Privacy Policy — SocialMedia by SEPANAI.COM

Who we are

SocialMedia by SEPANAI.COM is operated by Ahmad Zafarani, trading as Ashna4all, in the United Kingdom. The operator is the data controller for personal information covered by this policy where UK data protection law applies.

What we collect

Depending on the features you use, we may process:

• your SocialMedia account information and internal account identifiers;
• workspace, brand and service settings;
• connected social-platform account identifiers, display names and connection status;
• OAuth access and refresh tokens needed to maintain authorised platform connections;
• permissions or scopes you approve when connecting a platform;
• photos, videos, captions, drafts and other content you upload or create;
• publishing instructions, scheduled times, publishing history and platform response information;
• security and operational records needed to protect and troubleshoot the service.

TikTok

If you connect TikTok, SocialMedia uses TikTok Login Kit and the Content Posting API for the permissions you approve. The current integration requests user.info.basic to identify the connected TikTok account and video.publish to publish video content when you explicitly request or schedule a TikTok publishing action. TikTok separately processes data under its own terms and privacy policy.

Meta and other platforms

If you connect Meta or another supported social platform, we process the account details, permissions, tokens, content and publishing data needed to provide the connection and actions you request. Each connected platform separately processes information under its own terms and privacy policy.

Why we use information

• to provide and secure your account;
• to provide workspaces, brands, drafts, media management, scheduling and publishing;
• to connect social accounts when you ask us to do so;
• to carry out publishing instructions you approve;
• to maintain authorised connections and service continuity;
• to prevent abuse, investigate errors and protect the service;
• to comply with legal obligations and enforce applicable terms.

Private-trial requests

If you request consideration for the private trial, we collect the email address you provide and, optionally, your name. We use this information only to review the request, prevent duplicate or abusive submissions and contact you about trial access. A request does not create an account, start a subscription or grant access. If approved, account creation and any workspace invitation are handled separately. The form records privacy notice version 2026-09-13.

Legal bases

Where UK GDPR applies, our lawful basis depends on the activity. It may include performance of a contract or steps you ask us to take before a contract, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where consent is required. Connecting a third-party social account is optional and requires your authorisation through that platform.

Publishing

Content is sent to a connected platform only following an authorised user action or a schedule previously created by that user. We may transmit the selected media, caption and related publishing information to the chosen platform so it can process the requested post.

Sharing

We do not sell personal information. We may share information only where needed to provide, secure or support the service, including with:

• social platforms you choose to connect, including TikTok and Meta services;
• hosting, database, storage, security and infrastructure providers acting on our behalf;
• professional advisers or authorities where disclosure is required by law or needed to protect legal rights.

Security

Social-platform access and refresh tokens are treated as confidential credentials. SocialMedia is designed to store those tokens in encrypted form and restrict their use to authorised server-side operations. We also use access controls, security headers, rate limiting and other technical measures intended to reduce unauthorised access and abuse.

Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to maintain requested service functionality, meet legal requirements, resolve disputes or protect the service. Connected-platform tokens are no longer used after the relevant connection is revoked or removed, subject to limited backup, security or legal retention where applicable.

International processing

Some service providers or connected platforms may process information outside the United Kingdom. Where UK data protection law requires a safeguard for an international transfer for which we are responsible, we use an appropriate lawful transfer mechanism or other permitted safeguard.

Your rights and choices

Subject to applicable law, you may have rights to request access, correction, deletion, restriction or portability of your personal information, or to object to certain processing. Where processing relies on consent, you may withdraw that consent. You can also disconnect supported social accounts in SocialMedia and revoke access through the connected platform.

Contact and complaints

Privacy questions or requests can be sent to hello@sepanai.com.

If you are in the United Kingdom and remain dissatisfied with how your personal information has been handled, you have the right to raise a concern with the UK Information Commissioner's Office.