Privacy policy
Last updated: [Publish date]
This policy explains what personal data Shoku Social collects, why, who we share it with, and your rights. Shoku Social is a product of Shoku LTD. Shoku LTD is the controller of your personal data.
- Company: Shoku LTD, registered in England and Wales, company number 16756983
- Registered office: 113–116 Bute Street, Cardiff, Wales, CF10 5EQ
- ICO registration: ZC127161
- Contact for anything in this policy: hello@shokusocial.com
We've written this in plain English. If anything is unclear, email us.
1. Who this policy covers
This policy covers:
- People who visit shokusocial.com.
- People who create an account at app.shokusocial.com ("the app").
- People who contact us.
Shoku Social is for adults. You must be 18 or over to create an account, and we don't knowingly collect data from anyone under 18.
2. What we collect and why
| What | Examples | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|---|
| Account details | Email address, name if you give it, sign-in records | To create and secure your account and sign you in by email link | Contract |
| Business and brand details | Your website address, business type, logo, colours, fonts, product photos, text we read from your public website | To build your brand kit and make ads that look like your brand | Contract |
| What you create | Prompts, chat edit requests, generated images, videos, voiceovers, captions, your halal strictness settings, saved characters | To provide the service, keep your work, and apply your chosen settings | Contract |
| Connected social accounts | Account IDs, names and profile pictures of the TikTok, Instagram, Facebook or YouTube accounts you connect; access tokens; post IDs and the scheduling details you set | To publish or schedule posts you ask us to publish, and to show you their status | Contract |
| Billing | Plan, credit balance, purchase history. Card details are handled by our payment provider; we never see or store your full card number | To charge you, keep your credit balance correct, meet tax and accounting law | Contract; legal obligation |
| Moderation and safety records | Whether a request or output was blocked under our halal content standard, and why | To enforce our content standard and terms, prevent abuse and improve the checks | Legitimate interests (running a safe service that does what it promises) |
| Usage and device data | Pages viewed, features used, approximate location from IP, browser and device type, error logs | To keep the service working, fix bugs, prevent fraud and abuse (for example, free-credit farming) | Legitimate interests |
| Analytics (only with consent) | Anonymous events such as "generated a demo" or "opened pricing" | To understand which parts of the site help people | Consent; you can withdraw it at any time |
| Marketing emails (only if you opt in) | Your email and whether you opened our emails | To send tips and seasonal planning guides | Consent; unsubscribe link in every email |
| Messages to us | Emails, complaints, reports of a problem | To reply and keep a record | Legitimate interests; legal obligation for complaints |
We don't sell your personal data, and we don't use it for advertising profiles.
Content you upload
If you upload images of other people, or text about them, you must have the right to use them. Our content standard doesn't allow realistic human faces in generated ads.
3. How AI is used
Shoku Social uses AI models from third-party providers to:
- read your website and build your brand kit;
- write copy and scripts;
- generate images and voiceovers;
- check requests and outputs against our halal content standard.
Your prompts and brand materials are sent to these providers only to produce your result. We use their business (API) services, under terms that don't allow them to use your content to train their models. Some of them keep data for a short time for abuse monitoring, as described in their own terms. [Confirm each provider's current retention and training terms before launch.]
AI checks decide whether a generation is blocked under our content standard. A blocked request is refunded, and you can ask a person to review any decision by emailing hello@shokusocial.com. We don't make decisions about you that have legal or similarly significant effects using automated means alone.
4. Data from Google, YouTube, TikTok, Meta and other platforms
When you connect a social account, you choose what to allow on that platform's own permission screen. We use the access we're given only to:
- publish or schedule the posts you approve;
- show your connected account's name and picture in the app;
- show whether a post was published.
We don't use platform data for advertising, and we don't sell it or transfer it to anyone except as needed to provide these features.
YouTube and Google.
- Shoku Social uses YouTube API Services. By connecting YouTube, you agree to the YouTube Terms of Service.
- Google's use of data is covered by the Google Privacy Policy.
- You can revoke our access at any time at Google security settings.
- Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
TikTok, Instagram and Facebook. You can disconnect at any time in the app, or from that platform's own settings for connected apps.
When you disconnect an account or delete your Shoku Social account, we delete its access tokens straight away. We delete other data from that platform within 30 days, unless we must keep a record by law.
5. Who we share data with
We use trusted service providers ("processors") who act on our instructions under written contracts. [Confirm this list against the final app stack before launch.]
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Website hosting, file storage, security, email forwarding | Global network; UK/EU where available |
| Supabase | Database and sign-in | [Region, ideally London] |
| Amazon Web Services | Video rendering | UK (London) |
| Trigger.dev | Running generation jobs in the background | [Region] |
| Anthropic | AI writing, chat edits, content checks | US |
| Google (Gemini API) | AI image generation and text-to-speech | US/global |
| OpenAI | Content moderation; may provide image or voice generation | US |
| ElevenLabs | AI voiceovers | US/EU |
| Stripe (including Link) | Payments, tax and fraud prevention. For many purchases, Stripe's Link acts as the seller of record and is a separate controller of payment data | US/EU |
| Resend | Sign-in and service emails | US/EU |
| Upstash | Rate limiting to prevent abuse | [Region] |
| Sentry | Error monitoring | US/EU |
| PostHog | Product analytics, only with your consent | EU |
We may also share data:
- when the law requires it, or to protect our users, our rights, or the public;
- with a buyer, if Shoku LTD's business is sold or merged, in which case we will tell you.
6. International transfers
Some providers process data outside the UK, mainly in the United States. When they do, we rely on one of these protections:
- the UK–US Data Bridge, for providers certified under it;
- the UK International Data Transfer Agreement or Addendum;
- another safeguard allowed by UK data protection law.
You can ask us for details.
7. How long we keep data
| Data | How long |
|---|---|
| Account, brand kit and your creations | While your account is open. Deleted within 30 days of you deleting your account |
| Connected-platform access tokens | Deleted straight away when you disconnect or delete your account |
| Billing and tax records | 6 years, as UK law requires |
| Moderation and safety logs | 12 months |
| Server and error logs | Up to 90 days |
| Complaints and correspondence | 2 years after it's resolved |
| Analytics | Up to 12 months, then deleted or fully anonymised |
8. Your rights
Under UK data protection law you have the right to:
- see the data we hold about you;
- correct it;
- delete it;
- restrict or object to how we use it;
- take a copy in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email hello@shokusocial.com. We'll reply within one month. You can also delete your account yourself in the app's settings.
9. Complaints
If you're unhappy with how we've handled your data, please tell us first. See our complaints process. We'll acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
[If you serve customers in the EU: add the details of your EU representative under Article 27 EU GDPR here.]
10. Security
We protect your data with:
- encryption in transit (HTTPS);
- access controls, so each account can only see its own data;
- short-lived links for files;
- regular reviews.
No system is perfectly secure. If something goes wrong in a way that affects you, we'll tell you and, where required, the ICO.
11. Cookies
See our cookie policy.
12. Changes to this policy
If we make important changes, we'll email account holders before they take effect and update the date at the top.