Privacy Policy.

Unavoidable Studio Ltd is a company registered in England and Wales. Registered office in Leeds. If you need to contact us about privacy, email privacy@unavoidablysocial.com.

• Account data: your name, email, hashed password, workspace name. Collected when you sign up.
• Connected channel data: when you connect a social account, we store its identifier, display name, avatar URL, and the OAuth access token / app password needed to publish on your behalf. All tokens are encrypted at rest using AES-256-GCM.
• Content you create: posts, drafts, captions, media, scheduled times. Stored in our Supabase database in the EU region.
• Publishing metadata: when a scheduled post is published, we store the platform’s response (post ID, success/failure) and periodically fetch aggregate engagement metrics (likes, comments, reach) if the platform’s API allows.
• Billing data: if you subscribe to a paid plan, Stripe processes and stores your payment details. We store only the Stripe customer ID and subscription status — never card numbers.
• Technical logs: IP address, browser, and request logs are kept for 30 days for security and diagnostics.

• To operate the Service (publish your posts, show your calendar, etc.)
• To send transactional emails (sign-in links, billing receipts)
• To detect abuse and comply with legal obligations
• We do NOT sell your data or share it with advertisers.

• Contract: processing your account and content to deliver the Service you paid for.
• Legitimate interests: security logs, fraud prevention, service improvement.
• Consent: optional product marketing emails (you can withdraw any time from the footer link).

• Supabase (EU region): database, authentication, file storage
• Vercel: web hosting
• Stripe: payment processing
• Resend: transactional email
• Social platforms: when you connect a channel and we publish a post, content is sent to that platform (LinkedIn, Meta, Google, etc.) subject to their own privacy policies.

Account data and content are kept while your account is active. If you cancel or delete your account, we permanently erase all personal data within 30 days, except where we must retain records for tax or legal reasons (Stripe invoices are held for 6 years). You can request immediate deletion at any time by emailing privacy@unavoidablysocial.com or visiting /data-deletion.

Under UK GDPR you have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Restrict or object to processing
• Data portability (export your posts as JSON)
• Complain to the Information Commissioner’s Office (ICO) at ico.org.uk

Where any sub-processor (e.g. Vercel edge functions) may transfer data to the US, we rely on the UK Extension to the EU-US Data Privacy Framework and Standard Contractual Clauses as appropriate.

We use only essential cookies (authentication session, CSRF protection). No advertising or third-party tracking cookies. No cookie banner is required because we do not set non-essential cookies.

We’ll post material changes to this page and email active account holders at least 30 days before they take effect.