The CreatorThe Creator

Legal

Privacy Policy

Last updated: November 2026

This Privacy Policy explains how The Creator (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our service at socialclicks.help. It is written in line with the EU General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG).

1. Controller

The controller responsible for processing your personal data is:

The Creator. You can reach us through the help chat at the bottom right of every page.

2. What we collect and why

We collect only the data necessary to deliver the service:

  • Account data: email address, name (optional), authentication identifiers. Legal basis: contract performance (Art. 6(1)(b) GDPR).
  • Profile data you provide: niche, tone, keywords, phrases, content preferences. Used solely to personalize AI-generated scripts. Legal basis: contract performance.
  • Connected platform tokens: when you connect TikTok, Instagram, YouTube or LinkedIn, we store the OAuth access/refresh tokens. Tokens are encrypted at rest with AES-256-GCM. Used only to publish on your behalf when you initiate it. Legal basis: contract performance + your consent.
  • Instagram data: when you connect Instagram (Instagram API with Instagram Login) you allow two permissions, instagram_business_basic and instagram_business_content_publish. We store your Instagram user id, the follower counts we read from your account and the like and comment counts of the posts we published for you, and we publish the Reels and Stories you create and approve in our app to your own account. We do not read your messages, comments or other people’s data, and we do not sell or share Instagram data with anyone. You can delete all of it at any time: see how to delete your data.
  • Generated content: the viral videos we scrape on your behalf, your swipe decisions, AI-rewritten scripts, and your edits. Legal basis: contract performance.
  • Billing data: processed by Stripe (see Processors below). We store only the Stripe customer ID and subscription status. Legal basis: contract + legal obligation (Art. 6(1)(b) and (c) GDPR).
  • Technical data: IP address, browser type, and request logs, retained briefly for security and debugging. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Google and YouTube data

If you connect YouTube we ask for one permission, to upload videos to your channel (youtube.upload). We store an encrypted access token and an encrypted refresh token in our database (Supabase) and use them only to upload the videos you create and schedule in our app. We do not read your channel’s other videos, comments or analytics, we do not sell Google user data, and we do not share it with anyone except the hosting provider that runs our servers (Vercel). The Creator’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Uploads are made through YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy apply. You can remove our access at any time in your Google security settings or by pressing Disconnect next to YouTube in the app, and you can ask us to delete your data on the data deletion page. We delete it within 30 days.

TikTok and LinkedIn data

If you connect TikTok we ask for two permissions: to read your basic profile (user.info.basic: your TikTok name and avatar, so you can see which account is connected) and to post videos you create and approve in our app (video.publish). Before each TikTok post you choose who can see it, which interactions are allowed and whether it is commercial content, and nothing is sent to TikTok until you accept TikTok’s declaration. If you connect LinkedIn we ask for your name and profile (openid, profile) and permission to post on your behalf (w_member_social), used only for posts you schedule. We store an encrypted access token for each, we do not sell it, and you can disconnect or delete it at any time, see how to delete your data.

3. Processors (data we share)

We use the following service providers (Auftragsverarbeiter) under Art. 28 GDPR. Each is contractually bound to handle your data only on our instructions and to apply appropriate safeguards. Where data leaves the EU/EEA, we rely on EU Standard Contractual Clauses (SCCs).

  • Supabase, Inc. (USA): authentication and database hosting. SCCs in place.
  • Vercel, Inc. (USA): application hosting and edge delivery. SCCs in place.
  • Apify Technologies s.r.o. (Czech Republic, EU): scraping of public viral content based on keywords you provide.
  • GroqCloud (Groq, Inc.) (USA): primary LLM provider for script rewriting. SCCs in place.
  • Google LLC (USA): Gemini API fallback for LLM requests. SCCs in place.
  • Anthropic, PBC (USA): model API access when used. SCCs in place.
  • Stripe Payments Europe Ltd. (Ireland, EU): payment processing.

We do not sell your personal data. We do not use your private inputs to train third-party AI models for the public.

4. Cookies & local storage

We use strictly necessary cookies for authentication (Supabase session). These cookies do not require consent because they are essential to operate the service (§ 25 (2) Nr. 2 TTDSG). We do not use marketing or analytics cookies that profile you.

5. Retention

We retain personal data only as long as necessary for the purposes described:

  • Account and profile data: until you delete your account.
  • Generated content and swipe history: until you delete the relevant rows or your account.
  • OAuth tokens for connected platforms: until you disconnect the platform.
  • Billing records: 10 years where required by German tax law (§ 147 AO).
  • Technical logs: typically 30 days.

6. Your rights

Under GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). You may also withdraw any consent at any time. To exercise these rights, write to us through the help chat at the bottom right of every page. To delete the data we hold from your Instagram account, follow the steps on the data deletion page.

You also have the right to lodge a complaint with a supervisory authority, for Baden-Württemberg this is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

7. International transfers

Several of our processors are located in the United States. We rely on the EU-US Data Privacy Framework (where the processor is certified) and on EU Standard Contractual Clauses (SCCs) as the safeguard mechanism under Chapter V GDPR.

8. Children

The service is not directed at children under 16. We do not knowingly collect personal data from children.

9. Changes to this policy

We may update this policy from time to time. The current version is always available at this URL. Material changes will be communicated by email or in-app notice.

10. Contact

For any privacy questions or data requests, write to us through the help chat at the bottom right of every page.