under POPIA. You may withdraw consent at any time, though doing so may mean we can no longer provide the service.

We do not sell your personal information, and we do not use your content to train AI models.

We share personal information only with service providers (“operators” under POPIA) who process it on our behalf, under contract, to run the service:

• Vercel Inc. (United States) — hosts the website and app, and provides cookie-free visitor statistics (Vercel Web Analytics). Processed in: global edge network; our server functions run in Dublin, Ireland.
• Supabase Inc. (United States) — database, sign-in (authentication) and private file storage. Processed in: Ireland (AWS eu-west-1).
• Render Services Inc. (United States) — runs our two AI coaching services (monetisation advice and video coaching). Processed in: Frankfurt, Germany.
• Upstash Inc. (United States) — rate limiting and abuse prevention, which processes your IP address. Processed in: Ireland (AWS eu-west-1).
• Google LLC (Gemini API) (United States) — video and image analysis, coaching conversations, voice transcription and image generation. Processed in: United States and other countries.
• OpenAI (United States) — language models for monetisation advice and onboarding. Processed in: United States.
• Zernio ([Zernio’s country — owner to supply]) — connects your social accounts, reads their analytics and publishes posts you schedule. Processed in: [Zernio’s processing region — owner to supply]. Used only if you connect a social account.
• Paystack ([Paystack contracting entity and country — owner to supply]) — card and subscription payments; your card details go straight to Paystack and never reach us. Processed in: [Paystack processing region — owner to supply]. Used only when you buy a paid plan.
• Solana Pay (public Solana blockchain) (worldwide (decentralised network)) — USDC payments. The payment, your wallet address and a payment reference linked to your account are recorded permanently on a public blockchain and cannot be deleted by us or anyone else. Processed in: worldwide. Used only if you choose to pay with Solana.
• Cloudflare Inc. (Turnstile) (United States) — a spam and bot check on the sign-up, sign-in and password-reset forms, which processes your IP address and browser signals. Processed in: global network. Used only once the check is switched on.

Our sign-in provider may change. If it does, we will update this policy, including the list below, before the change takes effect.

The coach’s voice clips are recorded in advance. No personal information is sent to the voice provider.

We may also disclose information where the law requires it, or to establish, exercise or defend a legal claim.

Section 72 of POPIA requires us to tell you when your information crosses the border. It does. Our database, storage, server functions and rate limiting are in Ireland, and our AI coaching services are in Frankfurt, Germany (both in the European Union). Our hosting company is based in the United States and serves the site from a global network. Our AI providers (Google and OpenAI) process data in the United States and other countries.

We only use providers who are bound by contractual terms requiring a level of protection comparable to POPIA. Where that is not possible, for example on a public blockchain, we say so above and the feature is optional. By using Social Assembly you consent to these transfers, which are necessary to provide the service.

• Account, coaching profile, conversations, reviews and plans — for as long as your account is open. Deleted within 30 days of a verified deletion request.
• Uploaded videos and images for review — not kept by us. Google deletes them after about 48 hours.
• Media scheduled for posting — until it is published, then deleted.
• Voice recordings — not kept. The transcript is kept with your account and deleted with it.
• IP addresses used for rate limiting — deleted automatically within 1 hour.
• Hosting and security logs (which include IP addresses) — 30 days.
• AI usage and cost logs — 24 months, then deleted.
• Payment records — 5 years after the transaction, as South African tax law requires, even after your account is closed.
• Backups — overwritten within 30 days, so deleted data leaves our backups by then.

• Encryption in transit (HTTPS) for all traffic.
• Row-level security in the database, so one creator’s data cannot be read by another.
• Cost and internal operational logs restricted to privileged server access and never exposed to the browser.
• Secrets held in server-side environment configuration, never in client code.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

Under POPIA you have the right to:

• Ask what personal information we hold about you, and receive a copy.
• Ask us to correct or complete information that is inaccurate.
• Ask us to delete your information — see our data deletion page.
• Object to processing in certain circumstances, including direct marketing.
• Withdraw consent where consent is our basis for processing.
• Complain to the Information Regulator.

To exercise any of these, email support@socialassemblyhq.com or our information officer. We acknowledge requests within 5 business days and respond within the time the law allows.

Information Regulator (South Africa) — Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Phone: 010 023 5200. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za. Website: inforegulator.org.za.

Social Assembly is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

We may update this policy as the product changes. We will post the revised version here with a new effective date, and where changes are significant we will tell you in the app or by email.