Privacy Policy

Last updated: October 23, 2026

1. Introduction

The Social Tools ("we," "our," or "us") provides a comment and message moderation and automation platform. It ingests comments and messages from connected social media accounts, applies the workflow rules you define, can draft or post AI-written replies, tracks clicks on the links you share, and, if you install our Shopify app, Social Tools: Ad Comments, attributes your store's orders to those links. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, platform, and related services (collectively, the "Service").

We are committed to protecting your privacy. If you have questions or concerns about this policy, please contact us at [email protected].

2. Definitions

"Personal Data" means any information relating to an identified or identifiable individual.

"Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.

"Content" means comments, messages, posts, and associated metadata ingested from your connected social media platforms.

"Connected Account" means a social media account you link to the Service via OAuth.

"Connected Store" means a Shopify store that has installed our Shopify app, Social Tools: Ad Comments.

"Workflow" means the automated moderation rules you configure within the Service.

3. Information We Collect

3.1 Information You Provide to Us

Account Information: When you register, we collect your name, email address, and authentication credentials (managed by Clerk, our identity provider). If you sign up on our website and subscribe to a paid plan, we collect billing information (managed by Stripe, our payment processor — we do not store full credit card numbers on our servers). If you install our app from the Shopify App Store, Shopify bills you instead (section 7.1).

Accounts Created from Shopify: If you install our app from the Shopify App Store, we create your account from your Shopify staff identity instead of a sign-up form. From Shopify we receive and keep your Shopify user ID, name and email address; whether Shopify has verified that email address; whether you are the store owner or a collaborator; the store's name and myshopify.com address; and the store owner's email address, which we use only if Shopify does not give us yours. We use these to create your account and workspace, to sign you in to our web app from Shopify admin with a single-use link instead of a password, and to send you account email.

Social Media Connections: When you connect a social media account via OAuth, we receive access tokens and basic profile information (account name, profile image, user ID) from that platform. Access tokens are encrypted at rest using AES-256-GCM.

Website Content (Knowledge Base, Optional): If you add your own website as a knowledge source, we crawl the public pages of a domain you have verified, respecting its robots.txt and noindex rules, and index their text so AI reply drafts can draw on it.

Workflow Configuration: The moderation rules, conditions, and actions you define, including keyword lists, sentiment thresholds, and automated response templates.

Team & Workspace Data: If you use team features, we collect team member email addresses, names, and role assignments for access management. Team invitations are sent to the email addresses you provide.

Support Communications: Information you share when contacting our support team, including email correspondence and support ticket content.

3.2 Information Ingested from Your Connected Platforms

The Service ingests comments, direct messages and associated metadata from the social media platforms you connect, where the platform and your connection allow it. This includes:

• Comment and message text
• The author's platform user ID, username or display name, and profile image URL
• The platform's original record of the comment or message, stored as received
• Post content and metadata (post ID, caption, URL, timestamp)
• Engagement metrics (likes, replies, reaction counts where available)
• Sentiment, intent, topic and language labels, which we derive from the text ourselves

We process this data to provide the Service to you: to apply your workflows, show your inbox and analytics, and, where you use them, generate AI replies (section 5). We do not use your ingested content for any other purpose, and we do not sell or share it with third parties for their own purposes.

3.3 Tracked Links and Click Data

When you share a tracked link (on our cmtly.com domain) in a reply or message, each link carries a token that ties it to the comment or message it was sent in. When someone opens the link, we record:

• The link and its token, so the click can be attributed to the reply or message that carried it
• The time of the click
• The visitor's country, as reported by our network provider
• A broad device or browser class (for example, "mobile browser" or "link preview bot"), not the full user-agent string
• A keyed, one-way hash of the visitor's IP address, used to avoid counting repeat clicks. We do not store the IP address itself.

We do not read or store the page the visitor came from.

3.4 Shopify Store and Order Data

When you install our Shopify app, Shopify asks you to let us read your products, create discount codes, create marketing activities and read your orders. All four are granted at install. For each paid order in a Connected Store we read:

• The order ID and order number
• The order total, currency and creation time
• The discount codes applied
• Shopify's summary of the visits that led to the order: the last visit's source, referring URL and UTM campaign parameters, and the first visit's UTM content

We do not access the customer's name, email address, postal address or phone number.

What we keep. For every paid order, whether or not a tracked link led to it, we keep a lookup record: the order ID, order number, total, currency and creation time. When one of your tracked links led to the order, we also keep which evidence matched (a discount code or a link token), the link, and the reply or message the link was sent in. We discard the discount codes, the referrer and every UTM value other than our own link token. Retention is described in section 8.

What we use it for. Only to work out whether one of your tracked links led to the order, and to show you the result. Order data is not used for profiling, advertising, resale or AI model training, and it is never sent to an AI model.

What we add to your store. At your instruction, we create a discount code for a link you choose to give one; these codes begin with TST- and each customer can use one once. We create one marketing activity, "Social Tools — ad-comment replies", so your tracked links appear in Shopify's marketing reports. You can add our block to the order page in your Shopify admin, which shows the comment or message an order came from, and use our action on the product page to create a tracked link. If you use Shopify Flow, we start a Flow trigger for each order traced to a comment or message. It sends your workflow the order, the platform, how the order was matched, the discount code, details of the post and the link, and whether it was a test order. It never sends the commenter's name or handle.

Our role. For your Connected Store's order data, you are the controller and we process it on your behalf, under our Data Processing Agreement (section 17).

Your store's customers. A customer of a Connected Store who wants to see or delete their data should contact that store. When Shopify forwards us a customer's request for their data, we give the store the records we hold for the orders it lists. When Shopify forwards a customer's deletion request, we delete those records within 30 days.

3.5 Information Collected Automatically

Log Data: When you access the Service, our servers automatically record information including your IP address, browser type, referring/exit pages, timestamp, and requested resources.

Usage Data: We collect information about your interactions with the Service, such as pages visited, features used, and actions taken within the platform. Our analytics and session-recording tools (section 4) record page views, clicks, scrolling and mouse movement on our websites and in our web app, but not in our app inside Shopify admin.

Device Information: We collect device type, operating system, and browser configuration to optimize the Service experience.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our marketing website, our documentation site and in our web app:

• Essential: Sign-in and session cookies set by Clerk, our identity provider. The app cannot work without these.
• Preferences: Settings stored in your browser, such as your selected workspace and interface choices.
• Analytics: Google Analytics, to measure visits and how pages are used.
• Session recording: Microsoft Clarity, which records page interactions (clicks, scrolling, mouse movement) to produce heatmaps and session replays.
• Advertising measurement: the Google Ads tag, which tells us when a visit that began with one of our Google ads leads to a sign-up. Google may use this data under its own terms; see section 12.
• Live chat: the Tawk.to chat widget. On our marketing website it is anonymous. When you are signed in to the app, we pass Tawk.to your name, email address and a verification hash, plus your workspace ID, plan and connection status, so our support team knows who they are helping.

These tools load when you visit; we do not currently ask for consent first. You can block or delete cookies in your browser settings, opt out of Google Analytics with Google's browser add-on, and manage Google ad personalisation in your Google account. Blocking essential cookies will stop you from signing in.

Inside Shopify admin. Our app inside Shopify admin, and its order and product page extensions, set no cookies and use no browser storage: they sign you in with Shopify session tokens. Google Analytics, the Google Ads tag, Microsoft Clarity and Tawk.to do not load there. They do load in our web app if you open it from Shopify admin, for example to reply in the inbox.

5. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To authenticate your account, connect to your social media platforms, ingest comments and messages, evaluate workflow rules, and carry out the actions you configure: flag or hide, allow, promote, delete, like, reply publicly, reply privately, or send a direct message.
• Link and Order Attribution: To count clicks on your tracked links and attribute a Connected Store's orders to them (sections 3.3 and 3.4).
• Analytics & Reporting: To provide you with moderation analytics, audit trails, sentiment trends, and platform breakdowns based on your ingested data.
• Communication: To send service-related announcements, security alerts, billing notifications, account emails (for example, when a connection needs reconnecting) and support responses. We may also send onboarding emails, product updates and feature announcements (with opt-out available). These emails are sent through Loops.
• Product Improvement and Marketing: To understand how our websites and app are used (section 4), improve the Service, fix issues, and measure our own advertising.
• Security & Compliance: To detect and prevent fraud, abuse, and security incidents; to comply with legal obligations; and to enforce our Terms of Service.
• AI Replies (Optional): We send content to our AI providers (section 7.1) in two cases. Reply drafts: when you ask for a draft, we send the comment or message text, the author's display name, the post caption, the author's recent messages, your reply instructions and tone, and, if you use a knowledge base, relevant excerpts from your website. Automated AI replies: if you set up a workflow that replies with AI, every comment that matches it is sent automatically, without further action from you: the comment text, the author's display name, the post caption and your reply instructions. Depending on your settings, the reply may be posted publicly without you reviewing it first (section 14). Some automated replies are also translated by an AI translation model. We do not send authors' platform user IDs or email addresses.
• Push Notifications (Optional): If you enable web push notifications, we process subscription data to deliver real-time alerts.

6. Legal Bases for Processing (EEA & UK Users)

If you are located in the European Economic Area, Switzerland, or the United Kingdom, we process your Personal Data under the following legal bases:

• Contractual Necessity: Processing required to provide the Service you have requested under our Terms of Service — including account management, comment and message ingestion, workflow execution, AI replies you configure, link and order attribution, and billing.
• Legitimate Interests: Processing for security monitoring, fraud prevention, support, product improvement, website analytics and advertising measurement, and communicating relevant product updates to existing customers. You may object to processing based on legitimate interests by contacting us.
• Consent: Where you have given clear consent, such as for marketing communications. You may withdraw consent at any time.
• Legal Obligation: Processing required to comply with applicable laws, regulations, or valid legal requests.

7. How We Share and Disclose Information

We share information only as described below and never sell Personal Data:

7.1 Service Providers (Subprocessors)

We use the following service providers to operate the Service:

• Railway — hosts our application servers and database.
• Cloudflare — network and content delivery for our websites; runs our tracked-link redirects (click data, section 3.3) and our website crawler; hosts the knowledge-base search index; routes every AI request through its AI Gateway; and runs the translation model used for some automated replies.
• Anthropic — the AI models that write reply drafts and automated replies (section 5), reached through Cloudflare's AI Gateway. OpenAI — only for workspaces that chose a legacy OpenAI model before it was retired. Our AI providers do not train their models on this content.
• Clerk — user identity, sign-in and session management. Receives your name and email address, including the ones Shopify gives us when you install from the Shopify App Store.
• Stripe — subscription payments and billing for accounts that sign up on our website. You enter card details on Stripe's own pages; we do not receive or store full payment card details.
• Loops — account, onboarding and product emails. Receives your email address, first name, account ID, plan and account events (for example, when you connect an account or book a demo), plus the details an email needs, such as page names, counts and rule names. It does not receive comment or message content or order data. If you installed from the Shopify App Store, we send you service email only (a sign-in confirmation when Shopify has not verified your email address, setup reminders, and usage and billing alerts), and marketing email only if you opt in.
• Cal.com — demo booking. If you book a demo, it receives the details you enter and tells us your email address and the meeting time.
• Shopify — for a Connected Store, the access described in section 3.4. Shopify also bills accounts that install from the Shopify App Store: it tells us your plan, trial and charges, and we send it a count of the automations you used in each billing period, with no personal data. We do not receive card details.
• Google — Google Analytics and the Google Ads tag on our websites and in our web app (section 4).
• Microsoft — Clarity session recording and heatmaps on our websites and in our web app (section 4).
• Tawk.to — live chat support (section 4).
• Browser push services (for example, Google, Mozilla or Apple) — deliver web push notifications if you enable them. Notifications are encrypted end-to-end. Most carry generic text; ad alerts include the first 40 characters of the post caption and the ad spend.

7.2 Social Media Platforms

At your direction, we interact with the APIs of the platforms you connect — Facebook, Instagram, TikTok, YouTube, Twitter/X, Reddit and Discord, as each becomes available — to ingest comments and messages and carry out actions on your behalf. Replies you or your workflows send, including AI-written replies, are posted to those platforms and become visible as their rules provide. Data transmitted to these platforms is governed by their respective privacy policies. We recommend reviewing the privacy policies and terms of each platform you connect.

7.3 Legal and Safety Disclosures

We may disclose information if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation or valid governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Service; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

7.4 Business Transfers

If The Social Tools is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

7.5 With Your Consent

We may share your information for other purposes with your explicit consent or at your direction. For example, if you add an outgoing webhook, we send the event data you subscribe to (such as moderation actions or attributed orders) to the address you choose.

8. Data Retention

We retain your Personal Data only as long as necessary to fulfill the purposes described in this policy, or as required by applicable law:

• Account Data: Retained while your account is active. You can delete your account in Settings. This cannot be undone, and it immediately deletes your account record, every workspace you own with everything in it, the teams you own, and the records our sign-in provider (Clerk) and email provider (Loops) hold about you. A subscription billed through Stripe is cancelled at deletion, with no further charges and no refund for the rest of the billing period. If Shopify bills you, uninstall our app in Shopify before deleting your account: uninstalling is what stops Shopify's billing, so we cannot delete the account while the app is installed. Stripe keeps its own customer and payment records as the law requires of it. If you have been billed, we keep only a minimal billing record (your Stripe customer reference and usage records, with your name and email removed) as required by tax and accounting law.
• Comments, Messages and Workflow History: Retained while the social account stays connected; there is no automatic time limit. Deleting a workspace deletes its connected accounts, content, workflows and audit history immediately. When you disconnect a social account or delete a workflow, its data is permanently deleted 30 days later.
• Platform Deletion Requests: When a person asks Meta to delete their data from our app, we immediately delete the related connected accounts, content and audit history, disable the workflows, and keep a confirmation record of the request.
• Tracked Links, Click Data and Store Connections: Retained while your workspace exists. Deleting the workspace, or your account, deletes them immediately, along with the order records attributed to them.
• Shopify Order Data: We delete the lookup record of an order that no tracked link led to 30 days after the order. We keep the record of an attributed order while your store is connected, for at most 24 months. When you uninstall our app, we delete the store's access token immediately and stop processing its orders. When Shopify sends us its store redaction request (48 hours after uninstall), we delete the store connection and every order record, queued job and webhook delivery record that holds its order data. If you reinstall the app before that request arrives, we keep your store's data for the reinstalled app. When Shopify forwards a store customer's deletion request, we delete the records for the orders it lists within 30 days.
• Knowledge Base: Retained until you remove the website source or delete the workspace.
• Billing Records: Retained as required by tax and accounting laws.
• AI Request Logs: Cloudflare's AI Gateway logs each AI request's metadata, such as the time, model, token counts, outcome and the workspace it was for, but not the comment or reply text. We delete these logs after 30 days.
• Server Logs: Kept by our hosting provider for a limited period for security and operational purposes. We do not log the content of comments or messages.

When data is no longer needed, we securely delete or anonymize it. Data that has been anonymized or aggregated so that it can no longer identify you may be retained indefinitely for analytics and product improvement.

9. Data Security

We implement and maintain appropriate technical and organizational measures to protect your Personal Data:

• All data in transit is encrypted using HTTPS/TLS.
• Social media and Shopify access tokens, and the signing secrets of your outgoing webhooks, are encrypted at rest using AES-256-GCM under a master key held outside the database.
• Our production database is encrypted at rest.
• Incoming Shopify webhooks are verified by their HMAC signature before we read them.
• Every request from our app inside Shopify admin and from its extensions carries a Shopify session token, which we verify before answering.
• Sensitive configuration values (API keys, secrets) are never logged or stored in plaintext.
• We enforce least-privilege access controls for internal systems.
• We maintain rate limiting to protect against abuse and denial-of-service attacks.
• We regularly review our security practices and infrastructure.

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. In the event of a data breach affecting your Personal Data, we will notify you and relevant authorities as required by applicable law.

10. International Data Transfers

The Service is operated from the United States. If you are located outside the United States, your information will be transferred to and processed in the United States. We ensure that such transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Data processing agreements with our service providers that include transfer safeguard provisions.
• Assessments of the legal frameworks in destination countries.

By using the Service, you acknowledge that your information will be processed in the United States.

11. Your Data Protection Rights

Depending on your jurisdiction, you may have the following rights regarding your Personal Data:

• Access: Request a copy of the Personal Data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request deletion of your Personal Data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw previously given consent at any time (does not affect the lawfulness of processing prior to withdrawal).

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days and may need to verify your identity before processing your request. You will not be discriminated against for exercising your rights.

If you are a customer of a store that uses our Shopify app, please contact that store; it decides how your order data is used (section 3.4).

If you believe our processing of your data violates applicable law, you have the right to lodge a complaint with your local data protection authority.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with additional rights:

• Right to Know: You may request information about the categories and specific pieces of Personal Data we have collected about you, the sources of that data, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your Personal Data, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate Personal Data.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

We do not sell Personal Data as defined under the CCPA. Our websites and app use the Google Ads tag to measure which of our own ads lead to sign-ups (section 4). Because Google may also use that data for advertising, this may count as "sharing" for cross-context behavioral advertising under the CPRA. To opt out, email us, block cookies in your browser, or turn off ad personalisation in your Google account. We do not knowingly sell or share the Personal Data of consumers under 16 years of age.

To exercise your California privacy rights, contact us at [email protected]. You may designate an authorized agent to make a request on your behalf; we may require proof of authorization.

13. Children's Privacy

The Service is not intended for use by individuals under the age of 18, and we do not knowingly collect Personal Data from children under 13. If you believe a child under 13 has provided us with Personal Data, please contact us immediately at [email protected], and we will take steps to delete such information.

14. Automated Decision-Making

The Service performs automated processing of comments based on Workflow rules that you configure. You control the conditions (such as keywords, sentiment, intent, platform, author and ad criteria) and the resulting actions (such as flag or hide, allow, promote, delete, like, reply, or send a message) through the Service interface. These automated decisions are made according to your instructions and are not used to make decisions about you.

AI replies work in two ways. A reply draft you request is a suggestion: you review it and decide whether to send it. An automated AI reply, which you set up in a workflow, is written for each matching comment without your involvement, and depending on your settings it may be posted publicly without you reviewing it first.

15. Marketing Communications

We may send you emails about product updates, new features, and relevant offers. You may opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email or by contacting us. Please note that even if you opt out of marketing, we will continue to send you transactional and account-related communications (billing receipts, security notices, service announcements) necessary for the operation of your account.

16. Third-Party Links and Services

The Service integrates with and may contain links to third-party websites and services, including the social media platforms you connect, Shopify, and the service providers listed in section 7.1. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of every third-party service you interact with, for example:

• Clerk Privacy Policy: clerk.com/legal/privacy
• Stripe Privacy Policy: stripe.com/privacy
• Google Privacy Policy: policies.google.com/privacy
• Microsoft Privacy Statement: privacy.microsoft.com/privacystatement
• Shopify Privacy Policy: shopify.com/legal/privacy

17. Data Processing Agreement

Where we process personal data on your behalf — the comments and messages we ingest from your Connected Accounts, and your Connected Store's order data — our Data Processing Agreement applies. It sets out what we process and why, our subprocessors, our security measures, how we help you answer requests from the people the data is about, and the Standard Contractual Clauses for transfers from the EEA, the UK and Switzerland. It forms part of our Terms of Service, so there is nothing separate to sign. For a countersigned copy, contact us at [email protected].

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will notify you by email (to the address associated with your account) and/or by posting a prominent notice on the Service prior to the changes becoming effective. The "Last updated" date at the top of this page indicates the most recent revision. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: [email protected]
Post: Laurence Welch, doing business as The Social Tools, 3665 Hughes Ave, Los Angeles, California 90034, United States

We will respond to all privacy-related inquiries within 30 days. If you have an unresolved privacy concern, you may also contact your local data protection authority.