Legal

Privacy policy

How Salamnder Social Studio handles workspace, billing, connection, and publishing data.

Version 2026-10-07. This is the live product policy, not legal advice.

Salamnder Social Studio is a paid multi-tenant drafts and publish service. Each buyer gets a personal workspace. The operator's own studio lock is separate from buyer API keys.

Who is responsible

The controller is Salamnder Social Studio, a sole proprietorship registered in British Columbia, Canada, operating Salamnder Social Studio from Vancouver, British Columbia, Canada. This product has its own database and billing.

Contact: email sal@salamndersocialstudio.com for support, privacy, or security questions, or use the magic-link portal on /account. The official service domain is https://www.salamndersocialstudio.com.

What we collect for the service (Tier A)

  • Email, Stripe customer and subscription ids, plan, a hash of each assistant key, and monthly API/MCP call counts.
  • Drafts and media you or your agent save (captions, thread parts, titles, hosted file metadata and bytes you uploaded).
  • OAuth tokens for the LinkedIn, X, Facebook, Instagram, and Threads accounts you connect, so the studio can publish when you ask.
  • Publish results for posts you asked to send (status, platform ids, URLs, errors).
  • Short security logs (IP, time, errors) used to rate-limit and debug failed calls.

Why we use it

  • Account email: sign-in links, workspace setup, and service or billing notices.
  • Stripe ids and plan: to know which plan you pay for and to manage your subscription.
  • Assistant key hashes and call counts: to recognise your assistant and enforce plan limits.
  • Drafts, media, and scheduled posts: to save, show, and send them when you ask.
  • Social account tokens: only to publish or schedule posts you asked for, and to refresh that access.
  • Publish results: to show what was posted, where, and why a post failed.
  • Security logs: to rate-limit abuse, protect accounts, and fix errors.

We follow Canada's PIPEDA and British Columbia's PIPA. Where the GDPR or UK GDPR applies to you, our legal bases are: performance of a contract for account, billing, drafts, connections, and publishing data (we cannot run your workspace without it); legitimate interests for security logs, rate limiting, and fraud prevention; legal obligation for keeping billing records; and consent for any optional feature, which you can withdraw at any time. We make no decisions about you by automated means that have legal or similarly significant effects.

If you are in California or another US state with a privacy law: we do not sell or share your personal information for cross-context advertising, and we have not done so in the past 12 months. The rights described under Your rights apply to you.

What we do not do by default

  • We do not sell or license drafts for model training or datasets.
  • We do not return OAuth tokens to MCP clients.
  • We do not scrape LinkedIn or X feeds for resale.
  • We do not run ad trackers or advertising cookies on this site.

Subprocessors / hosting

  • Stripe — billing, Checkout, Customer Portal, subscription status.
  • Supabase — database and file storage for workspaces, drafts, connections, and media (United States).
  • Vercel — application hosting and request logs (United States).
  • Resend — transactional email (workspace setup, magic-link sign-in, founder alerts) when configured.

Processing may occur in the United States because Vercel, Supabase, and Stripe run there. Each provider acts on our instructions under its own data processing terms.

International transfers

We operate from Canada and store data with providers in the United States. That means your data leaves the country you live in and may be reachable by courts and authorities there under their laws. For transfers out of the EEA, UK, or Switzerland we rely on our providers' standard contractual clauses or an adequacy decision. For data under PIPEDA or BC PIPA, this notice is our disclosure that personal information is stored and accessed outside Canada.

MCP hosts

When you connect ChatGPT, Claude, Cursor, Gemini, Grok, or another MCP client, that host also processes the tool arguments and results you send through it, under that host's own policies. Salamnder Social Studio stores what the tools save or publish here.

Connected social networks

This covers LinkedIn, X, Facebook, Instagram, and Threads. Tokens are used only to publish when you ask (or to refresh a grant so a later publish can work). Disconnecting an account removes its tokens. Platform API terms still bind you and us. We do not sell API member data.

Your posts

You connect your own social accounts. What you publish — including views-your-own banking commentary — is yours. See Terms.

Retention

Drafts, media, scheduled posts, publish results, and social connections are kept while your workspace exists, including after you cancel, so you can resubscribe without losing work. Deleting your workspace from /account removes them immediately. If you email a deletion request instead, we complete it within 30 days.

  • Sign-in links expire after 20 minutes. Account portal sessions expire after 24 hours.
  • We never store API keys themselves, only a hash and the last four characters. A revoked key stops working immediately; its hash stays with your account record.
  • Your email, plan, and Stripe ids are kept after deletion as a billing record for up to six years, as Canadian tax law requires, then deleted.
  • Request and security logs are kept by our hosting provider under its log retention and are not exported or sold.
  • Stripe holds customer and invoice records under Stripe's own retention.

Content you published to a social network stays there until you delete it on that network.

Security and breaches

Data is encrypted in transit (HTTPS) and at rest by our providers. API keys are stored only as hashes. Social tokens live on the server and are never sent to browsers or MCP clients. Workspace data is isolated by user id. Details are on the Security page. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you by email without unreasonable delay and report it to the Office of the Privacy Commissioner of Canada and any other regulator the law requires, within the time the law sets.

Your rights

You can ask for access, correction, or deletion, and you can withdraw consent for optional future features, from /account (magic-link) or by emailing sal@salamndersocialstudio.com. Export downloads JSON of that workspace's drafts and post metadata. It never includes OAuth token values.

Depending on where you live you may also have the right to data portability, to restrict or object to processing, and not to be discriminated against for using these rights. We answer within 30 days and may ask you to confirm you control the workspace email first. If you are unhappy with our answer you can complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or, if you are in the EEA or UK, your local data protection authority.

Government and third-party requests

We assess every government or third-party request for access to personal data before responding. We verify the request's legal validity and jurisdiction, limit any disclosure to the minimum data the law requires, and challenge requests that are overbroad or lack a lawful basis.

We notify the affected user before disclosing their data unless we are legally prohibited from doing so. We do not provide voluntary bulk access to user data, and we do not build access for surveillance purposes.

Requests should be sent to the operator at sal@salamndersocialstudio.com and must identify the requesting authority, the legal basis, and the specific data sought.

Cookies

A studio_session cookie keeps the operator dashboard signed in. An account_session cookie keeps the buyer portal signed in after a magic link. Provider OAuth connect uses a short-lived PKCE cookie. All of these are strictly necessary to deliver a service you asked for, so no consent banner is shown. There are no advertising or analytics trackers on this site, and we do not respond differently to “Do Not Track” or Global Privacy Control signals because we never track in the first place.

Children

The Service is for adults running their own social accounts. We do not knowingly collect personal information from anyone under 18. If you believe a child has created a workspace, email sal@salamndersocialstudio.com and we will delete it.

Changes to this policy

The version date at the top changes when this policy changes. For material changes we email the address on your workspace at least 14 days before they take effect. Your accepted version is shown on /account.

Dataset contribution (Tier B) — not enabled

Dataset contribution is not enabled. We do not collect drafts or posts for a research or commercial corpus today. A future optional opt-in for an anonymized research or commercial corpus would require separate express consent. It would never be required to use the paid service. There is no toggle that turns this on.

Operator use

The operator studio password does not create a buyer workspace row. Operator publishing uses the personal studio lock, not the paid-buyer consent table.