Privacy Policy & GDPR

1. Who we are and what this covers

100 Suite ("we", "us") provides a social media management platform for creators, businesses and agencies: planning, scheduling, publishing, approvals, a unified inbox, analytics and AI-assisted content tools. This policy covers our website, the web application and any related communications.

For personal data you upload or process about your own audience and clients, you are the data controller and we act as your processor. For your own account and usage data, we are the controller.

2. Information we collect

Information you give us: name, email address, password (stored hashed), workspace and brand names, team member invitations, billing contact and, where you subscribe, payment details handled by our payment processor — we never see or store full card numbers.

Content you create: posts, captions, hashtags, comments, media you upload or generate, schedules, approval notes and notes you add about brands or clients.

Social account data: when you connect a social profile, the network gives us an access token plus profile details (account name, handle, avatar, page or channel ID) and — depending on the permissions you grant — your posts, comments, direct messages and performance metrics. We request the minimum scopes needed for the features you use, and we only act on your explicit instruction.

Automatically collected: IP address, browser and device type, pages viewed, actions taken in the app, timestamps, referring URLs and error diagnostics.

3. Cookies and tracking

We use strictly necessary cookies to keep you signed in and secure your session; these cannot be turned off without breaking the service. We also use a small number of analytics cookies to understand how the product is used, and on our public website we may use advertising cookies to measure campaigns.

• You can block or delete cookies in your browser settings.
• We honour Global Privacy Control and similar universal opt-out signals where legally required.
• We do not respond to legacy browser “Do Not Track” headers, as there is no common standard for them.

4. Artificial intelligence features

Some features use AI models to draft, rewrite or adapt captions and to generate images from your prompts. When you use them, the prompt and the relevant post text are sent to the model provider to produce a result and returned to you.

• AI features are optional — nothing is sent to a model unless you trigger the action.
• We do not permit your content to be used to train third-party models.
• Generated output is a suggestion, not a decision: nothing is published without your action.
• No legal or similarly significant decisions about you are made by automated means.
• We keep a record of generation counts to apply your plan's allowance and prevent abuse.

5. How we use your information

• To provide the service: publish and schedule your content, sync your inbox, produce analytics.
• To authenticate you, secure accounts and prevent fraud or abuse.
• To bill you, apply plan limits and process add-on purchases.
• To send service emails: approvals, publishing failures, trial reminders, security notices.
• To support you when you contact us.
• To improve the product using aggregated, de-identified usage statistics.
• To send marketing emails where you have opted in, with an unsubscribe link in every message.

Our legal bases under GDPR are: performance of a contract (running the service), legitimate interests (security, product improvement, direct marketing to business contacts), consent (optional cookies, marketing where required) and legal obligation (tax and accounting records).

6. How we share information

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share only with:

• The social networks you connect, in order to carry out your publishing and inbox instructions.
• Infrastructure, database and email providers that run the service under contract.
• Our payment processor, for subscriptions, invoices and add-on purchases.
• Other members of your workspace, according to the roles and brand access you assign.
• Authorities where required by law, and an acquirer in the event of a merger or sale of the business.

All providers act on our documented instructions under data processing agreements, and international transfers rely on Standard Contractual Clauses or an equivalent safeguard.

7. Storage and security

Data is encrypted in transit and at rest. Access to production systems is limited to staff who need it, protected by multi-factor authentication and logged. Workspaces are isolated at the database level so one customer cannot read another customer's data. Social access tokens are stored encrypted and are never exposed to your browser.

No system is perfectly secure. If a breach affects your personal data we will notify you and any required regulator without undue delay.

8. How long we keep information

• Account and workspace data: while your account is active.
• After cancellation: up to 30 days, then deleted or anonymised, unless you ask us to delete sooner.
• Invoices and tax records: as long as the law requires, typically 7 years.
• Disconnected social accounts: tokens are revoked immediately and related cached data is removed.
• Security and audit logs: up to 12 months.

9. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent at any time.

EU, UK and Switzerland (GDPR): you may exercise any of the rights above and lodge a complaint with your local supervisory authority.

California (CCPA/CPRA) and similar US state laws: you may request the categories and specific pieces of data we hold, request deletion or correction, and opt out of sale or sharing — we do neither. We will not discriminate against you for exercising these rights.

Canada (PIPEDA): you may request access to your information and challenge its accuracy.

Write to info@100suite.com and we will respond within the period the law allows, normally 30 days. We may need to verify your identity first.

10. Children

The service is for business use and is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has provided us information, contact us and we will delete it.

11. Third-party sites and networks

Connecting a social network means that network's own terms and privacy policy also apply to the data they hold. Our platform is not endorsed by or affiliated with the networks, and we are not responsible for their practices.

12. Changes to this policy

We may update this policy as the product evolves. We will change the date at the top and, for material changes, notify you by email or in the app before they take effect.

13. Contact us

For privacy questions, data requests and any other enquiry, write to info@100suite.com.