Privacy Policy

This explains what soshctrl does with your personal data. We are Cognitelligence SHPK, Prishtinë 10000, Republic of Kosovo, trading as Xctrl, and we're the controller of the data described here. Questions or requests: privacy@soshctrl.com.

1. What we collect

• Account: your name, email, a hashed password, and your plan.
• What you put in: pipeline settings, prompts, topics, and any files you upload as context.
• What comes out: the video, images, audio and text generated for you, and the record of which model made it and what it cost.
• Connected accounts: the access keys the social platforms and file services give us when you authorise them. These are encrypted, and we never receive a platform password.
• Publishing records: what was posted where, and the engagement figures the platforms report back.
• Billing: your plan and invoice records, and a payment reference from Paysera. We never see or hold your card number.
• Technical: activity and error logs, IP address, browser type.
• If you contact us: whatever you write, and your email address.

We don't collect sensitive categories of data, and you shouldn't put them into the service.

2. Why we use it, and what allows us to

• To run the service you signed up for — creating your account, generating content, publishing it, sending you approval and billing emails. We need this to perform our contract with you.
• To bill you and keep tax records. Contract, and legal obligation.
• To keep the platform secure — rate limits, abuse detection, audit logs. This is our legitimate interest in protecting the service and its users.
• To answer you when you get in touch. Our legitimate interest in replying.
• To send you marketing, only if you've opted in. You can withdraw at any time.
• To comply with the law when a court or regulator requires it.

We don't sell personal data, and we don't make automated decisions that have a legal or similarly significant effect on you.

3. Who we share it with

Only with the suppliers who help us run soshctrl, each under a contract that limits what they can do with it. By category, they are:

• AI generation. Every text, image and video request goes through one gateway, which passes it to the model you chose. Your prompt and any reference material go with it.
• Hosting, database and file storage.
• Email delivery for approval requests and account notices.
• Payment processing — Paysera.
• Security, content delivery and error monitoring. Our error monitoring receives technical diagnostics only, never your prompts or generated content.

We'll name the specific companies on request — write to privacy@soshctrl.com. We may also share data with professional advisers, with a buyer if the business is sold, or where the law requires it.

4. The accounts you connect

soshctrl uses YouTube API Services to publish to and read analytics from your YouTube channel. Google's own handling of your data is governed by the Google Privacy Policy, and the YouTube Terms of Service apply to your use of YouTube through soshctrl.

From YouTube we access and store only what publishing needs: your channel identifier and name, the videos soshctrl uploaded on your behalf, and the view and engagement figures for them. We don't read your subscriber list, your private videos or anything soshctrl didn't publish. Publishing to Instagram, Facebook and TikTok works the same way, under those platforms' own terms, and we take only the account identifier, what we posted, and its metrics.

You can withdraw access at any time, two ways:

• In soshctrl, from the Connectors page. We delete the data held under that authorisation within 7 days.
• For Google and YouTube, from the Google security settings page. We delete it within 30 days. The equivalent controls are in Meta's and TikTok's own app settings.

You can also ask us to delete stored platform data without disconnecting — email privacy@soshctrl.com. Content already published stays on your social account; only that platform can remove it.

5. Where your data goes

Your account, your uploads and the content generated for you are stored in the European Union. Some of our suppliers — including the AI gateway, our hosting and our error monitoring — operate from the United States, so your data is transferred there when they process it. Those transfers are covered by standard contractual clauses approved for international transfers.

Which country an individual generation touches also depends on the AI model you pick, since model providers operate in different places. If you need to avoid a particular country, choose your models accordingly or ask us first.

6. How long we keep it

• Your account and pipelines — while your account is open.
• Run logs and generated content — around 90 days, then archived or removed.
• Temporary working files — 7 days.
• Connection keys and platform data — until you disconnect: 7 days if you disconnect in soshctrl, 30 days if you revoke from the platform.
• Enquiries — up to 24 months after we last spoke.
• Billing and tax records — 7 years, because the law requires it.

When you close your account we delete or anonymise your personal data within 30 days, apart from those tax records. Backups expire on their own short cycle. Content you already published stays on your social accounts — we can't remove it.

7. Keeping it safe

Connection keys and other sensitive credentials are encrypted where we store them. Everything travels over an encrypted connection. Generated files sit in private storage that needs a signed link to open. Each account's data is separated from every other account's, admin access is restricted and every change is logged. No system is perfectly secure, but if a breach affects your data we'll notify the authority and, where required, you. Report a vulnerability to security@soshctrl.com.

8. Cookies and browser storage

This website sets no cookies. There's no analytics, no advertising and no tracking on it. It does load fonts from Google, which means your browser contacts Google's servers.

Once you log in, the application stores a sign-in token and your interface preferences in your browser so you stay logged in. Our security provider may also set short-lived cookies to tell automated traffic from people. All of that is necessary to deliver the service or keep it secure, which is why you don't see a consent banner. If we ever add anything optional, we'll ask you first.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You can withdraw consent where you gave it. Email privacy@soshctrl.com and we'll reply within one month. We may need to confirm who you are first.

If you think we've got it wrong, you can complain to the Information and Privacy Agency of the Republic of Kosovo (aip.rks-gov.net). If you're in the EU or EEA, you can complain to your own country's data protection authority instead. If you're somewhere else with its own data protection authority, you can go to that one.

10. Children

soshctrl isn't for anyone under 16 and we don't knowingly collect their data. If you think we have, tell us and we'll delete it.

11. Business customers

If you're putting other people's personal data into soshctrl, you're the controller of it and we process it on your instructions. We'll sign a data processing agreement on request — legal@soshctrl.com.

12. Changes

If we change this policy significantly, we'll tell you by email or in the app at least 14 days beforehand. The date at the top always shows the current version.

13. Contact

Cognitelligence SHPK, Prishtinë 10000, Republic of Kosovo · business no. 812331461
Privacy: privacy@soshctrl.com · Security: security@soshctrl.com

See also the Terms of Service and our legal notice.