Privacy Policy

1. Who is responsible

The controller of your personal data is Tayteldiev Nursultan (individual), Almaty, Kazakhstan. Write to hello@luv-social.com about anything on this page.

2. What we hold

We hold six kinds of data, and no more than these:

• Account: your name, e-mail address, language and time zone, and — if you enable it — the fact that two-factor authentication is on.
• Workspace content: the posts you write, the media you upload, tags, brands, the names of your channels and the people you invited — and, if you use the AI assistant, the brand profile you wrote for it.
• Channel access: the tokens a platform issues so that we can publish for you. They are encrypted and never shown back to you or to us in readable form.
• Publication records: what we sent to a platform, what it answered, and when. This is how the service can tell you what happened to a post.
• Technical records: IP address and browser of a sign-in, a record of each AI assistant request (who asked, when and how large it was), and error reports if the operator has enabled error tracking.
• Payment: the plan, the period and the identifiers our payment provider gives us. We never see or store your card.

3. Why we may hold it

Account data, workspace content and channel access are processed to perform the contract with you — without them the service cannot do the one thing it exists for.

Publication and technical records are processed on our legitimate interest in a service that can explain itself, resist abuse and be debugged. Payment data is processed to comply with tax and accounting law.

We do not use your data for advertising, we do not sell it, and we do not use your content to train models.

4. What we send to the platforms

When you publish, the post text, its attachments and the settings you chose are sent to the platform you selected — that is the act you asked for. What the platform does with them afterwards is governed by the platform, not by us.

We read from a platform only what we need to show you the channel and the result: the account name and picture, the identifier of the published post, and the error text when something fails.

5. YouTube and Google

luv-social uses the YouTube API Services. When you connect a YouTube channel, you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google handles the data it receives under the Google Privacy Policy (https://policies.google.com/privacy).

We ask Google for two permissions: to upload videos to your channel and to read basic information about it. From Google we read the identifier, name, handle and picture of the channel — to show you which channel is connected and to make sure we upload to that one — and the processing status of the videos we uploaded. We do not read your other videos, comments, subscribers or analytics.

When you publish, we send Google the video, its title and description and the settings you chose: who can see it, its category and whether it is made for children. Data received from Google is used only to provide the service, is never used for advertising and is not shared with anyone except the providers listed in section 8.

luv-social’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data received from Google is not used to develop, improve or train AI or machine-learning models. The access we keep for a channel is encrypted (section 10) and deleted as soon as the channel is disconnected; everything else is deleted on the schedule of section 9 and when you delete your data (section 12).

Who receives Google user data. We do not sell Google user data, and we share, transfer or disclose it to no one except: Google itself — the video, its title, description and settings go to YouTube when you publish; the infrastructure providers of section 8 that host and store the service’s data on our behalf (the hosting provider, the object storage and, if enabled, the error-tracking service), each bound by a contract and allowed to process it only to run luv-social; and public authorities, when the law requires it of us. Google user data is never given to advertisers, data brokers or information resellers, and it is never sent to the AI provider of the AI assistant (section 7). Inside luv-social, the connected channel is visible only to members of the workspace that connected it.

How Google user data is protected. The access and refresh tokens Google issues are encrypted at rest with AES-256-GCM under a key of their own workspace, and that key is itself encrypted with a master key kept outside the database. Tokens are decrypted only in memory, at the moment of a request to YouTube; they are never shown to anyone and are removed from every log line. All traffic between your browser, luv-social and Google is encrypted with HTTPS (TLS). Each workspace is isolated by the database itself (row-level security), and operator access to a customer workspace requires two-factor authentication and is recorded in an audit log the customer can read.

You can revoke access at any time: disconnect the channel in luv-social — we then delete the stored access and ask Google to revoke it — or remove luv-social on the permissions page of your Google Account (https://myaccount.google.com/permissions).

6. TikTok

When you connect a TikTok account, you also agree to the TikTok Terms of Service (https://www.tiktok.com/legal/terms-of-service). We ask TikTok for one permission: to publish videos to that account.

Before you publish, we ask TikTok who the account is and what it currently allows: the nickname, username and picture, the privacy levels you may choose, whether comments, Duet and Stitch are turned on, and the longest video it accepts. We show this on the publishing screen.

When you publish, we upload the video to TikTok together with the caption and the settings you chose: the privacy level, the interaction settings and the commercial content disclosure. Data received from TikTok is used only to provide the service and is never used for advertising.

You can revoke access at any time: disconnect the account in luv-social — we then delete the stored access and ask TikTok to revoke it — or remove luv-social in the security settings of the TikTok app.

7. AI assistant

luv-social has an optional AI assistant. It is off in every workspace until the workspace owner or an administrator turns it on, and it works only when a person asks it to. It helps in two places: in the post editor it suggests versions of a post text, adapts a text to other platforms, translates it, suggests hashtags and descriptions (alt text) for images and drafts ideas; in the AI agent chat a person asks about their workspace, and the agent answers and proposes posts, edits and ideas. Nothing the assistant suggests is saved, scheduled or published until a person applies it with a button.

The AI provider is Together AI (Together Computer, Inc., United States), and the requests are processed in the United States. For a suggestion in the editor we send only what it needs: the text you are editing, with the links and @mentions you wrote in it; the options you chose (intent, tone, a short hint, the language); the length limits of the selected platforms; and the brand profile your workspace wrote for the assistant. For alt text we send a reduced copy of the image — at most 1080 pixels on the longer side, without location or other metadata.

In the agent chat we send your messages and, when the agent needs them to answer, what the person in the chat could see in the workspace themselves: the names and platforms of the channels, their publishing rules and free posting slots, the texts, schedules and statuses of posts, the analytics figures of published posts, ideas, brands and the brand profile. The agent reads only with the permissions of the person in the chat, and it cannot save, schedule or publish anything itself.

We never send the AI provider e-mail addresses, names of people, passwords, channel access, the handles of channels or the links of published posts, payment data, original files — or any data received from Google: to the AI a YouTube channel is only "YouTube channel", without its name, identifiers or statistics (section 5).

Together AI does not use this data to train models and does not store the requests or its answers: prompt storage is switched off for our account (zero data retention). If the provider, the region or these conditions change, the assistant stops working in every workspace until an owner or administrator turns it on again. The messages of the agent chat are kept in luv-social for 90 days (section 9).

8. Who else touches the data

We use a small number of providers, each bound by a contract and each with access only to what their job needs:

We do not pass your data to anyone else, except where the law requires it of us.

• the hosting provider that runs the servers and the database;
• the object storage that holds uploaded media;
• the e-mail provider that delivers the letters we send you;
• the payment provider that processes charges;
• the AI provider, Together AI, if your workspace has turned on the AI assistant (section 7);
• an error-tracking service, when the operator has enabled one.

9. How long we keep it

Account and workspace content are kept while the account exists. Everything else is on a schedule the software enforces by itself, every night:

A deleted workspace or account is removed for good after 30 days; until then the deletion can be undone by writing to us.

• The text and platform answers stored with a publication attempt: 90 days, then cleared — the attempt and its outcome remain, the content does not.
• The workspace timeline and in-app notifications: 180 days, then deleted.
• The IP address in an audit record: 365 days, then cleared; the record of the action itself remains.
• The IP address and browser of a session: cleared 365 days after the session was opened, and deleted 7 days after the session expired.
• The body of a payment event, which may carry your name and address: 90 days, then cleared.
• A suggestion of the AI assistant, kept so that a repeated request is not charged twice: up to 8 days, then cleared.
• The record of an AI assistant request — who asked, when and how large it was: 90 days, then deleted; the monthly total remains as a usage counter.
• The messages of the AI agent chat: 90 days, then deleted.
• Backups: 30 days.

10. How it is protected

Channel tokens are encrypted with a key of their own workspace, and the key itself is stored wrapped by a master key held outside the database.

Every workspace is isolated in the database itself, not only in application code: a query that does not name a workspace returns nothing. Operator access to a customer workspace requires two-factor authentication and is recorded in an audit log the customer can read.

11. Your rights

You may, at any time:

Write to hello@luv-social.com. We answer within 30 days.

• ask what we hold about you and get a copy;
• correct anything that is wrong — most of it you can edit yourself;
• delete your account and your data (see the next section);
• object to processing based on our legitimate interest;
• complain to the data-protection authority of the Republic of Kazakhstan.

12. Deleting your data

You can delete your account yourself, from the profile screen, without writing to anyone. What exactly happens then — and what is kept, because the law requires it — is described on the "Deleting your data" page.

13. Children

The service is not intended for children. We do not knowingly create accounts for people below the age of consent in their country; if we learn of one, we delete it.

14. Where the data is processed

The servers of the service are in the country the operator names at hello@luv-social.com on request. The social platforms you connect are outside it, and publishing to them necessarily transfers the post to wherever they operate — that is the purpose of the act.

If your workspace has turned on the AI assistant, what is sent to it is processed by Together AI in the United States (section 7).

15. Changes to this policy

We may update this document. A change that materially affects you is announced by e-mail before it takes effect.

16. Contact

Tayteldiev Nursultan (individual), Almaty, Kazakhstan. Privacy questions: hello@luv-social.com.