SoSha User Privacy Policy

 

Last updated: Oct 9, 2026

 

This policy explains how SpeechifAI Inc. handles personal data when you use SoSha, whether you are visiting a social share toolkit or hold a SoSha account with a connected social media profile.

 

If anything here is unclear, contact us at support@sosha.ai.

 

1. Who We Are

 

The controller of the personal data described here is:

 

SpeechifAI Inc.
580 5th Avenue, Suite 820
New York, NY 10036
United States
support@sosha.ai

 

Organizations that create toolkits using SoSha may separately act as controllers in respect of their own campaigns and communities. Where that is so, the organization is responsible for explaining its own processing to you. Section 7 sets out what organizations can and cannot see about you.

 

2. Who This Policy Covers

 

It covers two groups, which are treated differently:

 

• Toolkit visitors — anyone who opens a share toolkit, with or without an account. We process a limited set of data about you (section 3.1).

• Account holders — those who have created a SoSha account, and who may have connected a social media profile. All of this policy may apply to you.

 

3. What We Process

 

3.1 Toolkit visitors without an account

 

An account is not required to use a toolkit. When you open one, and when you interact with or share the content it contains, we process:

 

• your IP address, together with browser and device information;

• which toolkit you visited, and how you reached it;

• how you interacted with it — for example viewing a post or changing its social network;

• the content of any post you share, including any edits you made to it beforehand;

• the destination network for each share, and whether the share completed; and

• clicks on the tracked links contained in shared posts.

 

These records are not linked to your name or your account. They do include your IP address, and we therefore treat them as personal data and limit their retention (section 8).

 

Where you hold an account, share activity from that point onward may be linked to it in order to display your own sharing history. We do not retrospectively attach your identity to earlier anonymous activity.

 

3.2 Account information

 

• your name;

• your email address, where the sign-in method provides a verified one — some identity providers do not, in which case your account has no email address on file;

• an account identifier;

• authentication information;

• your profile picture, where your sign-in provider supplies one;

• account preferences; and

• account creation and sign-in records.

 

If you sign in through an identity provider, we receive from that provider only what is needed to identify you and create the account.

 

If you sign in with Google, we receive your name, email address and profile picture from your Google account and use them only to create your account and sign you in. SoSha's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

 

3.3 Sharing activity

 

• the content of each post you share, including any edits you made to it beforehand;

• dates and times;

• the destination social network;

• identifiers for the relevant content or campaign;

• whether each publishing request succeeded or failed;

• clicks on the tracked links contained in posts you shared; and

 

Toolkit content is written by the organization running the campaign, but you may edit it before sharing. Both what was shared and the fact that you shared it form part of this record.

 

3.4 Connected social media account information

 

Where you connect a social media account, we store details about the connection:

 

• which network it is;

• your account identifier and handle on that network;

• the permissions you granted;

• when the connection expires;

• its status — active, needing reconnection, or revoked; and

• when it was last used.

 

We do not receive your social media password. Authorization is conducted on the network's own systems.

 

3.5 Social network credentials

 

When you connect an account, the network issues us a credential enabling our systems to submit posts you have confirmed, within the permissions granted.

 

The composition of that credential differs by network. Depending on the network, it may comprise:

 

• an access token, which authorizes the request;

• a refresh token, where the network issues one, allowing the connection to be maintained without repeated authorization; and

• a connection-specific cryptographic key, where the network's protocol requires one.

 

Where a network does not issue a refresh token, its access token expires after a fixed period and you will be asked to reconnect.

 

We treat these as sensitive security credentials. We use them only to publish posts you have confirmed, to maintain the connection, to diagnose publishing failures, and to protect the security of the Service. We do not sell them, disclose them to toolkit organizations or to other users, or use them to read your feed, your contacts, your followers or your private messages.

 

3.6 Technical and usage information

 

IP addresses, browser and device information, timestamps, logs, session information, security events, API request metadata, and diagnostic and error information.

 

3.7 AI writing requests

 

When you use SoSha’s AI writing tools, we keep a copy of what is sent to the AI provider and of the text it returns, together with the account or toolkit visit it relates to. We use these copies only to review the quality of the AI-generated text and to detect and prevent abuse of the tools. We do not use them for any other purpose.

 

4. Why We Process It, and on What Legal Basis