Privacy Policy

Effective 8 September 2026 · SyncSocialFlow is operated by Global Tech Develop Ltd.

1. Who we are

Global Tech Develop Ltd, a company registered in England and Wales (company number 16250551) with its registered office at 124 City Road, London, England, EC1V 2NX ("SyncSocialFlow", "we", "us"), is the controller for the personal data described in this notice, except where we say we act as a processor on your behalf (see section 9). Global Tech Develop Ltd is registered with the UK Information Commissioner's Office (ICO) as a data controller. You can reach us about data protection at support@syncsocialflow.com.

2. What we collect

Account and billing data

Your name, email address and workspace details.
A hashed password, session records, and any API keys you create.
Subscription state and the number of phones on your plan. Card details are handled by our payment processor, Stripe, and are never stored by us.

Content you upload

The videos, images, captions and schedules you put into the service, plus derived files such as thumbnails and clips.
Your content may contain personal data — faces, voices, names. You decide what to upload, and you are responsible for having the right to publish it.

Operational data from your phones and agent

Device labels, model and serial, Android version, battery and storage state, online/offline history and calibration results.
Job logs: which post ran on which phone, when, which step it reached, and whether it succeeded, failed or could not be confirmed.
A failure screenshot stays on the computer that runs the phone, and is never uploaded anywhere. When a step fails, the driver saves a screenshot into a folder of its own for that post. A screenshot taken when a post succeeds is deleted straight away; one kept for a failure is deleted after 14 days. Which computer that is depends on which product you are on, and we would rather say so than round it off:
- Phones you run yourself. The computer is yours, the folder is the agent's own folder on it, and we never receive the picture or hold a copy. To look at one, run postgrid-agent evidence <post-id> on that computer.
- Phones SyncSocialFlow runs for you. The computer is ours, so the picture is held by us, under the same rule: one folder per post, deleted the moment the post succeeds, and deleted after 14 days otherwise. The picture is used to work out why that one post failed and for nothing else, and it is not sent anywhere.
What travels back to us in either case is a set of named facts about the failure: which step of our recipe was running, what that step was doing, which on-screen control our own recipe was looking for, which version of the platform's app is installed on the phone, the phone's model and Android version, and a one-way hash of the names of the controls that were on the screen. Every one of those is either a word we wrote in our own recipe files, a version number the app's maker published, or a number. Nothing that was on the phone's screen — no message, no handle, no name — is in it, and the hash cannot be turned back into what was there. Your caption is not sent either; the one thing we record about it is a single yes or no, whether it ended on an unfinished hashtag or mention, because that changes what the app draws over the button we are about to press.
We also store a note saying that a screenshot exists: how many, how big, when it was taken, when it will be deleted, and which of your computers holds it. Not the file, and not its name or location on that computer.
We count these failure facts across all customers, so that one platform update breaking thousands of phones becomes one repair rather than thousands of support tickets. That counter holds no workspace, no phone and no person — only the hashed description of the breakage and how many times it has been seen.
While you are calibrating a phone or watching it work, the app can show you its live screen. That picture is streamed from your phone through our servers to your browser so you can see it, and is not kept: it is removed from our systems as it is handed to you, and a frame that arrives too late to show you is discarded unread. What calibration saves is the recipe: the names and labels of the controls to press.
The social media handles you register. We do not receive or store your passwords for those platforms — you sign in by hand on the handset, or you connect the platform's own developer credentials that you supply.

Attribution and click data

Where you use SyncSocialFlow's tracked links, we record clicks on those links, including approximate technical details such as the referring page, user agent and IP address of the person clicking, so a sale can be attributed to a post.
Those people are members of your audience, not our customers. For that click data, and for the content you upload, you are the controller and we act as your processor — we handle it only to run the service for you (see section 9). Telling your own audience that these links are measured, in your own privacy notice, is your responsibility as the controller.

Website and app usage

Server logs of requests to our systems, including IP address, timestamps and errors, kept for security and debugging.
We set only the cookies the service needs to work: a session cookie once you sign in, and a record of your cookie choice. We set no advertising or third-party tracking cookies, and we do not use analytics that profile you across other sites.

3. Why we use it, and on what basis

To provide the service — running your schedule, driving your phones, storing your content, showing you the results. Basis: performance of our contract with you.
To bill you — subscriptions and invoices. Basis: contract and legal obligation.
To keep the service secure and working — logs, diagnostics, abuse prevention. Basis: our legitimate interests in a secure, functioning service.
To contact you about the service — failures, offline nodes, billing and material changes. Basis: contract and legitimate interests.
Marketing email — only where you have opted in, and every message carries an unsubscribe link. Basis: consent.

4. Who we share it with

Hosting and storage: Amazon Web Services, in the United Kingdom (London / eu-west-2 region). Your account data, content and logs are held there.
Payments: Stripe, our payment processor. We never see or store your full card details.
Email: account and service emails are sent by us; we do not pass your details to a third-party marketing email company.
The platforms you publish to, because that is the point: publishing your content to your accounts sends it to them, under their own privacy terms, not ours.
Anyone you send data to yourself, for example through outbound webhooks you configure.
Authorities, where we are legally required to.

We do not sell personal data, and we do not share it for third-party advertising.

5. Where it is stored, and international transfers

Your account data, content and logs are stored on Amazon Web Services in the United Kingdom (London region), so they stay in the UK. Two ordinary exceptions: our payment processor, Stripe, may process billing data outside the UK, in which case the transfer is protected by the UK International Data Transfer Agreement or the equivalent Standard Contractual Clauses and Stripe's own safeguards; and when you publish to a social media platform, or send data to a webhook you configured, that data goes wherever that recipient operates, under their terms rather than ours. Your content also lives on your own phones and on the computer running the agent — those are yours to secure.

6. How long we keep it

Account data: for as long as your account is open, then deleted within 30 days of closure.
Uploaded content: until you delete it or close your account, then removed within 30 days, apart from routine backups until those expire (within a further 30 days).
Post history and device logs: while your account is open, then deleted within 30 days of closure.
Failure screenshots: 14 days on the computer that took the picture, and deleted straight away when the post succeeded. For phones you run, that computer is yours and we hold no copy. For phones we run for you, it is ours, and the same 14 days apply.
The named facts about a failed step, and the note saying a screenshot exists: 180 days and 14 days respectively, on your workspace. A job deletes them on those dates; both are also deleted with your account.
The cross-customer breakage counters: kept indefinitely. They contain no workspace, no phone and no person — only a hash of the technical description of a breakage, the app version it affected, and how many times it has been seen.
Billing records: six years, as UK tax and company law requires.

7. Your rights

Under UK GDPR you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict certain processing, ask for it in a portable format, and withdraw consent where consent is the basis. Write to support@syncsocialflow.com and we will respond within one month.

You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — though we would like the chance to put things right first.

8. Security

Passwords are stored hashed, sensitive tokens are encrypted at rest, and access to production data is limited to people who need it. No system is perfectly secure. Two risks are worth naming plainly: enabling USB debugging weakens a handset's own protection, and a failure screenshot captures whatever was on the phone's screen at that moment, which can include account names or message content. A screenshot is never uploaded; it stays on the computer that runs the phone and is deleted on the schedule in section 6. Where you run the phones yourself, that computer is yours, so securing it and the handsets is yours to do; where we run them for you, it is ours.

9. When we are your processor

For your own personal data — your account, your billing, keeping the service secure — we are the controller. But for the content you upload and for the click data of your audience, you decide what is collected and why, so you are the controller and we are your processor: we handle that data only on your instructions, to run the service for you, and we do not use it for our own purposes. Business customers who need a written data processing agreement can request one at support@syncsocialflow.com.

10. Children

The service is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

If we change this notice materially we will tell you by email or in the app before the change takes effect, and update the date at the top.

12. Contact

Global Tech Develop Ltd, 124 City Road, London, England, EC1V 2NX · support@syncsocialflow.com