Privacy policy

Who runs Guru Social Pilot

Guru Social Pilot is operated by GuruAlpha ("we"). Accounts are by invitation only: GuruAlpha creates a workspace for each customer, and the customer invites their own team. The customer that owns a workspace decides which social accounts are connected to it and what is published.

What we collect

Your account. Your name, email address, a scrambled (hashed) form of your password, optional two-factor sign-in settings, your role in each workspace, when you last signed in, and the browser type of each signed-in session.

What you create in the app. Posts, captions, comments, approval notes, uploaded images and videos, templates, link-in-bio pages, brand settings and invoices.

Data from social accounts you connect. When you connect an account (for example a Facebook Page, Instagram professional account, LinkedIn profile or Page, TikTok, YouTube channel, X, Pinterest, Google Business Profile, Threads, Reddit, Tumblr, Mastodon, Bluesky, Telegram channel or Discord webhook), the network gives us an access token and basic profile information: the account's ID, name, username and profile picture. Using that access we read and store:

• the posts we published for you, their links and IDs;
• performance numbers for those posts and the account, such as views, reach, likes, comments, shares, saves, clicks and follower counts;
• comments and replies on your posts, so you can answer them from the inbox;
• for Pinterest, your boards; for Google Business Profile, your business locations; for Facebook, the Pages you manage.

We only request the permissions needed for these features, and we never read your private messages, contacts or other people's private data. If you add a competitor, we read that account's public profile numbers only.

Technical data. Our hosting provider keeps standard server logs, which can include IP addresses. We keep an audit log of important actions (sign-ins, posts, approvals, connections), which records which user did them. We use one essential cookie to keep you signed in. There are no advertising or tracking cookies.

How we use it

• to publish the posts you or your team schedule, at the time you choose, to the accounts you choose;
• to show you how your posts and accounts perform, and to send the reports you ask for;
• to show comments in your inbox and send the replies you write;
• to tell you when a post fails or an account needs reconnecting;
• to run the service: sign-in, security, support, billing and preventing abuse.

We do not sell your data, use it for advertising, or use data from your social accounts for anything other than providing these features to your workspace. We do not use it to train AI models.

Google and YouTube data

Guru Social Pilot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a YouTube channel we use the YouTube API Services to upload the videos you schedule and to read their statistics. By connecting YouTube you agree to the YouTube Terms of Service, and Google's use of data is covered by the Google Privacy Policy. You can remove Guru Social Pilot's access at any time from your Google security settings.

Who we share it with

Only with the services that run the app for us, and only what each one needs:

• the social networks you connect, to publish and to read the data described above;
• Vercel (hosting and media storage) and Neon (database, in Singapore);
• Resend, to send emails such as invitations, approval requests and reports;
• Google (Gemini API, paid tier), only when someone in your workspace uses the AI writing assistant: the text they write, the comment being answered and the brand details they saved are sent to generate suggestions. Google doesn't use this data to train its models;
• Unsplash, only when someone searches for stock photos;
• Rapyd or Stripe, to process invoice payments. We never see or store full card numbers.

Everyone in a workspace can see that workspace's posts, accounts and results, according to their role. GuruAlpha staff can access every workspace to provide the service.

How we protect it

Access tokens from social networks, and API keys, are encrypted (AES-256-GCM) before they are stored and are never sent to your browser. Passwords are hashed with scrypt. Sessions use random tokens stored only as hashes. All traffic uses HTTPS. Two-factor sign-in is available to every user.

How long we keep it

• Access tokens: until you disconnect the account, or it is removed from the workspace. Disconnecting deletes them immediately.
• Posts, media, results and comments: for as long as the workspace exists, so your history and reports stay complete.
• Sessions expire after 30 days. Audit logs are kept for security.
• When a workspace is closed or you ask us to delete your data, we delete it within 30 days, except invoices we must keep by law.

Your choices and rights

• Disconnect any social account at any time on the Accounts page. You can also remove our access in the network's own settings.
• Ask to see, correct, export or delete your data by emailing info@gurualpha.com. See how to delete your data.
• Change your name and password, turn on two-factor sign-in and sign out other devices on your account page.

Children

Guru Social Pilot is a business tool and is not meant for anyone under 18.

Changes

If what the app collects changes, we update this page and the date at the top, and tell workspace owners by email about important changes.