Privacy policy
Last updated: 7 October 2026
This policy explains what personal data Aethergrid SRLS processes when you visit socialzen.tech or use the SocialZen platform, why it processes it, and what you are entitled to expect from us. It is written to be read, not endured.
01Who is responsible for your data
The data controller is Aethergrid SRLS, a company based in Italy, VAT no. IT06439890655, which runs the SocialZen service and the sites socialzen.tech and app.socialzen.tech.
For anything about this policy — questions, complaints or exercising your rights — write to privacy@socialzen.tech. We reply within 30 days, usually much sooner.
Two different roles matter here. For your account data — name, email, billing — we are the controller. For the content you prepare and publish with SocialZen (text, images and any personal data they contain) you are the controller and we are the processor: we process it on your instructions and for no purpose of our own.
If you use SocialZen through an agency that offers it under its own brand (white-label), your provider is the agency: the agency is responsible for the data you entrust to it, and we act as its processor.
02What we collect
We collect these categories of data, and nothing more:
| Category | What it contains | Where it comes from |
|---|---|---|
| Account data | Name, email, company name, password hash, role, plan. | From you or whoever invites you, when the account is created. |
| Purchase data | Email, name, company, chosen plan, amount, payment status and the transaction identifier at Stripe or PayPal. | From you and the payment processor. We never see or store the card number. |
| Content | Brands, post text, images, scheduling dates, history of revisions and publications. | From you and the collaborators on your account. |
| Data from Meta (Facebook and Instagram) | See the dedicated section below. | From Meta, only after you authorize the connection. |
| Technical data | IP address, date and time of requests, errors. | Automatically, while you use the service. |
We do not ask for, and do not want, special categories of data — health, beliefs, political opinions, biometric data.
03The data we receive from Meta
To publish on your Facebook Pages and professional Instagram accounts you need to connect them to SocialZen with Facebook Login. During the connection you choose which Pages to authorize. From Meta we receive only:
| Data | What it is for |
|---|---|
| The Facebook identifier (specific to our app) of the person authorizing | Knowing who connected the Pages, and being able to delete everything if they remove the app from Facebook. |
| Name and identifier of the Pages you manage | Showing you which ones to choose from. We keep nothing about the Pages you do not select: the list is deleted within 15 minutes. |
| The access token of each connected Page | Publishing the content you approve. It is stored encrypted (AES-256-GCM) and is never shown or sent to anyone else. |
| Identifier and username of the professional Instagram account linked to the Page | Publishing on Instagram. |
| The identifiers of the posts we publish for you | Showing you the outcome of the publication. |
Threads. If you connect a Threads profile (with a separate login, on threads.net) we receive its identifier, username and display name, and an access token valid for 60 days that we renew automatically while the profile stays connected. The token is stored encrypted (AES-256-GCM) and is used only to publish the posts you approve. We do not read replies, mentions or followers.
X, TikTok and LinkedIn. If you connect one of these accounts we receive its identifier, name (or username) and the access and refresh tokens, stored encrypted (AES-256-GCM). For LinkedIn we also receive, if you authorize it, the list of Pages you administer, so you can choose whether to publish as yourself or as a Page. We use this data only to publish the posts you approve; we do not read messages, comments, followers or analytics of these accounts.
We do not read your messages, comments, followers or your personal profile data. We do not use Meta data for advertising, profiling or model training, we do not sell it and we do not share it with anyone. We use it only to publish what you have approved, on the date you chose.
You can revoke access at any time: from SocialZen (Channels → Disconnect), from Facebook (Settings → Apps and websites) or from Threads (Settings → Account → Website permissions). In every case the token is deleted immediately. Full instructions are on the Data deletion page.
04Why we process it, and on what legal basis
- To provide the service (contract, Art. 6(1)(b) GDPR). Creating your account, storing your content, publishing it on the channels you connected, managing your plan and payments, answering support requests.
- To keep the service secure (legitimate interest, Art. 6(1)(f)). Limits on login attempts, abuse prevention, error diagnosis. We keep this data to a minimum and for a short time.
- To comply with legal obligations (Art. 6(1)(c)). The accounting records Italian law requires us to keep.
We do not make decisions about you by automated means that produce legal effects, and we do not profile you for advertising. No content is published without the approval of a person on your account.
05Who else handles the data
We rely on a small number of providers, each bound by GDPR-compliant terms:
- Hostinger, which hosts our servers in Germany (European Union).
- Stripe and PayPal, which handle payments for plans bought from us. If you buy from a white-label agency, payment happens on the agency's processor.
- The AI assistant you connect (for example Claude, ChatGPT or Gemini) through the MCP connector: it receives only what you ask it to read (brands, calendar, post analytics) and sends the drafts it creates, under the terms of the provider you chose. It receives no tokens, credentials or Meta data, and it cannot approve or publish.
- A transactional email provider, for invitations, password resets and notifications.
- Meta, which receives the content you choose to publish on your Pages and accounts, under its own terms.
The up-to-date list is available by writing to privacy@socialzen.tech. We do not sell personal data to anyone.
06Where the data is stored
Data is stored on servers in Germany, in the European Union. Each client company has its own separate database and its own file area: one client's data never sits in the same tables as another's.
Some providers (Stripe, PayPal, Meta and the AI assistant you connect) may process data outside the European Economic Area. The transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision, and concerns only the data needed for that service.
07How long we keep it
| Data | Retention |
|---|---|
| Account data and content | As long as the account is active. After the account is closed or the subscription ends, it is deleted automatically after 30 days, with an email notice 7 days before. |
| Page tokens and Facebook identifier | As long as the Page stays connected; deleted immediately on disconnection or when the app is removed from Facebook. |
| Threads profile token and identifier | As long as the profile stays connected; deleted immediately on disconnection or when the app is removed from Threads. |
| Tokens and identifiers of X, TikTok and LinkedIn accounts | As long as the account stays connected; deleted immediately when disconnected from SocialZen. |
| List of Pages offered during connection | 15 minutes at most. |
| Invoices and accounting | Ten years, as required by Art. 2220 of the Italian Civil Code. |
| Account activity log (publications, errors, connections, AI assistant operations, with the email of whoever performed them) | 180 days, then deleted automatically. |
| Server logs | 7 days for system logs; web server logs rotate within a few days. |
| IP addresses for login limits | One hour at most, in memory only. |
08How we protect it
- TLS on every connection, with automatically managed certificates.
- Meta tokens and payment credentials encrypted with AES-256-GCM at application level.
- A separate database for each client company, reachable only by the application.
- Passwords stored only as Argon2id hashes; single-use, expiring reset links; changing your password closes all open sessions.
- Calls to Meta signed with the app secret (appsecret_proof).
- Database and internal services reachable only from the server itself, never from the internet.
If a breach were to put your rights at risk, we would notify the Italian Data Protection Authority (Garante per la protezione dei dati personali) within 72 hours and tell you directly without undue delay.
09Your rights
Under the GDPR you can ask us to access your data and get a copy, correct it, delete it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest and withdraw consent where you gave it.
Write to privacy@socialzen.tech and we will act within 30 days, free of charge unless requests are manifestly unfounded or repetitive. You can also contact the Italian Data Protection Authority (www.garanteprivacy.it).
11Minors
SocialZen is a work tool and is not aimed at minors. We do not knowingly collect data from people under 16.
12Changes to this policy
If we change this policy we update the date at the top of the page. When a change substantially affects your rights, we tell account owners by email at least 30 days before it takes effect.
Questions about anything here: privacy@socialzen.tech.