Privacy Policy
Last updated: 1 November 2026
SocialOrk publishes social media content on your behalf. To do that it has to hold your account authorisation and the content you create. This page says exactly what is stored, why, where, and how to get rid of it.
1. What we collect
| Account | Your name, email address and password hash (or the identity returned by the sign-in provider you choose). |
| Workspace | The workspace you create or join, and your role inside it. |
| Connected accounts | For each social account you connect: the platform's user or page id, the username or handle, the profile image, and the permissions that platform granted. |
| Authorisation tokens | The access token — and refresh token where the platform issues one — that lets SocialOrk post as that account. These are encrypted before they are written to the database. |
| Content | The posts, drafts, schedules, media files and comments you create inside SocialOrk. |
| Activity | An audit record of decisions that change what the product does: approvals, rejections, scheduling, publishing, role changes and connection changes, with the acting user and the time. |
| Technical | IP address, browser user agent, and error logs needed to run the service securely. |
| Billing | If you subscribe to a paid plan, the billing details are handled by our payment processor; SocialOrk does not store card numbers. |
2. Why we process it
- To publish the content you approve, at the time you choose, to the accounts you connected.
- To show you what happened: publishing history, failures, and the audit trail of who approved what.
- To keep the service secure: detecting abuse, rate limiting, and repairing failures.
- To answer you when you write to support.
We do not sell personal data, we do not use your content to train models, and we do not publish anything you have not approved or scheduled.
3. Where it is stored
- Application data and account records: a managed PostgreSQL database.
- Media files you upload: object storage.
- The application itself: a managed hosting platform. All traffic is served over HTTPS.
These providers process data on our behalf under their own data processing terms. Access to production data is limited to the people who operate SocialOrk, and authorisation tokens are encrypted with a key held in the application environment — not in the database.
4. What is shared with the social networks
When you connect an account, the network receives the information its own authorisation screen discloses. When you publish, the network receives the post content and media you selected. Each network then processes that data under its own privacy policy — we cannot control what it does with it beyond what its terms allow.
No other third party receives your content or your tokens. SocialOrk does not share one customer's accounts or data with another customer: each workspace sees only the accounts connected to it.
5. How long we keep it
- Authorisation tokens: until you disconnect the account or delete your workspace. Disconnecting removes the stored token immediately.
- Posts and media: until you delete them, or until the workspace is deleted.
- Audit records: retained while the workspace exists, because they are the record of who approved and published what.
- Technical logs: a short operational window, then discarded.
6. Your rights
You can see, correct, export or delete your data at any time. Inside the product you can disconnect any account, delete content, and delete a workspace. For a request that covers everything we hold about you — or data originating from a Facebook or Instagram account — see Data deletion.
If you are in the EEA or the UK you also have the right to object to processing, to restrict it, and to complain to your data protection authority. Write to emma@medioteq.no and we will respond within 30 days.
7. Cookies
SocialOrk sets one session cookie, which keeps you signed in, and a short lived cookie during the connection flow that protects the OAuth handshake against tampering. There is no advertising or cross-site tracking cookie.
8. Google API Services (YouTube)
When you connect a YouTube channel, SocialOrk asks Google for three permissions and no others: youtube.upload (upload a video you created to your own channel), youtube.readonly (show which channel is connected and confirm an upload landed) and youtube.force-ssl (read back the status of the published video so we can report success or failure accurately).
That data is used only to perform the action you asked for. It is never sold, never shared with advertisers or data brokers, never used for ad targeting, and never used to train or improve any machine-learning model. It is transferred only to Google, as the destination of the upload you requested.
SocialOrk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at myaccount.google.com/permissions, or by disconnecting the channel in the product.
9. Children
SocialOrk is a business tool and is not intended for anyone under 16. We do not knowingly hold data belonging to children; if you believe a child has created an account, write to us and we will remove it.
10. Changes
If this policy changes in a way that affects what we store or why, we will update the date at the top of this page and tell workspace owners by email before the change takes effect.
Questions about this page: emma@medioteq.no. SocialOrk is a social media publishing product: you connect your own accounts, and every post is sent to the platform you chose.