Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how MCK Agency LLC, a Colorado limited liability company doing business as Upsocial Agency (“Upsocial,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with the Upsocial App, our website at upsocialapp.com, and related services (together, the “Service”).

The Upsocial App is a business tool. It lets marketing agencies, in-house marketing teams, and business owners plan, create, schedule, approve, publish, and measure social media content across connected social media accounts. It is not a consumer social network, and it is not intended for personal or household use.

Geographic scope. The Service is offered to businesses located in the United States and Canada. We do not currently offer the Service to individuals or organizations in the European Economic Area, the United Kingdom, or Switzerland, and we do not target those regions.

Not affiliated with the platforms. Upsocial is not affiliated with, endorsed by, sponsored by, or officially connected to Meta Platforms, Inc., LinkedIn Corporation, TikTok, Google LLC, YouTube, or X Corp., or any of their subsidiaries or affiliates. All platform names and logos are the trademarks of their respective owners.

By creating an account or using the Service, you agree to this Policy. If you do not agree, do not use the Service.

2. Key Terms Used in This Policy

Customer means the business or organization that subscribes to the Service and is responsible for the account.
Authorized User means an individual the Customer invites to use the Service under its account, such as an employee, contractor, or client reviewer.
Client means a third-party business whose social media accounts a Customer manages through the Service (for example, an agency’s client).
Connected Account means a social media account that a Customer or Client authorizes us to access on their behalf, such as a Facebook Page, Instagram Business or Creator account, LinkedIn Page, TikTok account, YouTube channel, or X account.
Platform Data means information we receive from a social media platform’s API about a Connected Account, including account details, published content, comments, direct messages, and performance metrics.
Customer Content means the captions, images, video, notes, approvals, and other material uploaded to or created in the Service by a Customer or its Authorized Users.

3. Our Role: Controller and Service Provider

Our role depends on the type of information involved, and this matters for how you exercise your rights.

We act as the business (controller) for account registration data, billing data, support communications, and the usage and device data we collect about how the Service is used. We decide how that information is handled.
We act as a service provider (processor) for Customer Content and Platform Data. We handle that information only on the Customer’s documented instructions, to deliver the features the Customer has asked for. We do not use it for our own purposes.

If you are an Authorized User, a Client, or a member of the public whose information appears in Customer Content or Platform Data (for example, someone who commented on a post we help manage), the Customer controls that information. Direct your requests to the Customer. If you contact us instead, we will refer you to the relevant Customer or assist that Customer in responding.

Customers who require a Data Processing Addendum may request one at app@upsocial-agency.com.

4. Information We Collect

4.1 Information You Provide

Account information: name, business name, work email address, password (stored only as a salted hash), job role, phone number, and profile photo.
Workspace and team information: workspace names, Client names, team member invitations, roles and permissions, and approval assignments.
Billing information: billing contact, billing address, plan selection, and payment method. Card numbers are collected and stored by our payment processor, Stripe, and are never stored on our systems. We receive only a token, the card brand, the last four digits, and the expiration date.
Customer Content: captions, hashtags, images, video, documents, internal notes, comments, task assignments, and approval decisions you create or upload.
Support communications: the content of messages you send us, including attachments and any diagnostic information you choose to share.

4.2 Platform Data From Connected Accounts

When you connect a social media account, you are redirected to that platform to sign in and approve a set of permissions. We never ask for, receive, or store your password for any social media platform. We receive only what the permissions you approve allow, and we request the narrowest set of permissions that will deliver the features you have chosen to use.

Depending on the platform and the permissions granted, Platform Data may include:

Account identity: the account or page ID, account name, username or handle, profile picture, account type, and follower or connection counts.
Publishing access: the ability to create, schedule, publish, and delete posts, stories, reels, videos, and articles on the Connected Account at your direction.
Published content and engagement: posts previously published to the Connected Account, along with comments, replies, mentions, and reactions on that content.
Direct messages: messages sent to the Connected Account, where you enable the message management features and the platform permits it.
Insights and metrics: aggregated and per-post performance data such as reach, impressions, engagement, clicks, video views, and audience demographics as the platform provides them.

Platforms we integrate with, or plan to integrate with, include Meta (Facebook Pages and Instagram Business and Creator accounts), LinkedIn, TikTok, YouTube, and X. Not every integration is available at all times, and each platform controls what data it makes available.

4.3 Information Collected Automatically

Device and usage data: IP address, browser type, operating system, device type, referring pages, features used, pages viewed, actions taken, and session duration.
Log and diagnostic data: server logs, timestamps, error reports, and crash data.
Cookies and similar technologies: described in Section 10.

We derive only approximate location from IP address, for security, fraud prevention, and regional formatting. We do not collect precise GPS location.

5. How We Use Platform Data

This section describes commitments we make to you and to the social media platforms whose APIs we use. Platform Data is used only for the following purposes, and only in ways compatible with the permission under which it was obtained:

To authenticate a Connected Account and keep it connected.
To publish, schedule, edit, and delete content on a Connected Account at your explicit direction.
To display your existing published content, comments, and direct messages inside the Service so you can review, organize, and respond to them.
To display analytics and performance reporting for the Connected Account to the Customer and to the Client that owns the account.
To provide customer support relating to that Connected Account, at your request.

What we do not do with Platform Data. We do not sell it. We do not rent, license, or share it with data brokers, ad networks, or advertising platforms. We do not use it for advertising or ad targeting of any kind. We do not use it to build profiles of individuals for our own purposes. We do not use it to train artificial intelligence or machine learning models, whether ours or a third party’s. We do not use it to enrich, augment, or supplement any other dataset. We do not transfer it to any party except the subprocessors listed in Section 8, who act only on our instructions.

We delete or disable access to Platform Data when it is no longer needed for the purpose it was collected for, when you disconnect the account, when the platform notifies us that access has been revoked, or when you delete your account, whichever happens first. See Sections 9 and 11.

5.1 YouTube

The Upsocial App uses YouTube API Services. If you connect a YouTube channel, you agree to be bound by the YouTube Terms of Service at https://www.youtube.com/t/terms. Google’s handling of your information is described in the Google Privacy Policy at http://www.google.com/policies/privacy.

When you connect a YouTube channel, we access your channel ID, name, and profile image; the videos, titles, descriptions, and thumbnails you schedule or publish through the Service; and analytics for your channel and videos, including view, like, and comment counts. We do not access or store the content of comments on your videos. We use this data only for the purposes described in this Section 5 and share it only as described in Section 8.

In addition to disconnecting in the Service, you can revoke our access to your YouTube data at any time through the Google security settings page at https://security.google.com/settings/security/permissions.

When you disconnect a YouTube channel in the Service, delete your account, or ask us to delete your data, we revoke our Google access token and delete the YouTube data we have stored within 7 days. If you revoke access through the Google security settings page instead, we delete it within 30 days. At least every 30 days we confirm that our access to your YouTube data is still authorized, and we refresh or delete stored YouTube data that is more than 30 days old, other than analytics and statistics you have authorized us to keep. Deleting data in the Upsocial App does not delete anything on YouTube; to remove content from YouTube itself, use YouTube directly.

Questions or complaints about how we handle YouTube data can be sent to app@upsocial-agency.com.

5.2 TikTok

When you connect a TikTok account, we access your TikTok display name, profile image, and account ID; the videos and photos you schedule or publish through the Service; and performance data for your posts, such as views, likes, comments, and shares. We send content to TikTok only after you have reviewed it and chosen to post it. Your use of TikTok remains subject to TikTok’s own Terms of Service and Privacy Policy.

You can disconnect TikTok in the Service at any time, or remove the Upsocial App from the connected apps list in your TikTok account settings. Deletion of TikTok data follows the schedule in Section 11.

6. How We Use Other Information

We use the information described in Sections 4.1 and 4.3 to:

Create, secure, and administer accounts and workspaces, and authenticate users.
Provide, operate, maintain, troubleshoot, and improve the Service.
Process payments, manage subscriptions, and send billing notices and receipts.
Send service communications such as security alerts, product changes, scheduling failures, and support replies. You cannot opt out of these while you hold an account, because they are necessary to operate the Service.
Send marketing communications about our products, where permitted by law. You may opt out at any time using the unsubscribe link or by emailing app@upsocial-agency.com.
Detect, investigate, and prevent fraud, abuse, spam, security incidents, and violations of our Terms of Use.
Produce aggregated, de-identified statistics about how the Service is used. These statistics cannot reasonably be used to identify any individual, Customer, Client, or Connected Account, and we do not attempt to re-identify them.
Comply with legal obligations and enforce our agreements.

7. Artificial Intelligence Features

The Service includes AI-assisted features such as caption drafting, content suggestions, and message sorting.

AI processing runs on Amazon Bedrock, operated by Amazon Web Services, Inc., in the United States (AWS US East, Northern Virginia).
When you use an AI feature, the text or content you submit, along with relevant context you have selected, is sent to Amazon Bedrock and a response is returned to you.
We do not use Customer Content, Platform Data, or AI prompts and outputs to train, fine-tune, or improve any AI or machine learning model.
Under the terms that govern our use of Amazon Bedrock, inputs and outputs are not used to train the underlying models and are not shared with the third-party model providers whose models are offered through the service.
AI output can be inaccurate, outdated, or unsuitable. You are responsible for reviewing anything generated by an AI feature before it is published. See our Terms of Use.

8. How We Share Information

We do not sell personal information. We have never sold personal information and we do not do so now.

Inside the Upsocial App, we do not share personal information for cross-context behavioral advertising. There is no advertising or retargeting technology in the application. Our public marketing website is different: it runs advertising and analytics cookies, including the Meta Pixel and Google tags, which under California and some other state laws may be treated as “sharing” personal information for cross-context behavioral advertising. You can opt out at any time, as described in Sections 10 and 13.

Otherwise, we share information only as follows.

8.1 Subprocessors and Service Providers

We use vendors to run the Service. Each is bound by written contract to use the information only to perform services for us, to protect it, and not to use it for their own purposes.

Vendor	Purpose	Data Involved	Location
Amazon Web Services	Cloud hosting, storage, database, media delivery	All Service data	United States (US East, N. Virginia)
Amazon Bedrock (AWS)	AI caption and content generation	Text submitted to AI features	United States
Stripe, Inc.	Payment processing and subscription billing	Billing contact and payment method	United States
Klaviyo, Inc.	Marketing email and lifecycle messaging	Name, email, usage signals	United States
Twilio, Inc. (incl. SendGrid)	Transactional email and in-product notifications (alerts, receipts, resets)	Name, email, phone number	United States

Product usage analytics, error monitoring, and customer support ticketing are handled on our own infrastructure. We do not use a third-party vendor for any of them.

A current list of subprocessors is maintained at upsocialapp.com/subprocessors. We will update that page before adding a new subprocessor that handles Customer Content or Platform Data.

8.2 Other Sharing

Social media platforms: when you publish or schedule content, that content and the instructions needed to publish it are transmitted to the relevant platform. Their handling of it is governed by their own terms and privacy policies.
Within your workspace: Customer Content, Platform Data, and activity are visible to the Customer and to the Authorized Users the Customer has granted access, according to the roles and permissions the Customer configures. Account administrators can see the activity of users in their workspace.
Legal and safety: where required by law, subpoena, court order, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Upsocial, our Customers, or the public. Where legally permitted, we will notify the affected Customer before disclosing their data.
Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality protections. We will notify Customers before their information becomes subject to a materially different privacy policy.
With your direction or consent: for any other purpose we describe to you at the time.

9. How Long We Keep Information

Category	Retention Period
Platform Data for a Connected Account	Deleted within 30 days of disconnection, permission revocation, or account deletion (7 days for YouTube data; see Section 5.1)
Customer Content and workspace data	Kept while the account is active; deleted or anonymized within 30 days of account deletion
Account and profile data	Kept while the account is active; deleted or anonymized within 30 days of account deletion
Encrypted backups	Purged on a rolling cycle, no later than 30 days after deletion from live systems
Billing and tax records	Retained 7 years as required by tax and accounting law
Server and security logs	Retained up to 12 months for security and fraud prevention
Support tickets	Retained up to 24 months after the ticket is closed
Aggregated, de-identified statistics	Retained indefinitely; cannot be linked back to an individual

We may retain information longer where required by law, or where necessary to resolve a dispute, investigate a security incident, or enforce our agreements. In those cases we retain only what is needed for that purpose.

10. Cookies and Similar Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how it is used. We use:

Strictly necessary cookies for authentication, session management, and security. These cannot be disabled without breaking the Service.
Functional cookies to remember settings such as your workspace, calendar view, and time zone.
Analytics cookies to measure feature usage and performance in aggregate.

10.1 Inside the Upsocial App

There is no advertising or retargeting technology in the application. We do not deploy the Meta Pixel, Google advertising tags, or any comparable advertising SDK inside the logged-in product. Cookies there are limited to the three categories above.

10.2 On our marketing website

Our public marketing website at upsocialapp.com uses advertising and analytics technologies, including the Meta Pixel and Google advertising and analytics tags, to measure our advertising and reach people who have visited the site. These may set cookies and share identifiers with Meta and Google.

Where required by law, these load only after you consent through our cookie banner, and you can change or withdraw that choice at any time through the banner or the “Do Not Sell or Share My Personal Information” link in the website footer. Declining has no effect on your ability to use the Upsocial App.

You can also control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in. We honor Global Privacy Control signals on our website and in the application where required by law.

11. Deleting Your Data and Disconnecting Accounts

11.1 Disconnecting a Social Media Account

You may disconnect any Connected Account at any time from Settings, Connections in the Upsocial App. When you do, we revoke our access token with the platform and delete the associated Platform Data from our live systems within 30 days, and from backups within 30 days. YouTube data is deleted from our live systems within 7 days, as described in Section 5.1.

You may also revoke our access from the platform side. For Facebook Pages and Instagram Business and Creator accounts, go to Facebook, Settings and Privacy, Settings, Business Integrations, select Upsocial, and remove it. Instagram Business and Creator accounts connected to the Upsocial App are managed through Facebook Business Integrations, not through the Instagram app’s website permissions. For YouTube, use the Google security settings page at https://security.google.com/settings/security/permissions. TikTok and other platforms provide equivalent controls in their own connected-apps settings.

When a platform notifies us that a user has removed the app, we treat that as a deletion request and delete the associated Platform Data on the same schedule.

11.2 Deleting Your Account

You may delete your account at any time from Settings, Account, Delete Account. You may also submit a deletion request at upsocialapp.com/data-deletion or by emailing app@upsocial-agency.com with the subject line “Data Deletion Request.”

We will verify the request, confirm receipt, and delete or anonymize your personal information within 30 days, with backups purged within 30 days, except for records we are required to keep under Section 9. We will confirm in writing when deletion is complete.

If you are an Authorized User of a Customer’s account, we will refer your request to that Customer, who controls the account.

12. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit (TLS) and at rest, role-based access controls, least-privilege access for staff, network isolation, logging and monitoring, and periodic review of our security practices. Access tokens for Connected Accounts are stored encrypted and are scoped to the permissions granted.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential, using a strong unique password, enabling multi-factor authentication where offered, and promptly removing team members who no longer need access. Notify us immediately at app@upsocial-agency.com if you suspect unauthorized access.

If a breach of security affecting your personal information occurs, we will notify you and any required regulator within the time frames applicable law requires.

13. Your Privacy Rights in the United States

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the following rights, subject to that state’s law and its exceptions:

Right to know or access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties we disclose it to.
Right to delete personal information we collected from you.
Right to correct inaccurate personal information.
Right to data portability, to receive your information in a portable, machine-readable format.
Right to opt out of sale, sharing, or targeted advertising. We do not sell or share personal information or engage in targeted advertising, so there is nothing to opt out of. We do not offer financial incentives for personal information.
Right to limit the use of sensitive personal information. We do not collect sensitive personal information as defined under California law, and we do not use it for inferring characteristics.
Right to non-discrimination for exercising any of these rights. We will not deny service, charge different prices, or provide a different level of service because you exercised a right.
Right to appeal. If we decline your request, you may appeal by replying to our decision. We will respond to an appeal within the period your state’s law requires, and will tell you how to contact your state attorney general if you disagree with the outcome.

To exercise a right, email app@upsocial-agency.com or use the privacy request form in Settings, Privacy inside the Service. We will verify your identity using information already associated with your account before acting, and will respond within 45 days, extendable once by an additional 45 days where permitted, with notice to you. An authorized agent may submit a request on your behalf with written proof of authorization.

Note on business contact information. Under California law, personal information collected in a purely business-to-business context still carries these rights. We apply this section to all Customers and Authorized Users regardless of context.

14. Your Privacy Rights in Canada

If you are in Canada, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial laws including Quebec’s Law 25, Alberta’s PIPA, and British Columbia’s PIPA. You have the right to:

Know why we collect, use, and disclose your personal information, and to have that purpose limited to what a reasonable person would consider appropriate.
Access the personal information we hold about you and be told how it has been used and to whom it has been disclosed.
Request correction of inaccurate or incomplete information.
Withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide the Service.
Request that your personal information be deleted or de-indexed, where Quebec’s Law 25 or other applicable law provides that right.
Receive your computerized personal information in a structured, commonly used technological format, where Law 25 applies.
Be informed before a decision about you is made exclusively by automated processing. We do not make decisions about individuals by automated means alone.

Cross-border transfer notice. Personal information of Canadian users is stored and processed in the United States by us and by the subprocessors listed in Section 8. While outside Canada, that information may be accessible to United States courts, law enforcement, and national security authorities under United States law. By using the Service you acknowledge this transfer. We use contractual safeguards with our subprocessors requiring a comparable level of protection.

Our Privacy Officer can be reached at app@upsocial-agency.com or at the address in Section 18. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada, or your provincial privacy regulator.

15. Age Restriction

The Service is a business tool intended solely for use by adults. You must be at least 18 years old to create an account or use the Service. We do not knowingly collect personal information from anyone under 18. We do not request or store date of birth. If we learn that we have collected personal information from someone under 18, we will delete it promptly. Contact us at app@upsocial-agency.com if you believe this has happened.

16. Where Information Is Processed

We are based in the United States, and we store and process information in the United States, in the AWS US East (Northern Virginia) region. If you access the Service from Canada or elsewhere, you are transferring information to the United States. See Section 14 for the notice that applies to Canadian users.

17. Third-Party Sites and Changes to This Policy

The Service links to and integrates with third-party services, including the social media platforms listed in Section 4.2. This Policy does not apply to them. Review their privacy policies directly.

We may update this Policy. If we make a material change, we will notify Customers by email or through the Service at least 10 days before it takes effect, and we will update the Effective Date above. We will keep prior versions available on request. Continuing to use the Service after a change takes effect means you accept the updated Policy.

18. Contact Us

Questions, requests, or complaints about this Policy or our data practices:

MCK Agency LLC d/b/a Upsocial Agency

200 E. 7th Ave., Apt. 629

Denver, Colorado 80203, United States

Email: app@upsocial-agency.com

Data deletion requests: upsocialapp.com/data-deletion