Privacy Policy

SocialRoute is a tool for planning, approving and publishing social media content. This policy explains what personal data we collect when you use socialroute.net, why we collect it, and how you can remove it.

It applies to your SocialRoute account and to any social accounts you choose to connect. If you are a client reviewing a shared calendar through a share link, only the sections on content and cookies apply to you.

SocialRoute is a service operated by LAZAARWORKS LLC, a limited liability company registered in the State of Nevada, United States, with a registered address at 844 Rainbow Boulevard, Las Vegas, NV 89128, USA. LAZAARWORKS LLC is the data controller responsible for the personal data described in this policy, and you can reach us about it at privacy-socialroute@lazaarworks.com.

We collect only what the product needs to work:

• Account details — your email address and your name. Passwords are handled by our authentication provider and stored hashed; we never see them.
• Your content — projects, business profiles, posts, captions, images you upload, schedules, goals, comments and client notes.
• Connected social accounts — when you link a Facebook Page, an Instagram Business account or a LinkedIn profile, we store that account's ID, its display name, the permissions you granted, and an access token. Tokens are encrypted with AES-256-GCM before they are written to the database.
• Credentials vault — any credentials you choose to store yourself are encrypted with the same scheme.
• Billing — a customer reference and your subscription status from our payment processor. Card numbers never reach our servers.
• Usage records — which AI generations you ran and their token cost, and the outcome of each publishing attempt. These meter your credits and let us show you why a post failed.
• Support messages — anything you send us through the in-app support form.

We do not sell your data, we run no advertising trackers, and we build no advertising profiles.

We use your data to:

• Run the service — store your plan, show your calendar, and publish your posts at the times you choose.
• Generate captions when you ask for them. Only the text you submit and your project's business profile are sent to the AI provider.
• Bill you and meter your credits.
• Notify you about your account, failed publishing attempts and support replies.
• Keep the service secure and diagnose faults.

We do not train any model on your content. Prompts are sent to our AI provider only to return the caption you asked for.

When you connect a Facebook Page or an Instagram Business account, we request only the permissions needed to list the pages you manage and to publish what you schedule.

• We read the list of Pages you administer — their names and IDs — and the ID of any Instagram Business account linked to them.
• We publish the posts, text and images, that you created and scheduled in SocialRoute.
• We do not read your personal profile, your friends, your private messages or your followers' data, and we never post anything you have not scheduled.

The same principle applies to LinkedIn: we store your member ID so we can publish on your behalf, and nothing more.

You can disconnect any account at any time from the project's Publish panel. Disconnecting deletes the stored token immediately.

We use a small number of processors to run the service:

• Supabase — database, authentication and file storage.
• Stripe — subscription and payment processing.
• Our AI provider — caption generation. We use Anthropic by default and may enable other providers.
• Meta and LinkedIn — only to publish what you schedule, to accounts you connected yourself.
• Our hosting provider, which runs the application servers.

We also disclose data where the law requires it. We never share your data for anyone else's marketing.

Access tokens and vault secrets are encrypted with AES-256-GCM. Every table is protected by row-level security, so one account cannot read another's data. All traffic is served over HTTPS.

No system is perfectly secure. If a breach affects your personal data, we will tell you.

We keep your content for as long as your account is open. When you delete something it is removed from the live database. Billing records are kept for as long as tax and accounting law requires.

See the data deletion page for exactly what happens when you close your account.

Depending on where you live, you may have the right to access, correct, export or erase your personal data, and to object to how it is processed. You can edit most of your data directly in the app; for anything else, contact us.

We use strictly necessary cookies only: a session cookie that keeps you signed in, and a short-lived cookie that protects the account-connection flow against cross-site request forgery. Your interface language is stored in your browser. We use no advertising or cross-site tracking cookies.

SocialRoute is not intended for anyone under 16, and we do not knowingly collect their personal data.

If we change this policy we will update the date at the top of this page, and for significant changes we will notify you in the app.

Questions about this policy, or a request concerning your data: privacy-socialroute@lazaarworks.com.