Privacy Policy

This Privacy Policy explains how Sooci ("Platform", "we", "us", "our") collects, processes, stores, and protects user data on the social media management platform at https://sooci.net. By using the Platform, you are deemed to have accepted this policy.

1. Data Controller

The party responsible for processing your personal data under the Sooci platform:

2. Data We Collect

2.1 Account and Identity Information

• First and last name
• Email address
• Hashed password (stored with bcrypt — never stored or transmitted in plain text)
• Account creation date, last login date, and time zone
• Subscription plan information

2.2 Social Media Connection Data

When you connect a social media account, only the minimum data required to provide the service is collected:

• OAuth 2.0 access token (stored in the database with AES-256 encryption)
• Refresh token (if available, stored with the same encryption)
• Token expiry and last refresh date
• Social media account platform identifier (external ID)
• Account/page/channel name and username
• Profile photo (cached on our servers; original URL is not stored)
• Connected page, company page, or channel information

2.3 Content and Post Data

• Created, draft-saved, and scheduled post texts
• Uploaded image, video, and document files
• Post schedules, publish statuses, and publish history
• Platform-specific metadata (hashtag groups, location, music ID, tags, alt text, etc.)
• Post type (post, story, reel, carousel, video, document, article)

2.4 Technical and Usage Data

• IP address (for session security and abuse detection)
• Browser type and version, operating system
• Session information and authentication logs
• API request logs (for debugging and security, retained for 90 days)
• Application error logs

3. Platform Integrations and Permissions Used

Sooci uses the official APIs of the social media platforms listed below. For each platform, only the minimum permissions required for the service to work are requested.

3.1 Meta — Instagram

API used: Instagram Graph API (Meta for Developers)

Permissions used (OAuth scopes):

• instagram_business_basic — Read account information and profile photo
• instagram_business_content_publish — Publish photos, videos, reels, carousels, and stories
• instagram_business_manage_comments — Add a user-specified first comment to a published post

Operations performed with these permissions: Publishing content to the user’s connected Instagram Business account, viewing profile information, and optionally sending a first comment. Direct messages (DMs) are not read or replied to. Instagram data is not shared with third parties and is not used for ad targeting or analytics.

Meta Privacy Policy: https://www.facebook.com/privacy/policy/

3.2 Meta — Facebook

API used: Facebook Graph API (Meta for Developers)

Permissions used (OAuth scopes):

• pages_show_list — List Facebook Pages managed by the user
• pages_read_engagement — Read page information and profile photo
• pages_manage_posts — Share text, photos, videos, and links on behalf of the page

Operations performed with these permissions: Publishing content to Facebook Pages where the user is an admin. Personal profile data is not accessed. Facebook user data is not shared with third parties.

Meta Privacy Policy: https://www.facebook.com/privacy/policy/

3.3 LinkedIn

API used: LinkedIn Marketing API / LinkedIn OAuth 2.0

Permissions used (OAuth scopes):

• openid — Authentication via OpenID Connect
• profile — Read first name, last name, and profile photo
• email — Read email address (for account matching)
• w_member_social — Share posts to a personal LinkedIn profile
• r_organization_social — List and read managed company pages
• w_organization_social — Share posts on behalf of a company page

Operations performed with these permissions: Sharing text, images, videos, documents, and articles to the user’s personal LinkedIn profile or company pages where they are an admin. LinkedIn data is not shared with third parties.

LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy

3.4 YouTube (Google)

API used: YouTube Data API v3 (Google APIs)

Permissions used (OAuth scopes):

• https://www.googleapis.com/auth/youtube.upload — Upload videos to a YouTube channel
• https://www.googleapis.com/auth/youtube.readonly — Read channel information and profile photo

Operations performed with these permissions: Uploading videos to the user’s YouTube channel, viewing channel information, and performing token refresh. YouTube/Google data is not shared with third parties.

Google Privacy Policy: https://policies.google.com/privacy

Google API Terms of Service: https://developers.google.com/terms

3.5 X (Twitter)

API used: X API v2 (OAuth 2.0, api.x.com)

Permissions used (OAuth scopes):

• tweet.read — Read tweets and view account information
• tweet.write — Publish tweets
• users.read — Read user profile information
• media.write — Attach images or videos to tweets
• offline.access — Securely refresh the access token (for continuous connection)

Operations performed with these permissions: Sharing text and media posts to the user’s X account and viewing profile information. X data is not shared with third parties.

X Privacy Policy: https://x.com/en/privacy

3.6 TikTok

API used: TikTok Content Posting API (Login Kit + Content Posting)

Permissions used (OAuth scopes):

• user.info.basic — Basic account information
• user.info.profile — Profile information and display
• video.upload — Upload video files
• video.publish — Publish videos and photos to a TikTok account

Operations performed with these permissions: Uploading and publishing video and photo content to the user’s TikTok account (directly or via in-app draft flow). TikTok data is not shared with third parties.

TikTok Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en

4. Purpose of Data Use

The data we collect is used only for the following purposes:

• Service delivery: Publishing content to connected social media accounts on your behalf
• Scheduling: Automatically publishing your planned posts at the specified date and time
• Token management: Checking access token validity and refreshing them automatically
• Profile sync: Keeping connected account profile information up to date
• Security: Detecting unauthorized access and protecting account security
• Service improvement: Detecting and fixing errors, improving performance
• Communication: Sending important service notices, security alerts, and billing notifications

5. Data Security

Industry-standard security measures are applied to protect your data:

• All data transmission occurs over TLS 1.2+ encrypted connections (HTTPS)
• Social media access and refresh tokens are stored in the database with AES-256 encryption
• Passwords are hashed with the bcrypt algorithm; never stored or transmitted in plain text
• Database access is limited to the application server; direct external access is disabled
• Session tokens are stored in cookies with HttpOnly and Secure flags
• CSRF protection is active on all form operations
• Regular security updates and dependency patches are applied
• Server access logs are monitored and anomalous activity is detected

6. Data Sharing

Your personal data is never sold, rented, or shared with third parties for commercial purposes. Data may only be shared in the following cases:

• Social media platforms: Only the minimum data required to publish content on your behalf is transmitted to the relevant platform (token + content)
• Infrastructure providers: Server hosting and database services (under a data processing agreement; they cannot access your data)
• Legal obligation: When required by applicable law, court order, or competent authority

No data is shared with advertising networks, analytics companies, data brokers, or marketing companies.

7. Data Retention Periods

• Account and profile data: For as long as the account is active
• Post and content data: Until the account is deleted or removed by the user
• Media files: Until the account is deleted or removed by the user
• Social media tokens: Until revoked by the platform or the account is disconnected
• API and system logs: 90 days
• Invoice and payment records: 10 years as required by law
• After account deletion: All personal data and media files are permanently deleted within 30 days

8. User Rights

Under Turkey’s Law No. 6698 (KVKK) and the EU GDPR, you have the following rights:

• Right to be informed: You may learn which data about you is being processed
• Right of access: You may request a copy of the data we store about you
• Right to rectification: You may request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): You may request deletion of your account and all your data
• Right to restrict processing: You may request that certain processing activities be stopped
• Right to portability: You may request delivery of your data in a machine-readable format (JSON/CSV)
• Right to object: You may object to processing based on legitimate interest
• Disconnect: You may disconnect any social media account from the platform at any time; this immediately invalidates the related token

To exercise these rights, write to privacy@sooci.net. Requests are answered within 30 days. For identity verification, you must send the request from the email address registered to your account.

9. Cookies

Sooci uses only cookies that are strictly necessary for the service to work:

• Session cookie (sooci_session): To keep you signed in. HttpOnly and Secure flags; not accessible via JavaScript.
• CSRF token cookie: To prevent cross-site request forgery attacks

Advertising cookies, third-party tracking tools (Google Analytics, Facebook Pixel, Hotjar, etc.), behavioral profiling, or retargeting cookies are not used.

10. Children’s Privacy

Sooci is not directed at individuals under 18. We do not knowingly collect personal data from persons under 18. If we discover data belonging to a user we believe is under 18, that data and account are deleted immediately. If you are a parent or guardian and believe your child has created an account, please contact privacy@sooci.net.

11. International Data Transfers

Your data is processed and stored on servers in Turkey. Publishing operations performed via social media APIs involve the servers of the relevant platforms (Meta, LinkedIn, Google, X, TikTok). These transfers occur under those platforms’ own privacy policies and standard contractual clauses.

12. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for those sites’ privacy practices. We recommend reviewing the relevant site’s privacy policy before clicking a link.

13. Policy Changes

This policy may be updated from time to time. Changes are published on this page and the "Last updated" date is revised. Changes that materially affect user rights are notified to your registered email address at least 30 days before they take effect. You can always find the current policy at https://sooci.net/privacy.

14. Data Deletion (Meta and Sooci)

Steps to follow when you remove Meta app permission or request deletion of your data:

• Data Deletion Instructions — disconnect, Meta settings, status check with confirmation code
• Automatic Meta callback: https://sooci.net/webhooks/meta/data-deletion
• Full account deletion by email: privacy@sooci.net

15. Contact and Complaints

For questions, requests, or complaints about our privacy policy:

If your request is not answered or you do not receive a satisfactory response, you retain the right to complain to the Personal Data Protection Authority (kvkk.gov.tr).