Privacy Policy

1. Information We Collect

1.1 Information You Provide to Us

Account Registration

When you create an Optimate account, we collect:

• Name
• Email address
• Authentication credentials (managed securely via Supabase)
• Account type (e.g. individual, business, agency)
• Optional profile details

Billing Information

If you subscribe to a paid plan:

• Payments on the website are processed by Stripe
• The Android app does not sell subscriptions; Android users subscribe on the website
• Subscriptions bought in the iOS app are processed by Apple through in-app purchase
• We do not store or access card numbers
• Stripe may process billing name, address and payment history

Content and Inputs

We collect content you choose to create or store in Optimate, including:

• AI prompts
• Generated content (captions, hooks, hashtags, ideas)
• Saved posts, drafts and plans
• Uploaded media
• In-app messages or notes

1.2 Social Media Account Data (OAuth Integrations)

Optimate allows you to connect third-party social media accounts using official OAuth authorisation flows. Access is limited to the permissions you explicitly grant. We use only the permissions necessary to provide the features you choose to enable, including authentication, analytics, content scheduling and content publishing where explicitly authorised by you.

You may disconnect integrations at any time via:

• The relevant social platform’s app settings, or
• Optimate’s account settings

TikTok

Via TikTok OAuth, and subject to the permissions you grant, Optimate may access:

• Public profile information
• Video list and metadata
• Analytics and performance metrics
• Permissions required to publish and schedule content on your behalf

Optimate only publishes content when explicitly requested by the authenticated user. We do not access private messages or use TikTok data for advertising or resale.

Instagram & Facebook (Meta)

Via Facebook Login and Instagram Graph API, Optimate may access:

• Profile or Page information
• Insights and analytics (reach, impressions, engagement)
• Media and post performance data

Posting and scheduling features are available only where explicitly authorised by the authenticated user and supported by the relevant platform APIs. Where you have granted comment permissions, Optimate shows comments on your Pages and professional accounts in the Inbox and posts the replies you write there. It does not send direct messages.

LinkedIn

Via LinkedIn OAuth, Optimate may access:

• Your name and profile photo
• The primary email address on your LinkedIn account
• Permission to create posts on your personal profile

Optimate publishes to your personal LinkedIn profile only when you create or schedule a post. Posting to LinkedIn Company Pages is not currently available. Optimate does not read your LinkedIn analytics, comments or messages.

X (Twitter)

Via X OAuth, Optimate may access your public profile data, your posts and their engagement metrics, and replies and mentions of your account. We publish posts and replies only when you create, schedule or send them. We do not send or read direct messages.

Bluesky

Bluesky connects with an app password you create in Bluesky and can revoke there at any time. Optimate publishes the posts you schedule and shows replies and mentions in the Inbox, where you can reply. If your app password allows access to your direct messages, Optimate reads those messages and stores them so they can be shown in the Inbox; it sends only the replies you write.

Mastodon

Mastodon connects with the OAuth sign-in of the server your account is on, which you name when you connect. Optimate registers itself as an app on that server, reads your profile and your own posts with their favourites, boosts and replies, and publishes the posts you schedule. It does not read your home timeline or direct messages. Revoke it at any time under Authorised apps on your server.

Threads

Threads connects with Meta’s OAuth. Optimate publishes the posts you schedule and, where you have granted reply permissions, shows replies in the Inbox and posts your answers.

Pinterest

Pinterest connects with Pinterest’s OAuth. Optimate creates the Pins you schedule and reads their performance.

AI assistants connected through the Optimate connector (Claude, ChatGPT)

If you connect Claude, ChatGPT or another app that supports the connector, that app can read your connected accounts, posts, analytics, brand profile and media once you approve it, and on a paid plan it can also save drafts, schedule, post, edit or cancel posts and make branded designs using your AI credits. We send that app only what each request needs, and we do not receive your conversations with it. What the app does with the results is covered by its own provider’s privacy policy (Anthropic for Claude, OpenAI for ChatGPT). We store the access token issued to that app so it can act for you, and keep it until you disconnect. Disconnect it at any time from Settings → Automations; its access ends straight away.

API keys

If you make an API key in Settings → Automations, software you give it to can do the same things through our API. We store only a one-way fingerprint of the key, never the key itself. For security, we keep a log of each request made with a key: when, which endpoint, the result and the IP address it came from. Revoke a key at any time; it stops working straight away. Deleting your account deletes your keys and their log.

OAuth Tokens

When you connect an account, we securely store:

• Access tokens
• Refresh tokens (if provided)
• Token expiry information

Tokens are stored securely and used only to provide Optimate features.

1.3 Automatically Collected Information

We may automatically collect:

• IP address
• Device and browser type
• Usage data (pages visited, interactions, session duration)
• Log files and error diagnostics
• Device push tokens, if you turn on notifications in the Optimate phone apps
• If you accept cookies on our website, the campaign or link that first brought you to Optimate, including any ad click id, which is saved to your account if you sign up (see our Cookies Policy)

This data helps us operate, secure and improve the Service.

1.4 Partner Programme Information

If you join a partner programme — either promoting a brand to earn commission, or running your own programme so others promote you — we additionally process:

• Your partner profile: display name, and any promotional channels you tell us about
• Payout details, handled by Stripe Connect. Stripe collects and verifies your identity and bank details directly; Optimate never sees or stores your bank details
• Performance records: clicks on your tracked links, sales attributed to you, commission earned and paid
• A hashed form of the referred visitor's IP address, used only to detect fraudulent or self-referred activity. It is stored hashed, never in the clear

What partners can and cannot see. A partner's dashboard shows aggregate performance only — counts of clicks, conversions and commission. It does not identify the customers who came through their link, and partners are contractually prohibited from attempting to identify them. Equally, a brand running a programme sees which partner earned a commission, not that partner's customers.

Commission records are financial records. Unlike most account data they are retained after an account closes, because they evidence what was earned, owed and paid — see section 8.

2. How We Use Your Information

We use personal data to:

• Provide and operate the Optimate Service
• Authenticate users and manage accounts
• Deliver analytics, insights and AI-powered features
• Publish and schedule content to connected social media accounts when requested by you
• Process subscriptions and billing
• Communicate service updates and support requests
• Improve performance, security and reliability
• Comply with legal and regulatory obligations

3. AI-Generated Content

Optimate uses third-party AI service providers (such as OpenAI or similar providers) to generate content, insights and recommendations.

• Inputs are processed securely
• Data is not used to train public AI models
• AI output may be inaccurate or incomplete

You are responsible for reviewing AI-generated content before using or publishing it.

4. Legal Bases for Processing (GDPR)

We process personal data under the following lawful bases:

• Contractual necessity – to provide the Service, and to run a partner programme and pay commission owed under it
• Legitimate interests – improving and securing the platform, detecting fraudulent or self-referred partner activity, and keeping a one-way record of deleted accounts' email addresses so the same address cannot claim a second free trial or free AI credits (see section 8)
• Consent – where required (e.g. marketing, optional integrations)
• Legal obligations – where required by law, including retaining financial records of commission earned and paid

5. Data Sharing & Sub-Processors

We share data only with trusted third parties necessary to operate the Service, including:

• Supabase – authentication, database and storage
• Stripe – billing and payments
• RevenueCat – manages subscriptions bought in the iOS app (Apple processes the payment)
• Stripe Connect – partner payouts and the identity verification Stripe requires before it will pay anyone. Stripe acts as its own data controller for that verification
• AI providers – AI inference and analysis
• fal.ai – AI video generation and lip-sync
• Google (Gemini API) – AI video generation
• Shotstack – video rendering
• Google Firebase Cloud Messaging and Apple Push Notification service – push notifications to the phone apps
• Sentry – error reporting
• PostHog – product analytics
• Brevo – marketing email and contact lists
• Resend – sending our service emails, such as password-reset links, account notices, client reports and approval requests (United States)
• Make.com and Airtable – our sales records: your name and email address when you sign up, contact us or upgrade, with the plan and any message you send (Make.com in the EU; Airtable in the United States)
• Google (Google Analytics 4) – website analytics, only after you accept cookies
• Meta (Meta Pixel and Conversions API) – measuring whether our Facebook and Instagram ads lead to sign-ups and first use, only where you accepted cookies on our website. Your email address is sent to Meta in hashed form
• Cloudflare (Turnstile) – bot protection on sign-up, sign-in and contact forms
• Hosting providers (e.g. Vercel)
• Analytics, monitoring and communication tools

Where you take part in a partner programme, limited data is shared between you and the other side of that programme so commission can be calculated and paid — see section 1.4 for exactly what each side sees.

We ensure appropriate contractual and security safeguards are in place.

6. Google API Services, YouTube & Google Business Profile

If you connect a YouTube channel or a Google Business Profile, Optimate accesses your Google account data through Google APIs, only with your permission and only to provide the features you use.

6.1 What we access and why

• Your YouTube channel — its name, ID, picture and subscriber count, so we can show which channel is connected and report its growth
• Uploading videos — to publish or schedule videos to your channel, with the title, description and settings you choose. We only upload when you ask us to
• YouTube Analytics — views, likes, comments, shares, watch time and subscriber changes, shown on your analytics dashboard
• Comments on your videos — shown in your Optimate inbox so you can read and reply to them. We only post a reply when you send one
• Your Google Business Profile — your locations, the updates you publish, your listing's performance (views, website clicks, calls and direction requests), and your reviews so you can read and reply to them from the inbox

6.2 What we store

We store the access and refresh tokens Google issues so that scheduled posts and analytics keep working, the name and ID of each connected channel or location, the performance figures listed above, and the comments and reviews shown in your inbox. We do not store your Google password.

6.3 Limited Use

Optimate's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the features you use in Optimate
• We do not sell it, and we do not use it for advertising
• We do not use it to develop, improve or train generalised AI or machine-learning models
• Your analytics figures may be sent to our AI provider to generate insights and recommendations shown only to you. That is the only reason it is sent, and the provider does not use it to train its models
• People at Optimate do not read it, except with your permission, where needed for security or to comply with the law, or in aggregated form for internal operations

6.4 YouTube API Services

Optimate uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

6.5 Removing access

You can disconnect YouTube or Google Business Profile at any time from Settings → Connections, which stops Optimate using your Google data. You can also revoke Optimate's access from your Google security settings.

Disconnecting YouTube deletes its data. When you disconnect a YouTube channel, or swap it for another channel, we delete the data we pulled in from that channel: its analytics, its audience and profile details, and the comments in your inbox. We also withdraw Optimate's access in your Google account, unless something still uses it: the same channel connected elsewhere in Optimate, or any Google Business Profile you have connected, because we can't tell which Google account a Business Profile was connected with. If you revoke Optimate's access in your Google account instead, we do the same once Google has told us the access is revoked and it has stayed that way for 7 days without you reconnecting. Reconnecting the channel afterwards starts its history afresh.

To have the other data we hold deleted, such as Google Business Profile data, delete your account or contact us — see section 9.

7. International Data Transfers

Personal data may be processed outside the UK or EEA. Where this occurs, we use appropriate safeguards such as Standard Contractual Clauses or equivalent legal mechanisms.

8. Data Retention

We retain personal data only for as long as necessary to provide the Service, meet legal and accounting requirements, resolve disputes and enforce agreements. Data may be deleted or anonymised when no longer required.

Commission records are an exception. Records of commission earned, owed, reversed and paid are financial records and are retained after an account closes, for as long as UK accounting and tax rules require. Deleting them would destroy the evidence of what a partner was owed and what a brand was billed. Requests to erase this data will be declined on that basis, and we will explain why.

Deleted accounts and free trials. When you delete your account we keep a one-way, salted fingerprint of your email address (not the address itself), the date the account was created and how much of its free AI and free-trial allowance it had used, for 12 months. It is used only to stop the same address starting a second free trial or a fresh free AI allowance by deleting and signing up again, and it is then deleted.

9. Data Deletion & User Rights

You have the right to:

• Access your personal data
• Request correction or deletion
• Object to or restrict processing
• Request data portability
• Withdraw consent where applicable

Account & Data Deletion

You may request deletion of your account and associated data by using in-app account deletion tools (where available), or contacting info@optimatesocial.com. Upon verified request, we will delete or anonymise personal data in accordance with applicable legal obligations. A one-way record of the account's email address is kept for 12 months after deletion (see section 8).

Disconnecting a connected social media account revokes Optimate's access to that account and removes its stored access tokens immediately. Data already pulled in from that account, such as analytics, is deleted when you delete your account, or sooner if you contact us to ask. YouTube is the exception: its data is deleted when you disconnect it or swap it for another channel, or after its access has been revoked in your Google account for 7 days (see section 6.5).

10. Security

We implement technical and organisational measures designed to protect personal data, including secure hosting and encryption where appropriate, access controls and monitoring, and least-privilege access principles. No system is completely secure, but we take reasonable steps to protect your data.

11. Children’s Privacy

Optimate is not intended for individuals under the age of 18. We do not knowingly collect data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the website or within the Service. Continued use of Optimate constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or your data rights, please contact: