Privacy Policy & GDPR

1. Who we are and what this covers

100 Suite ("we", "us"), an online-only company without a physical office that can be reached at info@100suite.com, provides a social media management platform for creators, businesses and agencies: planning, scheduling, publishing, approvals, a unified inbox, analytics and AI-assisted content tools. This policy covers our website, the web application and any related communications.

For personal data you upload or process about your own audience and clients, you are the data controller and we act as your processor. For your own account and usage data, we are the controller.

2. Information we collect

Information you give us: name, email address, password (stored hashed), workspace and brand names, team member invitations, billing contact and, where you subscribe, payment details handled by our payment processor — we never see or store full card numbers.

Content you create: posts, captions, hashtags, comments, media you upload or generate, schedules, approval notes and notes you add about brands or clients.

Social account data: when you connect a social profile, the network gives us an access token plus profile details (account name, handle, avatar, page or channel ID) and — depending on the permissions you grant — your posts, comments, direct messages and performance metrics. We request the minimum scopes needed for the features you use, and we only act on your explicit instruction.

Automatically collected: IP address, browser and device type, pages viewed, actions taken in the app, timestamps, referring URLs and error diagnostics.

3. Cookies and tracking

We use strictly necessary cookies to keep you signed in and secure your session; these cannot be turned off without breaking the service. We also use a small number of analytics cookies to understand how the product is used, and on our public website we may use advertising cookies to measure campaigns.

• You can block or delete cookies in your browser settings.
• We honour Global Privacy Control and similar universal opt-out signals where legally required.
• We do not respond to legacy browser “Do Not Track” headers, as there is no common standard for them.

4. Artificial intelligence features

Some features use AI models to draft, rewrite or adapt captions and to generate images from your prompts. When you use them, the prompt and the relevant post text are sent to the model provider to produce a result and returned to you.

• AI features are optional — nothing is sent to a model unless you trigger the action.
• We do not permit your content to be used to train third-party models.
• Generated output is a suggestion, not a decision: nothing is published without your action.
• No legal or similarly significant decisions about you are made by automated means.
• We keep a record of generation counts to apply your plan's allowance and prevent abuse.

5. How we use your information

• To provide the service: publish and schedule your content, sync your inbox, produce analytics.
• To authenticate you, secure accounts and prevent fraud or abuse.
• To bill you, apply plan limits and process add-on purchases.
• To send service emails: approvals, publishing failures, trial reminders, security notices.
• To support you when you contact us.
• To improve the product using aggregated, de-identified usage statistics.
• To send marketing emails where you have opted in, with an unsubscribe link in every message.

Our legal bases under GDPR are: performance of a contract (running the service), legitimate interests (security, product improvement, direct marketing to business contacts), consent (optional cookies, marketing where required) and legal obligation (tax and accounting records).

6. How we share information

We do not sell personal data and we do not share it for cross-context behavioural advertising. We share only with:

• The social networks you connect, in order to carry out your publishing and inbox instructions.
• Cloud storage services you choose to connect (Box, OneDrive/SharePoint, Dropbox, Google Drive), only to read the files you select.
• Infrastructure, database and email providers that run the service under contract.
• Our payment processor, for subscriptions, invoices and add-on purchases.
• Other members of your workspace, according to the roles and brand access you assign.
• Authorities where required by law, and an acquirer in the event of a merger or sale of the business.

All providers act on our documented instructions under data processing agreements, and international transfers rely on Standard Contractual Clauses or an equivalent safeguard.

Cloud storage connections

When you connect Box, OneDrive/SharePoint, Dropbox or Google Drive, 100 Suite only reads folder listings, file details and the files you select to import. We never upload, edit, move, share or delete content in those services. Box requires a write permission for downloads; we use it only to download files you pick. Access keys are encrypted and stored only on our servers, never in your browser. Imported files are copied into your workspace. Data from these services is never sold or used to train AI models. You can disconnect at any time from the picker or from the provider's app settings, which revokes access and deletes the saved connection.

7. Storage and security

Data is encrypted in transit and at rest. Access to production systems is limited to staff who need it, protected by multi-factor authentication and logged. Workspaces are isolated at the database level so one customer cannot read another customer's data. Social access tokens are stored encrypted and are never exposed to your browser.

No system is perfectly secure. If a breach affects your personal data we will notify you and any required regulator without undue delay.

8. How long we keep information

• Account and workspace data: while your account is active.
• After cancellation: up to 30 days, then deleted or anonymised, unless you ask us to delete sooner.
• Invoices and tax records: as long as the law requires, typically 7 years.
• Disconnected social accounts: tokens are revoked immediately and related cached data is removed.
• Security and audit logs: up to 12 months.

9. Your rights

Depending on where you live you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive it in a portable format, and to withdraw consent at any time.

EU, UK and Switzerland (GDPR): you may exercise any of the rights above and lodge a complaint with your local supervisory authority.

California (CCPA/CPRA) and similar US state laws: you may request the categories and specific pieces of data we hold, request deletion or correction, and opt out of sale or sharing — we do neither. We will not discriminate against you for exercising these rights.

Canada (PIPEDA): you may request access to your information and challenge its accuracy.

Write to info@100suite.com and we will respond within the period the law allows, normally 30 days. We may need to verify your identity first.

10. Children

The service is for business use and is not directed at children under 16. We do not knowingly collect their personal data; if you believe a child has provided us information, contact us and we will delete it.

11. Third-party sites and networks

Connecting a social network means that network's own terms and privacy policy also apply to the data they hold. Our platform is not endorsed by or affiliated with the networks, and we are not responsible for their practices.

12. Facebook, Instagram, Threads and Google data

When you connect a Facebook Page, Instagram professional account or Threads profile, we use the data Meta provides only to deliver the features you use: publishing and scheduling posts, showing comments and messages in your inbox, replying on your behalf, looking up public business profiles you want to mention, and reporting on performance. We do not sell this data, use it for advertising profiles, or share it with data brokers.

Use of information received from Google APIs (including YouTube and Google Business Profile) adheres to the Google API Services User Data Policy, including its Limited Use requirements. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's Privacy Policy applies. You can revoke access at any time from your Google security settings.

13. How to delete your data

• Disconnect a single account: go to Accounts → Manage Accounts and remove it. Its token is revoked and cached data is deleted.
• Remove access from the network: in Facebook go to Settings → Business Integrations (or Apps and Websites) and remove 100 Suite. We delete the related data when notified.
• Delete everything: email info@100suite.com from your account's address asking for deletion. We confirm and complete it within 30 days.

14. Changes to this policy

We may update this policy as the product evolves. We will change the date at the top and, for material changes, notify you by email or in the app before they take effect.

15. Contact us

For privacy questions, data requests and any other enquiry, write to info@100suite.com.