Privacy Policy

Who we are

Unplain Hub ("the Service") is provided by Unplain Media, trading under S&D Casey Bros Ltd (Registration HE429874, VAT (CY) 60034010C), a company registered in the Republic of Cyprus. Unplain Hub is a social media workspace that helps businesses manage their own social media and agencies manage social media for multiple clients.

This Privacy Policy explains what information we collect, why we collect it, and the choices you have. It applies to staff users (agency team members and administrators) and client users (businesses and their invited contacts).

Information we collect

Account information: name, email address and authentication details when you create or are invited to an account. We authenticate accounts through managed authentication and optional single sign-on providers such as Google.

Business and brand information: business names, descriptions, brand tone, services, audiences, posting preferences, contact details and other details you enter into a brand profile.

Content: content ideas, briefs, captions, generated text and images, uploaded media, post schedules, approvals and communications you create or store in the Service.

Social connections: when you connect a social account, we store limited tokens and identifiers needed to publish on your behalf through authorised publishing partners. We do not store your social media passwords.

Billing information: invoice and payment records required to manage retainers, quotes, contracts and invoices. Payment card details are handled by our payment provider; we do not store full card numbers.

Usage and technical data: approximate device and browser information, service logs and feature usage used to operate, secure and improve the Service.

How we use information

To operate the Service: create and schedule content, manage approvals, publish to connected accounts, generate reports and provide the features you request.

To communicate with you about your account, approvals, scheduled posts, billing and important service notices.

To secure the Service: detect, prevent and respond to fraud, abuse and security issues.

To improve the Service: analyse aggregated, non-identifying usage to fix issues and prioritise features.

AI processing and third-party models

Unplain Hub uses artificial intelligence to generate text and images. Generation may run on third-party model providers, including OpenAI and built-in providers.

If your account is configured to use a third-party model provider such as OpenAI, the prompts, brand information, captions and reference images you send may be processed by that provider. Under OpenAI's data-sharing arrangements, content sent through certain accounts may be used by OpenAI to train and improve its models. The built-in generation engine is not used for model training.

If you manage clients, you should disclose this processing in the agreements your clients accept and allow clients to opt out of third-party model providers where sensitive content is involved. You are responsible for ensuring you have permission to send client content to third-party providers.

Generated outputs may be inaccurate. You are responsible for reviewing generated content before it is published.

Social accounts and publishing partners

When you connect a social account, you authorise Unplain Hub to access that account through the platform's official authorisation process for the limited purpose of publishing and reporting on content you approve.

Publishing is carried out through authorised publishing partners, including PostForMe. We store only the tokens and identifiers required to publish and read back publishing results. We do not store your social media passwords.

You can disconnect a social account at any time from your workspace, which removes our access to that account.

AI assistants and the ChatGPT connection (MCP)

Unplain Hub offers an optional connection that lets you use AI assistants such as ChatGPT with your Hub account through our MCP server. Connecting is optional and requires your explicit authorisation and sign-in with your Hub account.

When connected, the AI assistant can access the businesses you have permission to see, view recent posts and content profiles, and create or schedule draft content on your behalf. It cannot approve or publish content, change billing, or access businesses outside your permissions.

Prompts and content you send through the AI assistant are processed by the assistant's provider (for example OpenAI) under that provider's own privacy terms, in addition to this policy.

You can disconnect the AI assistant at any time from the assistant's settings or by contacting us. Disconnecting removes the assistant's access to your Hub account.

Google and analytics integrations

Unplain Hub can connect to Google services such as Google Search Console. Connections use Google's official authorisation and read-only scopes. Tokens are stored securely and used only to retrieve the data you request.

We never ask for or store your Google password.

How we share information

With your service providers: we use trusted providers for hosting (Lovable Cloud), database, authentication and file storage of account data and content (Supabase), publishing (PostForMe), payments (Stripe and Viva Wallet), accounting (QuickBooks), email delivery, AI generation (OpenAI and Google Gemini), SEO data (DataForSEO) and Google services. These providers process data only to deliver the Service and under appropriate obligations.

Within your workspace: agency staff can see the clients and content within their own workspace. Client users can see their own business's content, reports and billing. Workspaces are isolated from each other.

For legal and safety reasons: we may disclose information where required by law, to protect the Service, or to protect the rights, property or safety of Unplain Media, our users or others.

We do not sell your personal data.

Data retention and account deletion

We keep your information for as long as your account is active or as needed to provide the Service. Media you mark for retention is kept until you delete it or your account is closed.

Cancelling a subscription does not delete your account or its data. To delete your account, email info@unplainmedia.com from the email address on your account. Your workspace content and personal data are then permanently deleted after 7 days. During those 7 days you can contact us to stop the deletion and restore your account.

Billing records are excluded from the 7-day deletion. Invoices, payment records and the related customer details needed on them (such as name, business name, address and VAT number) are retained to meet our legal obligations under Cyprus and EU tax, VAT and accounting law, and for the establishment or defence of legal claims (GDPR Article 6(1)(c) and 6(1)(f)). We keep these records for as long as those obligations and our legitimate business needs require, and they are not used for any other purpose.

These records never include payment card details, which are handled by our payment providers (Stripe and Viva Wallet) and are never stored by us.

Security

We use row-level access controls to enforce workspace isolation, encrypted storage for sensitive tokens, signed links for private files, and server-side validation for sensitive actions such as approvals and billing access.

No method of transmission or storage is fully secure, but we work to protect your information using reasonable technical and organisational measures.

Your rights and choices

You can review and update profile and brand information from your workspace, disconnect social and Google accounts, delete content and media, and request export or deletion of your data.

If you are in the UK, EU or another jurisdiction with data protection rights, you may have rights to access, correct, delete or restrict your data, and to lodge a complaint with your local data protection authority.

International transfers

Your information may be processed in the European Union and in other countries where our service providers operate. We take steps to ensure appropriate safeguards are in place for such transfers.

Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe we have collected data from a child, contact us so we can delete it.

Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be communicated through the Service or by email. Continued use after a change means you accept the updated policy.

Contact

If you have questions about this Privacy Policy or your data, contact Unplain Media through the support options in your workspace or at info@unplainmedia.com.