Privacy Policy

Scopeey is a platform for managing content and social media accounts, organizing team work, and using artificial intelligence to help create content. This policy applies to the Scopeey website, platform, and communications related to its services. When content, messages, or other people's data are managed through a workspace, the party that manages the workspace is responsible for having the necessary permissions and for determining the purposes for which that data is used, and Scopeey processes this data to provide the service in accordance with its instructions. Data that external platforms process independently is governed by their own privacy policies.

The data we process depends on how you use Scopeey, the features you enable, and the permissions you grant. It may include:

• Account Data: Such as your name, email address, profile picture, language, country, account settings, and the authentication data needed to sign in and secure your account.
• Workspace Data: Such as workspace and brand names, team members, roles and permissions, settings, and activity logs within the platform.
• Content You Add: Such as text, images, videos, attachments, drafts, notes, campaign data, and publishing schedules that you create, upload, or manage through Scopeey.
• Connected Account Data: Such as account, page, and channel identifiers and names, profile data, access and refresh tokens, and the data needed for the features you enable. Depending on the platform and the permissions you grant, this may include posts, comments, messages, and performance metrics.
• Usage and Device Data: Such as the features and pages you use, access times, IP address, browser type, operating system, language, time zone, and error and technical event logs.
• Payment and Subscription Data: Such as the selected plan, subscription status, transaction and invoice identifiers, amounts, and the billing data made available by the payment provider. We do not store full payment card details; payment details are processed by the payment provider in accordance with its policy.
• Communication and Support Data: Such as contact details, message content, attachments, and information you provide when you contact us or request technical support.

We process data to the extent necessary to provide, operate, and protect Scopeey's services, and for the following purposes:

• Creating and Securing Your Account: To create your account, sign you in, manage your settings, verify access requests, and resolve account issues.
• Operating Platform Features: To manage workspaces, brands, and teams, save content, schedule and publish posts, and display the data, messages, and analytics available according to the enabled features and permissions.
• Running Scheduled Tasks and Integrations: To carry out the posts and tasks you request or schedule, receive updates from connected accounts, and renew access when the platform supports it.
• Remembering Your Preferences: To save your language, display settings, and usage preferences, and to provide an experience that matches your account and workspace settings.
• Providing Support and Service Communications: To respond to your inquiries, diagnose problems, and send notifications about your account, security, subscription, or important changes to the service.
• Managing Subscriptions and Payments: To manage plans, subscription status, billing, payments, renewal, and cancellation, in cooperation with the payment provider.
• Improving the Service: To understand how features are used, measure performance, fix errors, and improve usability. Non-essential analytics tools are subject to privacy choices and applicable consent requirements.
• Security and Abuse Prevention: To detect unauthorized access attempts, fraud, and misuse, and to protect users, their data, and the stability of the platform.
• Meeting Legal Obligations: To comply with applicable legal, accounting, and regulatory requirements, respond to valid legal requests, protect rights, and resolve disputes.

We do not sell your personal data. Depending on the type of processing and the applicable law, we rely on performing the service you request, your consent, our legal obligations, or legitimate interests permitted by law. If a new use requires separate consent, we will ask for it before that use begins.

When you use AI features, we process the instructions, text, images, attachments, and context you provide or select to generate the requested results. We may send the necessary data to the AI service providers we use to operate the feature, and their data processing and retention terms vary by provider and service. You can contact us to find out which provider is used and the data processing terms associated with a feature. Google user data is not sent to these services merely because a YouTube channel is connected, and we do not use it to train general AI models. Avoid entering sensitive personal data or confidential information that you are not authorized to share, and review the results before using or publishing them.

When you connect an account, page, or channel, you grant Scopeey specific permissions to operate the features you choose. Depending on the platform and the enabled features, access may continue in the background to carry out scheduled publishing, receive messages or updates, and maintain the connection. You can disconnect the account from Scopeey or revoke the permissions in the external platform's settings. Disconnecting an account does not delete content already published on that platform.

Permissions vary by platform, account type, and available feature. The platform's consent screen shows the requested permissions when you connect. The permissions associated with Scopeey's integrations include:

• YouTube: youtube.readonly to read the channel data needed to identify and display the channel, and youtube.upload to upload the videos you choose to publish or schedule. The Google user data section below explains this use in detail.
• Google Calendar: We request https://www.googleapis.com/auth/calendar.events.owned. This permission allows Scopeey to see, create, change, and delete events on calendars you own, including your primary calendar. The intended use is to manage events associated with posts you schedule in Scopeey, using the event identifier, title, description, scheduled time, time zone, and related post link as needed. Connecting Calendar alone does not import your calendar events. This integration does not request Gmail or Google Drive access.
• Facebook: public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata, and pages_messaging. Depending on the enabled features, they are used to identify the account and available Pages, read permitted Page data and engagement, publish content, set up Page update delivery via Webhooks, and display and reply to Page messages.
• Instagram: instagram_business_basic, instagram_business_content_publish, and instagram_business_manage_messages. Depending on the enabled features and permissions, they are used to identify the professional account and read its basic data and available content, publish content, and receive, display, and reply to direct messages.
• LinkedIn: openid, profile, and w_member_social. They are used to identify your profile and publish the content you ask to publish to your account, as permitted by the LinkedIn integration.
• X: tweet.read, tweet.write, users.read, media.write, and offline.access. They are used to read the account data and content needed to operate the integration, publish posts and upload media, and renew access to support scheduled tasks and keep the connection active.
• TikTok: user.info.basic and video.publish. They are used to identify the account and publish the videos you choose, in accordance with TikTok's publishing options and restrictions.
• Pinterest: user_accounts:read, boards:read, pins:read, and pins:write. They are used to read the available account data, boards, and Pins, choose the board to publish to, and create the Pins you ask to publish.
• Threads: threads_basic and threads_content_publish. They are used to identify the profile and publish the content you create or schedule.
• Snapchat: user.display_name and user.external_id. They are used to identify the connected account and display its name and identifier. On their own, these permissions do not allow publishing content or reading messages.
• WhatsApp Business: whatsapp_business_management and whatsapp_business_messaging. They are used to manage the connection data for the WhatsApp Business account, and to receive and send messages in accordance with the enabled features and WhatsApp's policies.
• Discord: webhook.incoming. It is used to create a Webhook in the channel you choose in order to send content to it. On its own, this permission does not allow reading the channel's message history.
• Telegram: The integration relies on the bot's permissions within the channel or group, not on OAuth permissions for your personal account. The bot's permissions, its settings, and the type of chat determine what it can send or receive. Grant the bot only the permissions needed for the features you use.

Connecting a platform does not mean that all of its features are available in Scopeey. Functionality depends on the account type, the permissions granted, platform approvals, and the limits of their APIs. We process messages and comments when the integration and the enabled feature require it, within the available permissions.

This section explains how Scopeey accesses Google user data when you connect a YouTube channel, and how it uses, stores, protects, shares, and deletes that data.

• Data We Access: We use youtube.readonly to read the channel data needed to identify and display the channel, such as its ID, name, and handle where available. We use youtube.upload to upload the videos you choose to publish or schedule. Our use is limited to the channel connection and video upload functions described here, and we do not use this integration to read Gmail, Google Drive files, or data from other Google services.
• How We Use the Data: We use channel data to display the connected account and to direct publishing to the correct channel. We send the video, title, description, and publishing options you set to YouTube to carry out your request. We do not use Google user data for targeted advertising or to build advertising profiles, and we do not edit or delete existing videos through the connection and upload functions described in this policy.
• Storage and Protection: We store the connection data needed to operate the integration on the infrastructure we use, including Amazon Web Services (AWS). We use HTTPS (TLS) to protect data in transit, encryption to protect stored access and refresh tokens, and access permissions that determine who can manage the channel within the workspace. Operational access to the data is limited to authorized people and to permitted purposes.
• Sharing and Human Access: We do not sell or rent Google user data. We send the necessary data to Google to carry out uploads, and infrastructure providers may process it on our behalf to operate and protect the service. Human access to Google user data is permitted only in the cases allowed under Google's policy, such as your consent to the review of specific data, investigating abuse, or meeting a legal requirement.
• Retention and Data Refresh: We keep the necessary connection data for as long as the channel is connected and for the purpose you agreed to, subject to the retention periods and data refresh or deletion requirements that apply under the YouTube API policies. A continuing connection does not mean that an outdated copy of channel data is kept indefinitely.
• Revoking Access and Deleting Data: You can disconnect the channel in Scopeey's settings, or remove Scopeey's access from your Google Account at myaccount.google.com/connections. When you disconnect the channel, we stop using it for new tasks and begin deleting the associated access tokens and connection data, and revoking the tokens where Google supports this. We handle YouTube data deletion requests within the periods required by the YouTube API policies, which take precedence over the general deletion period in this policy. You can also request deletion at support@scopeey.com. Disconnecting the channel does not delete videos already uploaded to YouTube.
• Google and YouTube Terms and Policies: Scopeey uses YouTube API Services. Use of YouTube features is subject to the YouTube Terms of Service, available at www.youtube.com/t/terms, and the Google Privacy Policy, available at policies.google.com/privacy, explains how Google processes data.

Scopeey's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, available at developers.google.com/terms/api-services-user-data-policy, including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized AI or machine learning models.

Connecting Google Calendar is optional and separate from Google sign-in and connecting YouTube. A workspace owner or administrator can authorize the connection. Calendar event synchronization is used only when the corresponding feature is available and you enable it.

• Permissions and data: We request https://www.googleapis.com/auth/calendar.events.owned. This permission allows Scopeey to see, create, change, and delete events on calendars you own, including your primary calendar. The intended use is to manage events associated with posts you schedule in Scopeey, using the event identifier, title, description, scheduled time, time zone, and related post link as needed. Connecting Calendar alone does not import your calendar events. This integration does not request Gmail or Google Drive access.
• Purpose and publication status: When event synchronization is enabled, post details and scheduling changes may be sent to Google to create, update, or remove the corresponding event. A calendar reminder indicates a scheduled time and does not confirm successful publication. Any publication confirmation is based on the actual publishing result.
• Storage, sharing, and limited use: We store encrypted access and refresh tokens, granted permissions, connection status, and the Scopeey user and workspace associated with the connection. Offline access allows the enabled integration to work when you are not signed in. Necessary data is shared with Google and infrastructure providers operating the service on our behalf. We do not sell Calendar data, use it for targeted advertising, or use it to develop, improve, or train generalized AI or machine learning models. Use and transfer of Calendar data follow the Google API Services User Data Policy, including Limited Use: developers.google.com/terms/api-services-user-data-policy.
• Disconnecting and deleting data: A workspace owner or administrator can disconnect Calendar in Scopeey settings. This deletes the locally stored Calendar tokens, cancels pending connection attempts, and stops future Calendar access through that connection; a minimal connection record remains until deleted under this policy. Disconnecting does not delete existing Google Calendar events or revoke other Google connections. You can revoke Scopeey’s Google access at myaccount.google.com/connections; this may affect other Scopeey features linked to the same Google account. Request deletion of retained connection data at support@scopeey.com.

Access tokens, integration credentials, and messages require special care. Our protective measures include:

• Protecting Data in Transit: We use HTTPS (TLS) to protect communications between your browser, Scopeey's servers, and the external platforms' APIs.
• Protecting Stored Credentials: We use encryption to protect stored access and refresh tokens and the confidential credentials needed to operate integrations, and we restrict access to them according to operational need.
• Limiting Permissions: We request the permissions needed for the functions the integration provides. You can review the permissions on the platform's consent screen and revoke them in its settings.
• Access Control: Managing connected accounts, publishing, and access to workspace data are subject to the roles and permissions available in Scopeey. Access to operational systems is limited to authorized people.
• Disconnecting Connected Accounts: When you disconnect an account, we stop using its credentials for new tasks, and begin deleting the connection data and revoking access with the platform where it supports this. Some operations may already have been sent to the platform before disconnection, and disconnecting does not delete previously published content.

We do not sell your personal data. We may share the necessary data in the following cases:

• Service Providers: With hosting, storage, payment, email, support, security, analytics, and AI providers, to the extent necessary to operate the services we use them to provide. Some providers, such as payment providers, may process certain data as independent parties in accordance with their own policies.
• Connected Platforms: With the social media platforms and services you connect, to carry out publishing, scheduling, messaging, and other features you enable. Once sent to a platform, content is subject to that platform's policies and the privacy settings you choose.
• Workspace Members: Your data, content, and activity within a workspace may be available to its owner, admins, or members according to their roles and permissions. Review the workspace settings before adding information you do not want to share with your team.
• Legal Requirements: When disclosure is necessary to meet a legal obligation or in response to a court order or a valid legal request from a competent authority.
• Protecting Rights and Safety: When necessary and permitted by law to investigate fraud or misuse, or to protect the security of the service and the rights of Scopeey, its users, and others.
• At Your Request or With Your Consent: When you ask us to share specific data or agree to sharing that requires your consent. Google user data remains subject to the additional restrictions described in its dedicated section.

Your data may be stored or processed outside your country of residence, depending on the locations of the infrastructure and service providers we use. Where a legal data protection requirement applies to such a transfer, we use the safeguards required for the case, such as appropriate contractual commitments. You can contact us to ask about processing locations and the safeguards that apply to your data.

We keep data for as long as it is needed to provide the service and for the purposes described in this policy. Canceling a subscription on its own is not a request to delete the account or workspace; whether data remains accessible after cancellation depends on the plan and the Terms of Service. When we receive a valid deletion request from an authorized person, we aim to complete deletion of the relevant data from our operational systems within 30 days, unless a shorter period applies under the law or the connected platform's policy. We may keep limited records to meet legal or accounting obligations, resolve a dispute, or prevent fraud, to the extent and for the period necessary.

You can request deletion of your account, or of data you are authorized to request deletion of, at support@scopeey.com. We may ask for information to verify your identity and authority before acting. Deleting a personal account is different from deleting a workspace: posts and shared content may remain in a workspace that the team continues to use, depending on their nature and the rights of the party that manages it. If you are a workspace owner, you may need to transfer its ownership or request its deletion separately. We explain the scope and effect of the request when we process it, and once deletion is complete, the data may not be recoverable.

Limited copies of some data may remain in backups until their retention cycle ends, with access to them and their use restricted to recovery and protection purposes. Limited technical logs may be kept when needed for security or compliance. We do not use backups to make data you asked us to delete available again, and if a backup is restored, earlier deletion requests are honored. Periods and restrictions specific to external platforms' data continue to apply.

We use cookies, local storage, and similar technologies to sign you in, protect sessions, and remember settings. We may use additional technologies for analytics or campaign measurement when they are enabled, asking for consent where required. You can manage your choices through the privacy tools available on the website and your browser settings. Blocking essential technologies may affect signing in or how some features work. Your consent to essential cookies is not automatic consent to analytics or marketing.

We use technical and organizational measures to protect data, including protecting communications, restricting access permissions, protecting credentials, monitoring technical events, and backups. Measures vary by the type of data and the nature of its processing, and no electronic method of transmission or storage is entirely free of risk. If an incident occurs that requires notifying you or the competent authorities, we handle it in accordance with the applicable legal requirements.

Scopeey is a service intended for professional use and is not directed at children under 13, or under any higher minimum age set by applicable law. We do not knowingly collect personal data from such children. If you believe a child has provided us with data in violation of this, contact us so we can verify it and take appropriate action.

Depending on the applicable law, you may have the right to request access to your data, correct it, delete it, obtain a copy of it or have it transferred, and restrict or object to its processing. You can withdraw your consent where processing relies on it, without affecting the lawfulness of processing before its withdrawal. You can also disconnect connected accounts and manage the available cookie choices. Send your request to support@scopeey.com; we may verify your identity and authority before responding, taking into account the rights of others and our legal obligations. If your data is managed on behalf of an organization that uses Scopeey, we may refer your request to it or coordinate with it to handle the request. You may also have the right to lodge a complaint with the competent data protection authority.

We may update this policy to reflect changes to our services, data processing practices, or legal requirements. We publish the updated version with its date and notify you of material changes through the platform, by email, or by another appropriate means. If a particular change requires new consent, we will ask for it separately before applying the processing that requires it.

For privacy questions, to exercise your rights, or to request deletion of your data, email us at support@scopeey.com. For technical requests related to YouTube data, you can also contact support@scopeey.com. Please identify the account or workspace and your request, without sending passwords, access tokens, or full payment details. We respond to requests within the applicable legal periods and requirements.