Privacy & Cookie Policy

Effective October 27, 2026

1. Who we are

Social Relay (also written SocialRelay; “Social Relay,” “we,” “us”) is a social-media scheduling service operated by Early Forge Venture Studio LLC (“Early Forge”). Early Forge Venture Studio LLC is the data controller for personal data processed through Social Relay. This policy covers the Social Relay website, app and API. It does not cover the social networks, payment processor or other third parties you use with us — their own policies apply to their services.

2. What we collect

Account data. Your name, email address and a hashed password, plus the organization and workspaces (brands) you create, team members you invite, and your settings such as time zone.
Your content. Posts, drafts, per-network versions, follow-up comments, saved sets, images and videos you upload, schedules, automations, and the links in your posts (which we shorten to count clicks).
Connected-account data. When you connect a social account, the network gives us what you approve: an account identifier, display name, username, avatar, account type and publishing capabilities, and OAuth access and refresh tokens. Depending on the permissions you grant, we also receive publishing status, post identifiers, basic post metadata and post analytics (views, likes, comments, shares).
Purchase data. Our payment processor (Stripe) handles your payment details; we receive your plan, subscription status, billing email and a transaction reference. We never see or store card numbers.
Usage and device data. IP address, browser and device type, pages and features used, timestamps, referring URLs, error logs and security events, and session identifiers.
Communications. Messages you send us, and requests you type to the in-app assistant.

TikTok

For TikTok, Social Relay requests user.info.basic to identify the connected creator and video.publish or video.upload to publish or upload video at the creator’s direction. We do not use TikTok data for advertising, sell it, or disclose it to data brokers. TikTok information is handled in accordance with the permissions you grant and TikTok’s developer requirements.

YouTube and Google

Social Relay’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube access only to upload the videos you schedule and to read their status and statistics. You can also revoke access at myaccount.google.com/permissions.

3. How we use your information

Provide the service: accounts, workspaces, team access, and the calendar and queue.
Publish, comment and repost on the networks you choose, at the times you choose — only at your direction.
Show delivery status, post history and analytics, and the click counts for your shortened links.
AI features, when you use them. When you ask for a caption, hook, hashtags, an image or the assistant, the text or prompt you submit is sent to an AI model provider to generate the result. We do not use your content to train AI models.
Process subscriptions and enforce plan limits.
Send service email (account, security, billing and publishing problems). We send no marketing email.
Keep the service secure and reliable, prevent fraud and abuse, and debug and improve features.
Comply with law and enforce our terms.

We use data from connected networks only to provide the features you use. We don’t sell it, use it for advertising, or combine it to profile you.

4. Legal bases (EEA, UK and similar laws)

Where the GDPR or UK GDPR applies, we rely on:

Contract (Art. 6(1)(b)) — running your account, publishing your content, billing and support.
Consent (Art. 6(1)(a)) — connecting social accounts, and analytics cookies. You can withdraw consent at any time (disconnect the account, or “Cookie preferences” in the footer) without affecting processing that happened before.
Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, essential logging and aggregate product improvement. You may object at any time.
Legal obligation (Art. 6(1)(c)) — tax and accounting records.

5. Cookies and similar technologies

Essential cookies and storage keep you signed in (a session cookie), protect sign-in, and remember your cookie choice, theme and similar preferences on your device. These are strictly necessary and always on.
Analytics cookies are set only after you choose “Accept all” in the cookie banner — never before, and never if you choose “Essential only.” Today Social Relay runs no analytics or advertising cookies at all; if we add analytics, they will respect this choice.
Changing your mind is one click: “Cookie preferences” in the footer reopens the banner.

The networks you choose. We send your content and the needed account data to the social networks you connect, when you publish.
Service providers (processors). Hosting and AI gateway (Vercel), database and media storage (Supabase), job queue (Upstash), background processing (Railway), payments (Stripe), and AI model providers (Anthropic and OpenAI, through Vercel’s AI gateway) — each only as needed to do their job, under data-processing terms.
Legal and safety. When required by law, or to protect rights, safety and security, or to investigate fraud and abuse.
Business transfers. As part of a merger, financing, acquisition or sale of assets, subject to confidentiality protections.

We do not sell your personal information and do not share it for cross-context behavioral advertising.

7. International transfers

We are a U.S. company and our providers process data primarily in the United States. If you use Social Relay from the EEA, UK or Switzerland, your data is transferred to the U.S. Our providers rely on recognized safeguards for these transfers — the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. You can request a copy of the applicable safeguards at info@earlyforgestudios.com.

8. Data retention

Account and workspace data is kept while your account exists. Content, media and publishing records stay until you delete them or close your account, subject to backup cycles. OAuth tokens are deleted or made unusable when you disconnect the account, the network revokes them, or they expire. Billing records are kept as tax and accounting rules require (typically 7 years). Logs are kept on our providers’ rolling windows (typically 30–90 days). When you delete your account, we delete or anonymize personal data we aren’t legally required to keep.

9. Security

We use encrypted connections, access controls and secret management. Connected-account tokens are encrypted at rest, never sent to your browser, and never logged. No online service is perfectly secure; please use a unique password and tell us if you suspect unauthorized access.

10. Your rights

Depending on where you live — including under the GDPR and UK GDPR — you have the right to:

access a copy of your personal data (Art. 15);
correct inaccurate data (Art. 16);
delete your data (“right to be forgotten,” Art. 17);
restrict processing (Art. 18);
receive your data in a portable format (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw any consent at any time, as easily as you gave it (Art. 7(3));
lodge a complaint with your local supervisory authority (for the EEA, see the EDPB member list; for the UK, the ICO).

You can disconnect any social account in Social Relay (Channels), or revoke our access in that network’s own settings. To delete your account and its data — including data received from Facebook, Instagram or Threads — or to exercise any right above, email info@earlyforgestudios.com from your account email with “Social Relay privacy” in the subject. We respond to verified requests within one month. We will not discriminate against you for exercising a right, and we make no automated decisions with legal or similarly significant effects.

11. Children

Social Relay is a business tool for people 18 or older (or the age of majority where they live). It is not directed at children, and we do not knowingly collect their data. If you believe a child gave us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product changes. Material changes will be flagged on this page with a new effective date, and where a change relies on your consent, we will ask for it rather than assume it.

13. Contact

Early Forge Venture Studio LLC · info@earlyforgestudios.com