ZuluSocial

Privacy Policy

Last updated: October 4, 2026

1. Introduction

ZuluSocial ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Instagram growth platform and related services.

2. Information We Collect

2.1 Personal Information

  • Email address and full name when you create an account
  • Company name (optional)
  • Billing information for paid subscriptions
  • Communications you send to us

2.2 Instagram Data

When you connect your Instagram account, we access:

  • Basic account information (username, profile picture, follower count)
  • Media content (posts, images, captions) for analytics
  • Engagement metrics (likes, comments, reach, impressions)
  • Audience insights and demographics
  • Hashtag performance data

2.3 Usage Data

  • How you interact with our platform
  • Features you use most frequently
  • Device information and browser type
  • IP address and location data
  • Cookies and similar tracking technologies

3. How We Use Your Information

  • Service Delivery: Provide Instagram growth analytics and optimization tools
  • Analytics: Generate insights about your Instagram performance
  • Personalization: Customize recommendations and content suggestions
  • Communication: Send important updates, support responses, and marketing (with consent)
  • Billing: Process payments and manage subscriptions
  • Security: Protect against fraud and unauthorized access
  • Legal Compliance: Meet regulatory requirements and enforce our terms

4. Information Sharing

We do not sell your personal information. We may share information in these limited circumstances:

4.1 Service Providers

  • Supabase: Database hosting and authentication
  • Vercel: Application hosting and deployment
  • Stripe: Payment processing (billing information only)
  • Meta/Instagram: API access for Instagram data (as authorized by you)

4.2 Legal Requirements

We may disclose information if required by law, court order, or to protect our rights and safety.

4.3 Business Transfers

In case of merger, acquisition, or sale, your information may be transferred to the new entity.

5. Data Security

We implement industry-standard security measures:

  • Encryption of data in transit and at rest
  • Regular security audits and updates
  • Access controls and authentication requirements
  • Secure hosting with enterprise-grade providers
  • Regular backups and disaster recovery plans

6. Your Rights and Choices

6.1 Account Control

  • Update your profile information at any time
  • Disconnect your Instagram account
  • Delete your account and associated data
  • Export your data in a portable format

6.2 Privacy Rights (GDPR/CCPA)

If you're in the EU, UK, or California, you have additional rights:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate information
  • Erasure: Delete your personal data ("right to be forgotten")
  • Portability: Receive your data in a machine-readable format
  • Restriction: Limit how we process your data
  • Objection: Opt out of certain processing activities

To exercise these rights, contact us at privacy@zulusocial.com

7. Instagram Data Handling

Regarding your Instagram data specifically:

  • We only access data you explicitly authorize through Instagram's OAuth process
  • Your Instagram credentials are never stored on our servers
  • We use Instagram's official API and comply with their Platform Policy
  • You can revoke our access at any time through Instagram's app settings
  • Instagram data is used solely for providing our analytics services
  • We do not use your Instagram data for advertising or marketing to third parties

8. Cookies and Tracking

We use cookies and similar technologies for:

  • Essential: Authentication, security, and core functionality
  • Analytics: Google Analytics to understand usage patterns
  • Performance: Optimize loading times and user experience
  • Preferences: Remember your settings and preferences

You can control cookies through your browser settings.

9. Data Retention

  • Account Data: Retained while your account is active
  • Instagram Data: Refreshed regularly, older data may be archived
  • Analytics Data: Aggregated data may be retained longer for insights
  • Billing Data: Kept for tax and legal requirements (typically 7 years)
  • Deleted Accounts: Most data deleted within 30 days of account closure

10. International Transfers

Your data may be processed in countries outside your home country, including the United States. We ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions.

11. Children's Privacy

Our service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If we become aware of such data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through our platform. Your continued use after changes indicates acceptance of the updated policy.

13. Contact Information

For privacy-related questions or concerns:

  • Email: privacy@zulusocial.com
  • Address: ZuluSocial Privacy Team
  • Response Time: We aim to respond within 30 days

AI creation and Native Video Studio

When you use AI tools, we send the prompts and selected inputs needed for your request to the relevant provider. OpenAI powers conversational editing and, when enabled, transcription and voiceover. Google provides image and video generation; PiAPI provides access to supported video-generation models. Supabase stores projects and media, Vercel hosts the application, and Inngest coordinates background jobs. Providers receive inputs only for the tools you request; importing an existing generated asset does not request a new generation.

A Studio chat request can include your project timeline, media descriptions, relevant chat history, and up to two selected images or video contact sheets. The editing chat does not send your raw video or audio file to OpenAI. An explicitly requested transcription, voiceover, or generation can send its required media or text to that tool's provider. Only upload material you have permission to process, and avoid sensitive personal information in prompts and media.

Studio editing requests disable OpenAI response storage with store: false. This is not a promise of zero retention: provider safety logs, prompt caches, and applicable exceptions can still retain data. See OpenAI's data controls for current details. Other providers apply their own data policies.

Native Studio uploads and exports use private storage and temporary authorized access links. Making an export available for social publishing requires your explicit confirmation and creates a separately accessible copy. A public publishing copy is not protected by the original private asset's temporary link, and copies already delivered to social platforms are governed by those platforms.

Private saved prompts and your Studio chat messages are removed during confirmed account cleanup. Deleting an account does not erase other members' shared workspace projects, assets, revision history, or confirmed public publishing copies used by those projects; those shared contributions may retain an opaque creator identifier. Sole-owner workspaces with no other members can be removed. Minimal settled credit and job reconciliation records may remain without prompt or provider payload content. Active or uncertain jobs, unresolved charges, or worker files requiring reconciliation can delay deletion; the application will not report account deletion as complete before required cleanup is confirmed. Contact privacy@zulusocial.com for assistance or requests involving retained shared contributions.

This Privacy Policy is designed to be transparent and comprehensive. If you have questions about any section or need clarification, please don't hesitate to contact us.