This document is in final legal review. Questions in the meantime: [email protected].
In short
How Mabeyn LLC collects, uses, shares and protects personal data when you use Sociby, and the rights you have, including under the GDPR, UK GDPR, the California Consumer Privacy Act and Turkey's Law No. 6698 (KVKK).
1.Who we are
Sociby is operated by Mabeyn LLC, 117 S Lexington St, Ste 100, Harrisonville, Missouri 64701, United States ("Sociby", "we", "us"). We are the controller of the personal data described in this policy. You can reach us about privacy at [email protected].
This policy applies to sociby.com, app.sociby.com and our related services. It does not apply to third-party services that you reach through links or integrations.
2.Personal data we collect
We collect the following categories of personal data:
- Account data: your email address, name, password (stored only as a secure hash), the way you sign in (for example Google sign-in), your language and the account type you choose.
- Brand and design data: brand kits (names, logos, colors, fonts, field, handles), photos you upload, texts and prompts you write, and the designs and pictures you create.
- Payment data: the plans and credits you buy, amounts, dates, order and receipt references. Card details are collected and stored by Stripe, not by us.
- Usage and technical data: sign-in sessions, IP address, browser and device information, the actions you take in the app (such as generations and downloads) and error logs, used to run and secure the Service.
- Communications: messages you send to support and the emails we send you, including your choices about product news.
- Consent records: the versions of our Terms and this policy you accepted, and when.
3.How we use personal data and our legal bases
We use personal data only for the following purposes:
- To provide the Service: create and manage your Account, store your brand kits and designs, generate pictures and deliver downloads (performance of our contract with you).
- To process payments, renewals, receipts and refunds, and to prevent payment fraud (contract; legal obligations; our legitimate interest in preventing fraud).
- To keep the Service secure and working: authentication, rate limiting, abuse detection, content moderation and debugging (legitimate interests).
- To communicate with you about your Account, purchases, security and changes to our terms (contract; legitimate interests).
- To send product news and tips, only if you opted in; you can opt out at any time (consent).
- To comply with law, enforce our terms and protect our rights (legal obligations; legitimate interests).
We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not use Your Content or your designs to train AI models.
4.AI processing
When you generate a picture, we send a prompt built from your brand kit, field, chosen style and the text you write to an AI model provider (currently Google's Gemini API and, where configured, OpenAI). Photos you ask us to edit are sent as well. Your logos and fonts are not sent for generation; they are added afterwards by our own compositor.
Our AI model providers process this data on our behalf to return the picture, under their business terms, which do not allow them to use API data to train their models. Please do not include sensitive personal data in prompts.
6.International transfers
We are based in the United States and our service providers may process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom, Switzerland or Turkey, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK addendum), or on other lawful transfer mechanisms. You can ask us for more information about these safeguards.
7.How long we keep personal data
We keep personal data only as long as needed for the purposes above:
- Account, brand and design data: for as long as your Account exists. Designs you move to the trash are deleted after 30 days; uploaded photos that no design uses are deleted after 24 hours.
- When you delete your Account, we delete your Account, brand kits, designs and uploads, except data we must keep by law.
- Payment and tax records: for as long as tax and accounting laws require, usually up to seven years.
- Security logs: for a limited period, usually no longer than 12 months.
8.Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data and complete incomplete data;
- delete your data;
- receive your data in a portable format (Account › Download your data in the app);
- object to or restrict certain processing, including processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing;
- lodge a complaint with your data protection authority.
You can download or delete your data yourself in the app. For any other request, email [email protected]. We will answer within the time the law requires (usually one month) and may need to verify your identity. We will not discriminate against you for exercising your rights.
9.Notice for California residents
In the last 12 months we collected the categories of personal information described in "Personal data we collect" (identifiers, commercial information, internet activity, and content you provide) for the business purposes described in "How we use personal data". We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information for purposes other than providing the Service. California residents may exercise the rights to know, delete, correct and opt out, and may use an authorized agent, by emailing [email protected].
10.Notice for people in Turkey (KVKK)
For personal data subject to Law No. 6698 on the Protection of Personal Data (KVKK), Mabeyn LLC acts as the data controller. We process your data for the purposes and on the legal grounds in Articles 5 and 6 of KVKK described in this policy: performance of a contract, compliance with legal obligations, our legitimate interests and, where required, your explicit consent. Personal data may be transferred abroad to the service providers listed above under Article 9 of KVKK. You can exercise your rights under Article 11 of KVKK, including the right to learn whether your data is processed, to request correction or deletion and to object, by writing to [email protected].
11.Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, hashed passwords, access controls, rate limiting and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your data, we will notify you and the authorities as the law requires.
12.Children
The Service is not intended for people under 18 and we do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
14.Changes to this policy
We may update this policy. If a change is material, we will tell you by email or in the app before it takes effect. The date at the top shows when the policy last changed.
15.Contact
Mabeyn LLC, 117 S Lexington St, Ste 100, Harrisonville, Missouri 64701, United States. Email [email protected] for privacy questions and requests.