Privacy
What we collect, what we do with it, and what we never do with it. Written to be read, not to be survived.
Last updated 9 September 2026
Unsocial Studiio (ABN 88 998 861 786) operates the Unsocial Studiio platform at app.unsocialstudiio.com. We are based in Wollongong, New South Wales, Australia.
This policy covers the platform. If you are a client of our agency services rather than a user of the platform, the same principles apply and the same contact details reach us.
For anything in this policy, write to esther@unsocialstudiio.com.
Two kinds of people appear in this policy, and it matters which one you are.
If you are a studio's client and want to know what is held about your business, ask the studio you work with first. They control the account. You can also contact us directly and we will help.
The platform is useful because it reaches the accounts you already run. You choose which to connect, and you can disconnect any of them at any time. We only ever request the narrowest set of permissions the feature needs.
Subscriptions are handled by Stripe. Card numbers never reach our systems. Stripe holds them and we hold only a customer reference, the plan you are on, and the status of your subscription. Stripe's own privacy policy governs the payment data itself.
The detail
When a studio connects a Google account, we ask for three permissions and no others.
| Permission | What it lets us do |
|---|---|
| business.manage | Read the Business Profile locations you manage, read the reviews left on them, and post a reply to a review when you press send. |
| youtube.force-ssl | Read comment threads on your YouTube videos and post a reply when you press send. |
| userinfo.email | Show you which Google account you connected, so you can tell one from another. Nothing else. |
How we handle it
We store only an encrypted refresh token. That is the credential that lets us reconnect to Google on your behalf. It is encrypted at rest.
Review and comment text is displayed, never copied into our own store. When you open the reviews page we fetch it from Google, show it to you, and let it go. We do not keep a copy.
Nothing is ever posted automatically. Every reply to a review or a comment is sent because a person read it, wrote a response, and pressed send.
Disconnecting actually disconnects. When you disconnect a Google account we call Google's own revoke endpoint, which invalidates the token at Google's end, rather than simply deleting our copy and leaving the grant standing.
Unsocial Studiio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train generalised artificial intelligence models, we do not sell it, and we do not transfer it except as described in this policy.
When a studio connects an Instagram professional account and the Facebook Page linked to it, we ask for the following.
| Permission | What it lets us do |
|---|---|
| instagram_basic | Read the account's profile and its published posts, so we can show them to you. |
| instagram_content_publish | Publish a post you have composed, at the moment you press publish. |
| instagram_manage_comments | Read comments on your posts and post a reply when you press send. |
| pages_read_engagement | Read comments and engagement on your Facebook Page. |
| pages_manage_engagement | Post a reply to a Page comment when you press send. |
The same rules apply as for Google. Comment text is shown to you and not copied into our store, nothing is published or replied to without a person pressing the button, and disconnecting removes our access.
We use information to run the product for you and for nothing else. Specifically: to show you your content and your accounts, to publish and reply when you tell us to, to produce the reports you asked for, to bill you, and to answer you when you contact us.
We do not sell your information. We do not share it with advertisers. We do not use content from your connected accounts to train generalised artificial intelligence models.
We use a small number of providers to run the platform. They process information on our instructions only.
| Provider | What for |
|---|---|
| Netlify | Hosting the application |
| Supabase | Database and storage |
| Stripe | Subscription billing and payments |
| Notion | Where a studio's own content lives, when connected |
| Anthropic | Generating drafts and suggestions when you ask for them |
Some of these providers store or process data outside Australia, including in the United States. By using the platform you consent to that transfer. We choose providers that offer contractual protections for personal information.
We keep your account information and your content for as long as your account is open. When you close your account we delete it, along with every connected credential. See Data deletion for exactly how and how long.
We keep billing records for the period Australian tax law requires, currently five years. Those records contain the fact and amount of a payment, not the content of your account.
Connection tokens are encrypted at rest. Access to production systems is restricted and protected by multi factor authentication. Traffic to and from the platform is encrypted in transit.
No system is perfect, and anyone who tells you otherwise is selling something. If we ever suffer a breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
Under the Australian Privacy Principles you can ask us to show you the personal information we hold about you, correct it if it is wrong, or delete it. You can also disconnect any connected account yourself, at any time, from Settings.
Write to esther@unsocialstudiio.com and we will respond within 30 days. If you are not happy with how we handle a privacy complaint you can take it to the Office of the Australian Information Commissioner.
We use cookies to keep you signed in and to remember your preferences. We do not use advertising cookies and we do not track you across other websites.
The platform is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.
If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell you by email before it takes effect.