Privacy Policy

This Privacy Policy explains what personal data socialz (“socialz,” “we,” or “us”) collects when you use the website at socialz.org, what we do with that data, and the choices you have. socialz is a curated marketplace that matches small and medium businesses (Businesses) with vetted Social Media Managers and UGC Creators (Creators).

We aim to collect only the data we need to operate the matching surface, deliver transactional notifications, and keep the platform safe. We do not sell your personal data.

2.1 Account data

When you create an account, we collect your email address, a hashed password (or an OAuth identifier if you sign in with Google), a chosen role (Business or Creator), and a display name. We rely on Supabase Auth for credential handling and never store raw passwords ourselves.

2.2 Profile data

When you complete the onboarding wizard, we store the answers you provide: niches, content style, work model (REMOTE / ONSITE / HYBRID), country and city, and budget tier. Creators additionally store a headline, optional bio, optional standout metrics, optional tools list, and uploaded portfolio images.

2.3 Marketplace activity

When you contact a Creator we store the message text, sender, recipient, and timestamp. When you write a review we store the ratings, comment, the linked paid project that verifies the review, and a re-derived trust score for the reviewed Creator. Reviews written before October 2026 remain linked to the contact record that verified them.

2.4 Payments and projects

When you book or pay for work, we store the project and its milestones, payment and refund records (amounts, currency, status, and the payment provider’s identifiers), and the deliverables a Creator uploads. Creators who accept direct in-chat payments through Sumit also provide their business name, company type, and Israeli business ID (מספר עוסק / ח.פ.) so their Sumit vendor account can be set up.

2.5 Connected social accounts

If a Creator connects a TikTok account, we store the account’s open ID, username, display name, and avatar URL, along with the permissions the Creator granted. If a user connects an Instagram professional account, we store its account ID and username. If a user connects a Facebook Page, we store the Page’s ID, name, and username. We do not store access tokens for any of these networks.

2.6 Technical data

We process basic technical data inherent to operating a web service: IP address, user-agent string, page paths, response codes, and timestamps. This data is processed by our hosting provider (Vercel) for operational and security purposes such as rate-limiting, debugging, and abuse prevention.

• To operate the Service: authenticate you, render your profile, compute matches, store messages and reviews, and serve uploaded portfolio images.
• To send transactional notifications: for example, emails to a Creator when they receive a new contact message or a new review.
• To improve the Service: product analytics on how flows are used (see PostHog below) so we can fix friction and improve match quality.
• To keep the platform safe: detect fraudulent reviews, prevent abuse, and comply with legal obligations.

We use the following processors to operate socialz. Each processes data only on our instructions and under a data processing agreement.

• Supabase (auth, Postgres database, object storage). Hosts your account, profile, messages, reviews, and uploaded portfolio images.
• Vercel (application hosting and edge network). Serves the web application and processes request metadata.
• Resend (transactional email delivery). Delivers notification emails such as new-contact and new-review alerts on behalf of socialz.
• Sumit (direct in-chat payments). When a Business pays a Creator’s offer in chat, card details are tokenized in the browser by Sumit and the charge, along with its receipt, is processed by Sumit into the Creator’s own Sumit account. Creators who accept these payments share their Sumit account details with us so offers can be charged.
• PostHog (product analytics). Records page views and in-product events, linked to your account when you are signed in, so we can understand how flows are used and improve them.
• Sentry (error monitoring). Receives technical details of errors, such as the page, browser, stack trace, and request metadata, so we can diagnose and fix problems.
• Upstash (rate limiting). Receives keys derived from request data, such as your IP address, so we can limit abusive traffic.
• TikTok (account connection, optional). If a Creator connects a TikTok account, TikTok shares with us the open ID, union ID, display name, username, and avatar of that account.
• Meta (Instagram and Facebook connection, optional). If a user connects an Instagram professional account, Meta shares its account ID and username; if a user connects a Facebook Page, Meta shares the ID, name, and username of the Page they choose.
• Google (OAuth sign-in, optional). If you choose to sign in with Google, Google shares with us your email, profile name, and a stable identifier.

We use a small number of strictly necessary cookies, primarily authentication cookies set by Supabase to keep you signed in across requests. We also store onboarding wizard answers in your browser’s sessionStorage under the keys socialz.onboarding.draft.v1 and socialz.creator-onboarding.draft.v1 so you do not lose progress when navigating or signing up. Our analytics provider, PostHog, sets a first-party cookie and a localStorage entry that hold a pseudonymous identifier so page views and events can be grouped into visits. PostHog loads only after you agree to it in the notice shown on your first visit; your choice is kept in your browser under the key socialz_analytics_consent, and you can change it at any time from "Analytics settings" at the bottom of every page. We do not use advertising cookies.

Your Creator profile (display name, headline, bio, niches, location, work model, budget tier, portfolio, standout metrics, and reviews) is public once a moderator approves it: it appears in the public creators directory at /creators and on your public profile page, and is also used to compute matches for Businesses. Reviews include the reviewer’s display name. Business profiles (name, category, city, description, logo, cover image, and links to the website and social accounts) appear in the businesses directory at /businesses and on the business’s own page, which anyone browsing the Service can see. We ask search engines not to index these pages. A business’s phone number and contact email are not shown there and are not shared with Creators. Neither is its brief (budget, work model and style), which is used to compute matches.

When a Business contacts a Creator, the Creator sees the sender’s display name, email address, and message body in their leads inbox. This is necessary so the Creator can reply outside the Service.

We retain account, profile, and marketplace data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records to comply with legal obligations, resolve disputes, or enforce our agreements.

Portfolio images deleted from your profile are removed from Supabase Storage shortly after the deletion is recorded.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent. To exercise any of these rights, email privacy@socialz.org from the email associated with your account. We will respond within the time required by applicable law.

We use industry-standard safeguards to protect your data, including TLS in transit, encrypted storage at rest via our hosting providers, and least-privilege access to our production database. No service can guarantee perfect security; if we become aware of a breach affecting your personal data we will notify you and any relevant regulators as required by applicable law.

Our processors operate from multiple regions. By using socialz you understand that your personal data may be processed in, and transferred to, countries other than the one in which you reside, including the United States. Where required, we rely on transfer mechanisms such as the European Commission’s Standard Contractual Clauses and equivalent safeguards.

socialz is not directed to children under the age of 18 and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, give reasonable additional notice (for example, by email or an in-product notice).

For privacy questions, requests, or complaints, email privacy@socialz.org.