Privacy Policy

1. Introduction

Welcome to LotsSocial ("we," "our," or "us"), a social media management platform operated by LotsTech AI Solutions Private Limited, a registered private limited company based in India. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service").

We are committed to protecting your privacy and ensuring transparency about our data practices. This policy applies to all users of LotsSocial, regardless of their location, and complies with applicable privacy laws including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other relevant data protection regulations.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Email address, name, and password when you create an account
• Profile Information: Optional profile details you choose to provide
• Content: Posts, captions, images, videos, and other content you create or upload
• Communication: Messages you send to us through support channels
• Payment Information: Billing details processed securely through third-party payment processors

2.2 Social Media Account Information

When you connect your social media accounts (including Facebook, Instagram, LinkedIn, YouTube, X, TikTok, Reddit and others), we collect:

• Account identifiers and basic profile information
• Access tokens, refresh tokens and, for Bluesky, the app password you enter (encrypted and stored server-side; see Data Security)
• Account metadata necessary for posting and management
• Publishing permissions and capabilities

We receive only what the permissions you approve on the network's own consent screen allow. For example:

• TikTok: your TikTok account id, display name and profile picture; your username, profile link and follower, following, like and video counts when you grant those permissions; and the id, status and view, like, comment and share counts of the posts we publish for you. For TikTok accounts connected through the TikTok API for Business, also the insights TikTok returns for your posts (such as views, reach, likes, comments, shares, saves, watch time, new followers and profile views) and the comments on your own posts (the comment text, the commenter's public name, username and profile picture, and the time). We read these only while you have the TikTok insights and comments screen open, and we reply to, hide or delete a comment on your own post only when you press that button. We show them to you as TikTok returns them and do not save them in our database or in any cache, so nothing is kept once you leave the screen
• Reddit: your Reddit username, user id, profile picture and follower count; the post flairs available in a subreddit you choose to post in; and the id, status, score and comment count of the posts we publish for you

2.3 Automatically Collected Information

• Usage Data: How you interact with our Service, features used, and time spent
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP addresses, access times, pages viewed, and referring URLs
• Cookies and Tracking: Session data, preferences, and analytics information
• Relationship Record: Account milestones and where you first came from (see section 4)

3. How We Use Your Information

We use your information for the following purposes:

3.1 Service Provision

• Creating and managing your account
• Scheduling and publishing content to your connected social media accounts
• Providing account connection, publishing tools, media storage and analytics
• Managing media uploads and storage
• Processing credit purchases and managing usage billing

3.2 Service Improvement

• Analyzing usage patterns to improve our Service
• Developing new features and functionality
• Troubleshooting and providing technical support
• Ensuring security and preventing fraud

3.3 Communication

• Sending service-related notifications and updates
• Responding to your inquiries and support requests
• Providing important account and security information
• Sending marketing communications (with your consent)

3.4 Data From Connected Networks

Data from connected networks is used only to show you your accounts, publish what you or your AI agent ask us to publish, and report the results back to you and your agent. TikTok post insights and comments are used only to show you your results and to let you manage the comments on your own posts. We never sell data from connected networks and never use it to train AI models.

4. How We Keep Track of Our Relationship With You

When you create an account on LotsSocial or any other LotsTech product, we keep a short record of your relationship with us. We use it to support you, to help you get started with the product, and to understand which channels bring people to our products.

4.1 What We Record

• Your email address, your name if your account has one, and a company name taken from your email domain when it is a business domain (never from free mailboxes such as Gmail or Outlook)
• Account milestones and their dates: signing up, signing in, reaching a first key step (for example connecting your first social account or publishing your first post), connecting an AI agent, and your plan, payments, credit purchases and cancellations
• Where you first came from: the utm_source, utm_medium and utm_campaign of the link that brought you, the referring website's domain (never the full address) and the page you first landed on, taken from the lots_ft cookie described in section 11

We do not copy anything from inside our products into this record: no posts, captions, media, connected account details or other content you create.

4.2 Where It Is Kept

• LotsCRM: each LotsTech product has its own workspace in LotsCRM, our own CRM product, with one contact per person who uses that product. This data stays in our own database. The contact holds the details above, your plan and the dates of your milestones, with no IP address and no full web addresses.
• Customer.io: the service we use to send product and account email receives the same milestones. Customer.io processes this data on our behalf.

4.3 What It Is Not

• Signing up is not consent to marketing email. Nothing in LotsCRM emails you automatically.
• Our own team's accounts are included too, marked internal.
• We do not sell this record.

4.4 How Long We Keep It and How to Remove It

We keep this record while you have an account with any LotsTech product. To see it, correct it or have it deleted, email privacy@lotstech.com. A deletion request covers this record too: we delete your contact in LotsCRM and your profile in Customer.io along with your account data.

For users in the European Economic Area, our legal basis is our legitimate interest in supporting our customers and understanding how people find us. You can object to it at any time at the same address.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your personal data based on:

• Contract Performance: To provide the services you've requested
• Legitimate Interests: To improve our services, ensure security, and communicate with you
• Consent: For marketing communications and optional features
• Legal Obligation: To comply with applicable laws and regulations

6. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

6.1 Social Media Platforms

We share content and necessary metadata with connected social media platforms (including Facebook, Instagram, LinkedIn, YouTube, X, TikTok, Reddit and others) to publish your content as requested. This sharing is essential for our service functionality.

6.2 Service Providers

We work with trusted third-party service providers who assist us in:

• Cloud hosting and data storage (Supabase, Cloudflare)
• Payment processing (Polar.sh)
• Connecting some social networks and publishing to them for you (connection providers that hold the access you grant for those accounts)
• Analytics and monitoring (Google Analytics, Cloudflare Web Analytics)
• Customer support tools
• Product and account email, and the account milestones described in section 4 (Customer.io)

6.3 Legal Requirements

We may disclose your information when required by law or to:

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Prevent fraud or security threats
• Enforce our Terms of Service

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections.

7. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: Data is encrypted in transit and at rest
• Access Controls: Strict access controls and authentication requirements
• Regular Audits: Security assessments and vulnerability testing
• Secure Infrastructure: Enterprise-grade hosting with security monitoring
• Account Credentials: Social media access tokens, refresh tokens and app passwords are encrypted by our application with AES-256-GCM before they are stored, using a key kept outside the database, and our database provider (Supabase) also encrypts the database at rest with AES-256. Only our servers can decrypt them, and only to publish and read results for the accounts you connect. They are never sent to your browser, and never included in what our API or MCP server returns to AI agents. Disconnecting an account deletes its stored credentials, and you can also revoke our access at any time in the network's own settings.

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest security standards.

8. Data Retention

We retain your information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements
• Maintain security and prevent fraud

TikTok post insights and comments read through the TikTok API for Business are not retained at all: they are shown while the TikTok insights and comments screen is open and are never written to our database or a cache (see section 2.2).

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes.

When you disconnect a social account in LotsSocial (from the Accounts page or through your AI agent), we delete its record from our database at once: its stored tokens, its profile details, its follower counts and the publishing history for that account. We also delete the copy of its profile picture that we keep for display. Some networks are connected through a connection provider that holds the access you grant for that account; when you disconnect, we release the account at that provider (unless another LotsSocial user has connected the same account), which removes the tokens it kept.

If you revoke our access in the network's own settings instead, the tokens we hold stop working at once. For TikTok accounts connected through our own TikTok app, TikTok tells us when you remove LotsSocial, and we delete our access and refresh tokens for that account straight away; the account stays in your list, marked for reconnection, until you reconnect or disconnect it. The other networks do not tell us when you revoke access, so for them the tokens we hold are deleted when you disconnect the account in LotsSocial. For an account connected through a connection provider, revoking our access in the network's settings ends the provider's access too.

9. Your Rights and Choices

9.1 General Rights

• Access: Request information about the personal data we hold about you
• Correction: Update or correct inaccurate personal information
• Deletion: Request deletion of your personal data (subject to legal requirements)
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests

9.2 GDPR Rights (EU Users)

If you are in the European Economic Area, you have additional rights including:

• Right to withdraw consent at any time
• Right to restrict processing
• Right to lodge a complaint with a supervisory authority

9.3 CCPA Rights (California Users)

California residents have the right to:

• Know what personal information is collected and how it's used
• Delete personal information (subject to exceptions)
• Opt-out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising privacy rights

9.4 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@lotstech.com. We will respond to your request within 30 days (or as required by applicable law).

10. International Data Transfers

LotsTech AI Solutions Private Limited is based in India, and your information may be transferred to and processed in India or other countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Other appropriate safeguards as required by law

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your session and preferences
• Analyze usage patterns and improve our service
• Provide personalized experiences
• Ensure security and prevent fraud

Our websites (including lots.social, lotstech.com, lots.blog, lots.team, lotscrm.com, lotsnotes.com, lots.link and lots.directory) use Google Analytics 4 to count visits and see which pages and links people use. It sets first-party cookies (such as _ga) and sends Google page views and button clicks, never your name or email address. Ad features and ad personalization are off. For visitors on a European time zone, Google Analytics does not load at all until you accept it in the consent bar (Google Consent Mode v2, basic mode), and rejecting it means it never loads. Your choice is kept in a first-party cookie named lots_ga_consent for 180 days, and you can change it any time with the "Cookie settings" link in the footer. Cloudflare Web Analytics, which sets no cookies, also counts visits.

On your first visit to one of these websites we also set a first-party cookie named lots_ft. It holds the utm_source, utm_medium and utm_campaign of the link you arrived from, the referring website's domain, the page you landed on and the time of that visit. It contains nothing that identifies you, lasts 90 days, is never overwritten by later visits, and is read when you create an account to record where you first came from (see section 4). It follows your Google Analytics choice: on a European time zone it is set only after you accept. Our Cookie Policy lists the cookies we set.

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Service.

12. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete such information.

13. Third-Party Links and Services

Our Service may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those external sites or services. We encourage you to review the privacy policies of any third-party services you use.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending email notifications for significant changes
• Providing in-app notifications where appropriate

Your continued use of our Service after the effective date of the updated policy constitutes acceptance of the changes.

15. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EU users, you may also contact your local data protection authority if you have concerns about our data practices.

16. Governing Law

This Privacy Policy is governed by the laws of India, while respecting the privacy rights granted under GDPR, CCPA, and other applicable privacy laws based on your location.