Privacy Policy

Gridcore AI Social Auditor is a subscription service that connects to a customer's YouTube channel, Facebook Page and Instagram professional account with read-only access by default and produces a daily AI-written performance audit. It also offers an optional scheduling and publishing feature (section 2.7), which needs an extra permission that you give separately. It is operated by Gridcore Inc.. You can reach us at support@gridcoreinc.online.

2.1 Information you give us

When you sign up and complete your profile we collect:

• your name and email address;
• if you sign up with an email address, the password you choose. We store it only as a salted one-way (scrypt) hash, never in readable form;
• your phone number (required), which we use to contact you about your account. It is also the number for Telegram/WhatsApp notifications, which are not active; we do not message it unless you later switch them on;
• your country, state or region, and city (required);
• the links to your YouTube channel, Instagram profile and Facebook Page (optional);
• if you fill it in, your brand profile (optional): what your business does, your niche, audience, what makes you different, target regions, languages, brand voice, content topics, things to avoid and your preferred call to action.

2.2 Payment information

Payments are processed by Razorpay. Your card, UPI, bank or wallet details are entered on Razorpay's secure checkout and are never sent to or stored by us. We store only the Razorpay order ID, payment ID, amount, currency, status and payment date — and, if you switch on the optional auto-renew, the Razorpay subscription ID and its status (when the next charge is due, whether it is active or cancelled). Razorpay also sends our server signed notifications about your payments, refunds and auto-renew charges so that we can record them even if you close the page mid-payment.

2.3 Data from accounts you connect

When you choose to connect an account, you sign in on Google's or Facebook's own pages and grant us read-only permissions (publishing is a separate, optional permission — see section 2.7):

• Google / YouTube — your basic Google profile (account ID, name and email address, used to identify you and let you sign in) and, through the YouTube Data API v3 and YouTube Analytics API with read-only scopes (for example youtube.readonly and yt-analytics.readonly): your channel ID and name, public channel and video information (titles, publish dates, durations, thumbnails), and channel/video analytics such as views, watch time, average view duration, audience retention, subscriber changes, traffic sources and subscribed vs. non-subscribed viewer breakdowns.
• Meta / Facebook & Instagram — your app-scoped Facebook user ID and name, the list of Facebook Pages you manage and choose to connect, and read-only Page and Instagram professional-account insights (for example via pages_show_list, pages_read_engagement, read_insights, instagram_basic and instagram_manage_insights): Page and Instagram account IDs, names/usernames, posts, Reels and their captions and publish times, and metrics such as reach, impressions, plays, likes, comments counts, shares, saves and follower vs. non-follower reach.

We do not read your private messages and we do not access your contacts or friends lists. With the read-only permissions above we cannot post, comment, like or edit anything. The only exceptions are the optional features in sections 2.7 and 2.8: if — and only if — you switch them on, we publish the posts you scheduled, and we read and answer the comments on your own posts, and change the details of your own videos, as you tell us to.

2.4 Credentials you enter manually

If you choose to connect an account by pasting credentials (such as an API key or access token) instead of signing in, we store them encrypted and use them only to read the same analytics described above.

2.5 Public data you ask us to look up

Some tools work on public information rather than on your own accounts, and need no permission from you or from the other party:

• Competitor tracking — the public YouTube channels you choose to follow. We store the channel's ID, name and handle (until you remove it) and, through the YouTube Data API, its public subscriber, view and video counts, plus summary figures from its recent public videos (such as which title words and tags it uses, and the titles and view counts of a few top videos). A weekly job refreshes the counts so you can see the change since last week.
• Instagram competitor benchmarking — the public Instagram Business or Creator accounts you choose to follow (up to five). Through Instagram's “Business Discovery” feature, using your own Instagram connection, Instagram returns that account's public username, name, profile picture, follower and post counts and the like and comment counts, captions, post types and times of its latest posts. We store the username and, as figures, those counts and a summary (average likes and comments, posting rhythm, most-used hashtags, a few top posts) and refresh them weekly. Personal accounts cannot be looked up and nothing private is read; the account is not notified.
• Analyze a video — a YouTube link you paste. We read that video's public title, description, tags and statistics (and its channel's recent public videos, for comparison) to explain why it performs well.
• Keyword research — the keywords or phrases you type, together with a country and language, are sent to DataForSEO to look up search volume and competition. The numbers that come back are kept for up to 30 days without your name, account or the fact that you searched, and are shown to other customers who look up the same keyword in the same country (so that one paid look-up serves everybody).
• Facebook Page benchmarking — the public Facebook Pages you choose to follow (up to five). Through Meta's “Page Public Content Access” feature, using your own Page connection, Meta returns that Page's public name, category, follower and like counts and the reactions, comments and shares of its latest public posts. We store the Page ID and, as figures, those counts and a summary, and refresh them weekly. Personal profiles cannot be looked up and nothing private is read.
• Research tools — question mining (the topic you type is sent to Serper or DataForSEO to fetch the questions people search on Google; the list is kept for up to 14 days without your name or account and shown, for up to 3 days, to other customers who look up the same topic in the same country), search rank tracking (the phrases you add and the ID of your own video are stored; each week we run a public YouTube search and keep the position, for 90 days), trend alerts (the public “most popular” chart of YouTube for your country is reduced to repeating words, and the ones that match your niche are shown to you; kept 30 days), niche & content-gap research and thumbnail & title patterns (public YouTube search results, public channel figures and the public titles and thumbnails of the competitors you track; nothing is stored).
• Free SEO report — if your brand profile names a niche or content topics, we send that topic (a few words, for example “home fitness”) with your target country and language to DataForSEO (search volumes) and to Serper or DataForSEO (the questions people search) to fetch Google search data. These are market figures, not data about you; we keep them once for everyone in the same niche and market. On our own servers we then compare them with the titles of your own recent videos. The resulting report is stored for you and deleted after 60 days (and when your account content is deleted); if the AI note is switched on, an AI model also sees the topic, the figures and a few of your recent titles to write two or three sentences. Your name, email and account data are never sent to DataForSEO or Serper.

These tools contain no private data about the channels they cover, and we do not contact anyone about them.

2.6 Technical information

Our servers keep standard technical logs (IP address, browser user-agent, requested page, time) for security and troubleshooting. We use only essential cookies (see Cookies). We do not use advertising or cross-site tracking cookies.

2.7 Optional publishing (scheduling)

Besides reading analytics, Gridcore AI Social Auditor can schedule and publish posts for you — but only if you press “Enable publishing” for a network and grant the extra permission on Google's or Facebook's own consent screen. Until you do, we hold no permission to publish anything for you, and you can take it back at any time (section 11). The extra permissions are:

• YouTube — https://www.googleapis.com/auth/youtube.upload, used only to upload to your own channel the videos you scheduled, with the title, description, tags, hashtags and privacy setting you chose, at the time you chose.
• Facebook Page — pages_manage_posts (publish the text, photo or video posts you scheduled to the Page you connected) and pages_manage_engagement (post the optional first comment you wrote).
• Instagram professional account — instagram_content_publish (publish the Reel or photo you scheduled) and instagram_manage_comments (post the optional first comment you wrote).

What we store for this feature, and only for it:

• the video and photo files you upload, the caption, title, hashtags, tags, link and first comment you write, the time you schedule and the network(s) you pick, together with the result (published or failed, the network's ID and link for the post, and an error message if it failed);
• if you tick “shorten my link”, the web address you entered and a click counter behind a short link on our own domain. The counter records only how many times the link was opened — not who opened it.

Instagram and Facebook load an uploaded file from our server themselves, through a long, unguessable link that stops working after a few hours. We never publish anything that you did not schedule, we never edit or delete your existing posts, and we never publish for a client whose subscription has ended.

2.8 Optional comment inbox, channel edits and automation rules

These features need an extra permission that you give only by pressing “Enable inbox” (or “Enable inbox & channel edits”) for a network on Google's or Facebook's own consent screen. Until you do, we hold no such permission, and you can take it back at any time (section 11). The extra permissions are:

• YouTube — https://www.googleapis.com/auth/youtube.force-ssl, used only to read the comments on your own videos, to post the replies you write, to hide or delete a comment when you press the button, and to change the title, description and tags of your own videos when you tell us to.
• Facebook Page — pages_manage_engagement (read the comments on your Page's posts, post the replies you write, hide or delete a comment when you press the button).
• Instagram professional account — instagram_manage_comments (the same for the comments on your Instagram posts).

What we store for these features, and only for them:

• the public comments on your own posts (the text, the commenter's public display name and ID, the time, the post it belongs to), whether you replied, hid or deleted it, the reply you sent and any draft reply — kept for 90 days at most. A comment you delete from the inbox is removed from the network and its text is cleared here;
• for every change to one of your videos, the old and the new title, description and tags, so that you can undo it — kept for 60 days at most;
• the automation rules you write (words to look for, reply texts, schedules, post wordings, feed addresses) and, for a feed rule, a one-way fingerprint of the items already seen, so that nothing is posted twice;
• a short line in your activity log for each action (who, what, when — not the text of a comment or reply).

Comments are written by other people about your content. We use them only to show them to you, to let you answer them and — if you press “Suggest replies with AI” — to send that one comment to our AI provider (section 4). We do not contact commenters except with the replies you send, we do not build profiles of them and we do not read or send direct messages.

Automation rules (repeating posts, feed-to-Facebook posts and keyword replies) exist only if you create them, are switched off when created, and only act after you switch them on, and only on what happens afterwards. By default a rule's posts wait for your approval, and its replies are drafts that you send. If you choose “send automatically”, the reply is exactly the text you wrote — no AI-written text is ever sent without a person pressing Send. A rule that fails three times in a row switches itself off.

2.9 Teammates, white-label reports and the assistant connector

• Teammates — if the account owner invites a teammate, we store their name, email address, role (Manager, Editor or Viewer) and, once they accept, a salted one-way hash of the password they choose. The owner and the activity log can see who did what (“Asha (Editor) approved a post”). Removing a teammate deletes their record and signs them out at once.
• White-label reports — the name, tagline, colour, logo and footer you enter so that reports can carry your own look. If you create a share link, anyone who has the link can read that one report's text until it expires (7, 30 or 90 days) or you revoke it. We store only a one-way hash of the link and a counter of how many times it was opened — not who opened it. Ended links are deleted after 30 days.
• Assistant connector — if you create a token for an AI assistant of your choice (the owner only), that assistant can read your reports and summary figures, read-only, until you revoke the token. We store only a one-way hash of the token. What the assistant's provider does with the data once it has read it is governed by that provider's own terms.
• Saved replies, brand profile, tracked search phrases — texts and phrases you write for your own use, kept until you delete them or the account.

We use your information only to provide the service you subscribed to:

• to create and secure your account and let you sign in (email and password, Google or Facebook sign-in);
• to fetch the analytics of the accounts you connected, typically once a day;
• to generate your AI audit and show it — with your report history — on your private dashboard;
• if you switch on email reports in your dashboard, to email a copy of each daily audit to the address on your account;
• to run the competitor, video and keyword tools you use (section 2.5);
• if you switch on publishing, to publish at the time you chose the posts you scheduled (section 2.7);
• if you enable the inbox, channel edits or automation rules, to show you the comments on your own posts, send the replies and make the changes you ask for, and run the rules you wrote (section 2.8);
• to let the teammates you invite, and the people you share a report with, see what you chose to give them (section 2.9);
• to keep a daily history of your account numbers (followers, views, reach, engagement) and of your recent videos and posts (title or first words of the caption, publish time, views, likes, comments), so your dashboard can show growth charts and a health score;
• if you fill in the optional brand profile on your dashboard, to tailor the suggestions in your audit (hooks, captions, calls to action, titles, tags and hashtags) to your business, audience, languages and voice;
• to process and verify payments and keep required financial records;
• to provide support you request, keep the service secure, and comply with the law.

We do not sell your data, we do not use it for advertising, and we do not use it to build profiles for anyone else.

To write your report, we send the relevant metrics and content details from your connected accounts (for example video titles, captions and performance figures) to an AI model through the provider's API. Which provider and model answers depends on your plan and on how we have set up the service: the default is the Claude API provided by Anthropic, and we may also use models from OpenAI, Google (Gemini API) or DeepSeek. Each provider processes this data as our service provider solely to return the analysis to us, through its API under its own terms and privacy policy (linked above) — we use the API products, not the consumer apps, and we send each request to one provider only. Anthropic's commercial terms do not allow it to train its models on this API data. DeepSeek is operated from China; we use it only for tasks where that is acceptable and, if you prefer, you can write to us to ask that your account is not routed to it. If you fill in the optional brand profile on your dashboard, what you write there is sent together with those metrics so the suggestions fit your brand. We send only what is needed for your audit and never send your access tokens or passwords.

The same applies when you ask for a competitor strategy or a video strategy: the public figures, titles and tags described in section 2.5 are sent to the AI provider to write it, together with — so the advice fits you — the titles and tags of your own recent videos and your brand profile, if you filled it in.

The research and creative tools send to the AI provider only what you ask them to work on: the public titles and thumbnails of channels you track (thumbnail & title patterns), public search results and channel figures (niche research), the words you type for a thumbnail or post design, and — only when you press Suggest replies with AI — the text of that one comment. Comment text and other third-party text is sent as clearly marked data, never as instructions. No AI-written text is posted, sent or published without a person pressing the button, and automation rules send only the fixed text their author wrote. When you use Read my video with AI on the Publish page, the video you uploaded there is sent to the Google Gemini API so the model can watch and listen to it and write its title, description, caption, tags and hashtags. We delete the copy at Google as soon as the answer arrives (Google deletes such files after 48 hours at the latest), and we use the paid API, under whose terms Google does not use the content to improve its products.

In particular, for data we receive from Google (including YouTube data):

• we use it only to provide and improve the user-facing features of Gridcore AI Social Auditor — your daily audit and dashboard — and, if you switch on publishing, to upload to your own channel the videos you scheduled (the youtube.upload permission is used for nothing else);
• if you enable the inbox and channel edits, the youtube.force-ssl permission is used only to read the comments on your own videos, to post the replies you write, to hide or delete a comment when you press the button, and to change the title, description and tags of your own videos as you instruct — for nothing else, and never to change a video's privacy setting, thumbnail or monetisation;
• we transfer it to others only as necessary to provide those features (the AI analysis described in section 4), for security purposes, to comply with applicable law, or as part of a merger or acquisition with your notice;
• we do not use or transfer it for serving advertisements, including retargeting or personalised ads;
• we do not sell it and do not use it to determine credit-worthiness or for lending purposes;
• we do not use it to develop, improve or train generalised AI and/or machine-learning models;
• no human at our company reads it unless you give us permission (for example when you ask for support), it is needed for security purposes (such as investigating abuse), it is needed to comply with applicable law, or it has been aggregated and anonymised for internal operations.

Gridcore AI Social Auditor uses YouTube API Services to read your channel analytics and, only if you switch on publishing (section 2.7), to upload the videos you scheduled and, only if you enable the inbox and channel edits (section 2.8), to read and answer the comments on your own videos and to change their title, description and tags. By connecting YouTube you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

We also use YouTube API Services, with our own API key, to read public information about channels and videos you ask us to look at (competitor tracking and Analyze a video, section 2.5). We keep that public YouTube data for no more than 30 days: it is refreshed or deleted within that time, and the weekly competitor counts you see are never older than that.

You can revoke our access to your Google account at any time from your Google Account's third-party access page (Security → Third-party apps & services). You can also disconnect YouTube from your Gridcore AI Social Auditor dashboard.

Data received from Meta Platforms is used only to produce your audit and — if you switch on publishing (section 2.7) — to publish the posts and first comments you scheduled and — if you enable the inbox (section 2.8) — to read and answer the comments on your own Page and Instagram posts, in line with the Meta Platform Terms. Meta's own practices are described in the Meta Privacy Policy.

To revoke access, go to Facebook Settings & privacy → Settings → Business integrations (direct link), select Gridcore AI Social Auditor and choose Remove. You can also disconnect Facebook and Instagram from your dashboard. See our Data Deletion Instructions for deleting data we already hold.

We share information only with service providers that help us run the service, and only as needed:

• Anthropic and, where your plan or our settings route a task to them, OpenAI, Google (Gemini) and DeepSeek — AI analysis of your metrics and of the public data in section 2.5 (section 4);
• DataForSEO — the keywords you type into keyword research, the topic you type into question mining and the niche topic used for your free SEO report (not your name, email or account data);
• Serper (serper.dev, optional alternative for question lists) — the topic you type into question mining and the niche topic used for your free SEO report, with a country and language (not your name, email or account data);
• Brevo (email delivery) — only if you switch on email reports: your name, email address and the report text, so that it can be delivered to you;
• Razorpay — payment processing, including optional auto-renew subscriptions and the payment notifications it sends us;
• our hosting / cloud infrastructure provider — to store and run the service;
• Google and Meta — when we call their APIs on your behalf to read the data you authorised and, if you switch on publishing, to publish the posts you scheduled (including the video, photo and text you wrote for them) and, if you enable the inbox and channel edits, to read and answer the comments on your own posts and to change your own videos' details as you instruct;
• the people you give access to — a teammate you invite sees your workspace according to their role, and anyone who has a report share link you created can read that one report (section 2.9).

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or in connection with a merger or acquisition (with notice to you). We never sell personal data.

• OAuth access and refresh tokens and any credentials you paste are encrypted at rest with AES-256-GCM, using a key kept outside the database.
• All traffic to our site is encrypted in transit with HTTPS.
• Sign-in sessions use signed, HTTP-only cookies. Your password is stored only as a one-way scrypt hash, so it cannot be recovered from our database, and changing it signs you out on every other device.
• Administrative access is restricted and password protected.

No method of storage or transmission is 100% secure, but we work hard to protect your data and will notify you and the relevant authorities of a breach where the law requires.

• Account details, your brand profile and reports — kept while you have an account, so you can still open your report history after a paid month ends. Each report stores a snapshot of the metrics used to create it, and the daily performance history behind your dashboard charts is kept the same way. Ask us to delete the account when you no longer want it kept.
• Access tokens — kept only while the connection is active. When you disconnect an account in your dashboard, we stop accessing it and delete its stored tokens. When your paid month ends we stop reading your accounts; disconnect them (or ask for deletion) if you also want the tokens removed.
• Deletion requests and closed accounts — you ask for deletion from your dashboard (or by email) and we close the account. On closing we stop the sign-in and auto-renew and delete your connections, access tokens, share links, API tokens and teammates. Your profile details, brand profile, reports, performance history, posts, comments, files and the rest of your content are deleted 30 days after closing (sooner if you ask us to); until then we can restore the account if you change your mind. What remains for good is a small record of the account (name, email, phone number, plan, the dates it was opened and closed and the note of who closed it) and the payment records below.
• Plan and AI-usage records — we log, for each AI request of your account, which task and model was used, how many tokens it took and what it cost, to show your monthly usage and to keep our costs within your plan. They contain no report or comment text and are kept with the payment records.
• Public YouTube data (competitor counts, weekly snapshots and competitor/video analyses) — deleted automatically after 30 days at most; the list of channels you follow stays until you remove them.
• Public Instagram data (the figures and summaries of Instagram competitors, section 2.5) — deleted automatically after 30 days at most; the list of accounts you follow stays until you remove them.
• Public Facebook data (the figures and summaries of Facebook Pages you follow, section 2.5) — deleted automatically after 30 days at most; the list of Pages you follow stays until you remove them.
• Trend alerts and rank history — trend snapshots and alerts are deleted after 30 days; the position history of your tracked search phrases after 90 days; the phrases themselves stay until you remove them.
• Comments and replies (the inbox, section 2.8) — deleted automatically 90 days after the comment was written; a comment you delete from the inbox has its text cleared at once. Channel edits (the old and new title, description and tags) — deleted 60 days after the change; undo is possible for 30 days. The fingerprints a feed rule keeps are deleted after 120 days. Activity log lines — 180 days.
• Share links — a link that expired or was revoked is deleted 30 days later. Teammates, API tokens, saved replies, rules and your brand kit stay until you remove them or delete the account.
• Files and posts for publishing — an uploaded file that no waiting post needs is deleted automatically after about two days (a failed post keeps its file for 7 days so that you can retry), and you can delete any file yourself at any time. The record of a scheduled or published post (text, time, result) is kept with your account until you delete the account.
• Payment records — kept for as long as tax and accounting laws require (they contain no card or bank details).
• Server logs — kept for a limited period for security and troubleshooting.

• Disconnect any account at any time from your dashboard.
• Revoke access at the source: Google third-party access or Facebook Business integrations.
• Access, correct or delete your personal data by emailing support@gridcoreinc.online — see also our Data Deletion Instructions.
• Email reports are off until you switch them on, and you can switch them off at any time from the Notifications card on your dashboard.
• Publishing is off until you press “Enable publishing” for a network. You can cancel any scheduled post, or withdraw the permission by disconnecting the account or removing Gridcore AI Social Auditor in your Google / Facebook settings (links above).
• Comment inbox, channel edits and automation rules are off until you press “Enable inbox”. Every rule is created switched off; you can switch a rule off or delete it at any time, and withdraw the permission by disconnecting the account or removing Gridcore AI Social Auditor in your Google / Facebook settings.
• Teammates, share links and assistant tokens can be removed or revoked by the account owner at any time, which takes effect immediately.
• Withdraw consent at any time; this does not affect processing already carried out.

We will respond within the time required by applicable data-protection law, including India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR. We may need to verify your identity before acting on a request.

We use only strictly necessary, first-party cookies:

• sma_client — keeps you signed in to your dashboard (up to 30 days);
• sma_payment — links a verified payment to the onboarding form (up to 2 days);
• sma_oauth — protects Google/Facebook sign-in against forgery (10 minutes);
• sma_admin — administrator sessions only.

Razorpay's checkout window may set its own cookies while you pay, governed by Razorpay's privacy policy. We do not use analytics or advertising cookies.

Gridcore AI Social Auditor is intended for businesses and creators aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

Our service providers may process data in countries other than your own (for example, AI analysis may be performed in the United States, or — for DeepSeek — in China). Where this happens we rely on the providers' contractual commitments to protect your data.

We may update this policy as the service evolves (for example if we add Telegram or WhatsApp notifications). We will change the “Last updated” date above and, for material changes, notify active clients by email or on the dashboard before the change takes effect.

Questions, requests or complaints about privacy can be sent to our grievance contact at support@gridcoreinc.online. We aim to acknowledge requests within 72 hours and resolve them within 30 days.