YOUR SOCIAL HUB
Privacy Policy
Last Updated: July 6, 2026
Who we are (Data Controller)
Your Social Hub ("YSH", "we", "us") is operated by the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
YSocialH OÜ (registry code 17455058)
Tornimäe tn 3, 10145 Tallinn, Harju maakond, Estonia
Privacy contact: info@yoursocialhub.online
Personal data we process
- Account data: name, email, password hash, profile image.
- Content: images, videos, captions, comments and feedback you upload.
- Connected accounts: social account identifiers and access tokens you authorise.
- Billing data: subscription and transaction metadata (card data is handled by Stripe, not stored by us).
- Technical data: IP address, device and browser information, usage events.
How and why we use it — legal basis & retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Provide and operate your account and the platform | Name, email, profile, uploaded content, comments, team/hub memberships | Performance of a contract (Art. 6(1)(b)) | For the life of the account; deleted/anonymised after closure (see Retention) |
| Publish content to connected social accounts | Connected Meta/Instagram account IDs and access tokens, the content you schedule | Performance of a contract (Art. 6(1)(b)) | Until you disconnect the account or close your account |
| Billing and subscriptions | Billing details, plan, transaction metadata (card data handled by Stripe) | Contract (Art. 6(1)(b)) + legal obligation — accounting (Art. 6(1)(c)) | Accounting records kept by Stripe for the statutory period (7 years, Estonia) |
| AI-assisted feedback and insights | Review comment text and content-calendar names sent to our AI sub-processor | Legitimate interest in improving the review workflow (Art. 6(1)(f)) | Cached results retained short-term; not used to train third-party models |
| Transactional email (sign-in, invitations, notifications) | Email address, message content | Performance of a contract (Art. 6(1)(b)) | Delivery logs retained short-term by our email provider |
| Newsletter (product updates and marketing email) | Email address, subscription status | Consent (Art. 6(1)(a)) — double opt-in; withdraw anytime via the unsubscribe link | Until you unsubscribe or withdraw consent |
| Security, fraud and abuse prevention | IP address, device/browser data, reCAPTCHA signals, audit logs | Legitimate interest in keeping the service secure (Art. 6(1)(f)) | Typically up to 12 months |
| Analytics to understand and improve the product | Usage events, pages viewed, approximate location, device data | Consent (Art. 6(1)(a)) — set via the cookie banner | Per provider; see the Cookie Policy |
AI-assisted features
To generate feedback summaries and insights, we send limited content (review comment text and content-calendar names) to our AI sub-processor (OpenAI). We minimise what is sent, and this data is not used to train third-party models. The feature does not make automated decisions producing legal or similarly significant effects about you.
Who we share data with (sub-processors)
We do not sell your personal data. We share it with vetted service providers acting as our processors under data processing agreements, and with other users only where you choose to collaborate (e.g. sharing content for review). The current list is also maintained on our sub-processors page.
| Recipient | Purpose | Location / safeguard |
|---|---|---|
| Amazon Web Services | File storage and content delivery | EU / USA (SCCs) |
| Vercel | Application hosting and web analytics | EU / USA (SCCs) |
| Microsoft Clarity | Product analytics — heatmaps and session replay to improve usability | USA (SCCs) |
| Stripe | Payment processing | EU / USA (SCCs) |
| Meta Platforms (Facebook, Instagram) | Publishing and insights for connected accounts | EU / USA (SCCs) |
| OpenAI | AI feedback summaries and insights | USA (SCCs) |
| Sign-in (OAuth), Analytics, reCAPTCHA | EU / USA (SCCs) | |
| Resend | Transactional and magic-link email | USA (SCCs) |
| Upstash (QStash) | Scheduling/queueing of publication jobs | EU / USA (SCCs) |
If you subscribe to our newsletter, your email address is also processed on our behalf by Loops, Inc. (USA, protected by SCCs), our newsletter delivery provider, on the basis of your consent. See the Loops Privacy Policy.
International transfers
Some of our sub-processors are located outside the European Economic Area (notably in the United States). Where this happens, transfers are protected by the European Commission's Standard Contractual Clauses (SCCs) and/or an applicable adequacy decision, together with supplementary measures where needed.
Cookies and analytics
We use strictly necessary cookies to run the site and, with your consent, analytics cookies to improve it. Analytics are off until you opt in. See our Cookie Policy for the full list and to change your choices at any time.
Where you allow analytics, we use Microsoft Clarity for behavioural analytics (heatmaps and session replay) to see how visitors navigate our pages and to improve them. This data is collected via cookies and similar technologies. To learn more about Microsoft's practices and your choices, see the Microsoft Privacy Statement.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting prior processing). You can:
- Access and update most data directly in your profile settings.
- Request erasure of your account and data via our data deletion page (we action requests within 30 days).
- Contact us at info@yoursocialhub.online to exercise any other right.
Complaints — supervisory authority
If you believe we have mishandled your personal data, please contact us first so we can put it right. You also have the right to lodge a complaint with our lead supervisory authority:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
Email: info@aki.ee · www.aki.ee
Children's privacy
Our services are not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy here and revise the "Last Updated" date; material changes will be communicated where appropriate.
© 2026 YSocialH OÜ. All rights reserved.