Privacy Policy

What Socout does with data, in plain words.

1. Who we are

Socout is operated by Memocult, Dr Ambedkar Street, Taramani, Chennai 600113, Tamil Nadu, India. General contact: support@socout.com. Privacy requests: privacy@socout.com.

2. Businesses and the people who message them

Socout is used by businesses, our customers. A business connects its own WhatsApp Business number and/or Instagram professional account to Socout, and decides what its assistant says.

For the data of the people who message a business (its customers), the business is the data fiduciary (controller) and Socout processes that data on the business's behalf. For the business's own account details, Socout is the one who decides how they are used.

3. What data we handle

• Business account details: the business name, work email, Instagram and WhatsApp account IDs and usernames, and the access tokens Meta gives us when the business connects an account.
• Messages, comments and replies on the connected accounts, with the sender's name, username or phone number as provided by Meta.
• Photos, videos and files that people send to a connected account.
• Support tickets and notes that the business and its team create in Socout.
• Technical logs: which AI model answered, token counts, timing and errors.

4. How we use it

We use this data to run the service for the business that connected the account: to receive messages and comments, to write assistant replies, to show conversations to the business's team in a shared inbox, to keep tickets and a knowledge base, and to keep the service working (the technical logs).

5. Who else handles it (service providers)

• Cloudflare: hosting, our database, file storage, search index, and embeddings through Workers AI.
• Anthropic (Claude) and Google (Gemini): they generate the assistant's replies. The message content of a conversation is sent to them so they can write the reply.
• Meta: the WhatsApp and Instagram platforms the messages travel through.

These providers act as processors on our behalf. Data may be processed outside India by these providers.

6. How it is protected

• Access tokens are encrypted at rest (AES-GCM) in our database.
• Photos and files are stored privately in Cloudflare R2 and shown only through links that expire after one hour.
• Admin access requires a secret key.
• All traffic uses HTTPS.

7. What we do not do

We do not sell personal data. We do not show ads. We do not use customers' messages to train AI models.

8. How long we keep it, and deleting it

We keep data while the business uses Socout. A business can ask us to delete its data at any time, and we complete verified deletion requests within 30 days. See Data deletion for the ways to ask.

9. Instagram and Meta

If a business removes Socout in Instagram (Settings, then Apps and websites), Meta notifies us. We then delete that account's stored access token right away and stop receiving its messages.

When a request comes through Meta's data deletion flow, Meta is given a confirmation code. The status of the request can be checked at socout.com/data-deletion by entering that code.

10. Your rights

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• access the personal data held about you;
• have it corrected;
• have it erased;
• have a grievance addressed; and
• nominate another person to exercise these rights for you.

To use any of them, email privacy@socout.com. If you are a customer of a business that uses Socout, you can also contact that business directly, since it controls that data.

11. Grievance Officer

Grievance Officer (India, Digital Personal Data Protection Act, 2023 and the IT Rules): Pavan Sai, pavansai@memocult.com. We acknowledge a grievance within 48 hours and resolve it within 30 days.

12. Changes to this policy

When we change this policy we update the date at the top of this page.