Data Transparency Summary
The table below provides a complete, auditable summary of every data point soshlpylt accesses, the source API, its intended purpose, and how long it is retained. No data is collected beyond what is listed here.
| Data Source | Data Points Accessed | Retention Period | Purpose | Shared? |
|---|---|---|---|---|
YouTube Data API v3 | Channel subscriber count, total views, video count, per-video metrics (views, likes, comments), comment thread text, video metadata | Cached ≤ 48 hours; tokens held while account is connected | AI-Generated Performance Audits; Community Management; Content Publishing | Never |
LinkedIn Community API | Post content, engagement metrics (reactions, comments, shares), organization page data, comment thread text | Cached ≤ 48 hours; tokens held while account is connected | AI-Generated Performance Audits; Community Management; Content Publishing | Never |
OAuth Access Tokens | Encrypted access token + refresh token (Google & LinkedIn) | Until account is disconnected or user deletes data | Secure API authentication on behalf of the authenticated user | Never (AES-256 encrypted at rest) |
Identity (Clerk) | Email address, display name, profile picture, platform account ID | Duration of account; deleted on account deletion | User identity verification and account association | Clerk (identity provider only) |
WhatsApp (Twilio) | Inbound message text, phone number, session state | Active session only; draft buffers cleared after publish or discard | Command routing and AI-assisted content drafting via WhatsApp interface | Twilio (message delivery only) |
Google API Services - Limited Use Disclosure
soshlpylt's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In compliance with the Limited Use requirements, soshlpylt affirms the following with respect to all data obtained through Google APIs:
YouTube API Scope Justification
youtube.readonlyRead channel statistics, subscriber count, video performance metrics, and video metadata for the analytics dashboard.
youtube.uploadPublish video content to the authenticated channel owner's YouTube account when the user explicitly initiates a post.
youtube.force-sslRead comment threads on the user's videos and post replies on the authenticated channel owner's behalf - the core community management capability.
openid profile emailVerify user identity and associate the YouTube account with the soshlpylt workspace.
No Secondary Use
Google API data is used solely to deliver the features you explicitly request. It is never used for profiling, advertising, or secondary commercial purposes.
No Transfer to Data Brokers
We never sell, lease, or transfer Google API data to third-party data brokers, advertising networks, or any party whose business involves data aggregation.
Restricted Human Access
Employee access to your Google API data is limited to security incident investigation, conducted with your informed consent or as required by law.
No Advertising Use
Google API data is never used to serve targeted advertisements and is never shared with advertising or marketing technology platforms.
Data Collection
soshlpylt collects the following categories of data, exclusively through your explicit authorization via industry-standard OAuth 2.0 flows. No data collection occurs without prior authenticated consent.
Account and Identity Data
Email address, display name, profile picture, and workspace configuration settings collected through Clerk authentication at account registration.
Social Platform Credentials
OAuth access tokens and refresh tokens obtained during platform connection. All tokens are AES-256 encrypted immediately upon receipt in the authorization callback handler and before database write.
Analytics and Engagement Data
Channel and post performance metrics (views, impressions, subscriber counts, engagement rates), comment thread text, and video metadata - fetched transiently on your behalf after your explicit authorization.
WhatsApp Interface Data
Inbound message text from your registered WhatsApp number, used solely to route commands within the Platform. Not retained beyond the active session unless you explicitly instruct a preference to be persisted.
Usage and Audit Logs
Standard server-side logs (IP addresses, request timestamps, API response codes) retained for a maximum of 30 days for security and service reliability purposes.
Data Usage
soshlpylt uses collected data solely for the following enumerated purposes. We do not engage in secondary use, data monetization, profiling for advertising, or any use not explicitly described below.
Service Delivery
Reading analytics, rendering the dashboard, and executing publishing or comment-reply actions you explicitly initiate.
Session Continuity
Storing draft buffers, selected post configurations, and connected account workspace state within your active session.
Reliability Optimization
Caching analytics metrics locally for up to 48 hours to reduce redundant API calls and improve response latency.
AI-Assisted Drafting
Passing your content topic, niche, and style preferences to our AI drafting layer. API data is never used as training input (see AI Training Policy section).
Transactional Communications
Sending account activity notifications and connection status updates to your registered email address.
Security and Integrity
Detecting and preventing unauthorized access, token misuse, and abuse of connected social platform accounts.
AI Model Training Policy
User data retrieved through authorized platform APIs - including all data obtained from the YouTube Data API v3 and the LinkedIn Community Management API - is strictly confidential and is NEVER used to train, fine-tune, benchmark, or otherwise iterate upon any generalized Large Language Model (LLM), foundation model, or machine learning model, whether operated by soshlpylt, our AI infrastructure providers, or any third party.
Our AI-assisted drafting feature generates post suggestions using only:
The content topic or idea you provide within the current active session
Your niche, tone, and style preferences you have explicitly instructed the Platform to persist (MEMORIZE actions)
Anonymized, non-API-derived contextual signals such as content category
Your social account data - comment content, post performance metrics, channel analytics - is presented exclusively in your authenticated dashboard for your own insight. It is never extracted, aggregated, or used as input to any AI training pipeline, model fine-tuning process, or dataset compilation effort. This prohibition applies permanently and without exception.
Retention & Storage
soshlpylt applies a strict data minimization policy. We store only what is necessary to deliver the service and purge data on the schedules below.
Analytics & Metrics Cache
≤ 48 hoursAnalytics data fetched from YouTube Data API v3 and LinkedIn APIs is cached in your connected account record for a maximum of 48 hours before being invalidated. This applies to subscriber counts, video performance metrics, post engagement data, and any other analytics-class data. This limit satisfies LinkedIn's data residency requirements.
OAuth Access & Refresh Tokens
Until disconnectionEncrypted access tokens and refresh tokens are retained for as long as your platform connection remains active. Tokens are revoked and deleted within 24 hours of account disconnection or user-initiated data deletion.
Post History
90 daysPublished post records (content, platform, timestamp) are retained in your workspace audit log for up to 90 days and can be deleted upon request at any time.
WhatsApp Session State
Active session onlyDraft buffers, selected platform targets, and pending approvals are retained only for the duration of your active session. Sessions reset upon explicit instruction or after a period of inactivity.
Server Audit Logs
30 daysStandard server logs (IP addresses, request timestamps, API response codes) used for security and debugging are retained for a maximum of 30 days.
LinkedIn API Data Handling
soshlpylt integrates with the LinkedIn Marketing Developer Platform via the Community Management API and UGC Posts API. The following scopes are requested and their use is strictly limited to the purposes described.
LinkedIn OAuth Scope Justification
openid profile emailIdentity verification and workspace association.
w_member_socialPublish posts to your personal LinkedIn profile at your explicit direction.
w_organization_socialPublish posts to LinkedIn Company Pages you administer and manage community engagement on organization posts.
LinkedIn Data Handling Commitments
LinkedIn data is used exclusively to deliver community management features you initiate. Analytics data is retained for a maximum of 48 hours in compliance with LinkedIn data residency requirements. LinkedIn API data is never shared with third-party data brokers or advertising networks, and is never used to train AI or machine learning models.
Security Measures
soshlpylt implements enterprise-grade technical and organizational security controls to protect your data and access credentials at every layer.
AES-256 Encryption at Rest
All OAuth access tokens and refresh tokens are AES-256 encrypted immediately upon receipt in the authorization callback - before any database write operation.
TLS 1.2+ in Transit
All data transmitted between your browser, our servers, and third-party APIs travels exclusively over TLS 1.2 or higher.
Proactive Token Rotation
YouTube access tokens are refreshed proactively when they are older than 50 minutes, ahead of the 60-minute expiry window, minimizing credential exposure.
Principle of Least Privilege
Only the OAuth scopes minimally necessary to deliver each specific feature are requested. No over-provisioned permissions are accepted.
Refresh Token Preservation
Our authorization callback uses an explicit upsert pattern to preserve existing refresh tokens when Google omits them on re-authorization, preventing credential rotation failures.
Restricted Database Access
Database access is restricted to authenticated application services. No employee has unrestricted access to decrypted tokens or raw API data.
No Third-Party Sharing
Absolute Prohibition on Data Sale and Sharing
soshlpylt does not sell, lease, rent, or otherwise share user data - including data obtained via Google APIs or LinkedIn APIs - with third-party data brokers, advertising networks, marketing analytics platforms, or any party whose primary purpose is the collection, aggregation, or resale of user data. This prohibition is unconditional and permanent.
The only third-party services that receive any portion of your data are our infrastructure subprocessors, and only to the extent strictly necessary to operate the Platform:
| Subprocessor | Role | Data Scope |
|---|---|---|
| Neon (PostgreSQL) | Encrypted token & user record storage | Encrypted tokens, user IDs, workspace config |
| Redis / Upstash | Session state & job queue management | Session state, draft buffers, job payloads |
| Twilio | WhatsApp message delivery | Your WhatsApp number, outbound message text |
| Clerk | Identity and authentication | Email, display name, session tokens |
| Google (YouTube API) | API provider | OAuth tokens (used for API calls on your behalf only) |
| LinkedIn (Community API) | API provider | OAuth tokens (used for API calls on your behalf only) |
User Rights
soshlpylt provides the following rights to all users, regardless of jurisdiction, as a baseline commitment to data transparency and control.
Right of Access
Request a complete copy of all personal data we hold about you at any time by contacting hello@soshlpylt.com.
Right to Rectification
Correct inaccurate personal data by updating your workspace configuration or by contacting us directly.
Right to Erasure
Request total, permanent deletion of your data at any time. See the Data Deletion section below for the exact procedure.
Right to Portability
Request an export of your personal data in a machine-readable JSON format within 7 business days.
Right to Withdraw Consent
Revoke soshlpylt's access to your YouTube or LinkedIn account at any time through your Account Settings, or directly in your Google or LinkedIn account security settings.
Data Deletion Procedures
You have the absolute right to permanently purge all your data from soshlpylt's infrastructure at any time. Choose any of the following methods:
Via Your Dashboard
RecommendedSign in to your soshlpylt workspace at soshlpylt.com
Navigate to Account Settings → Privacy & Data
Select "Disconnect Account" for each connected platform (YouTube / LinkedIn) to immediately revoke and delete OAuth tokens
Select "Delete My Account" to permanently purge all workspace data, post history, session state, and your user record
Confirm deletion via the verification email sent to your registered address
You will receive a deletion confirmation email within 7 business days
Via WhatsApp Command
If you have the WhatsApp interface enabled, you can initiate data revocation directly from your registered WhatsApp number:
REVOKESend the word REVOKE to our WhatsApp endpoint from your registered number. This immediately invalidates your session and initiates the full data deletion workflow. You will receive a confirmation reply with a deletion reference number.
Via Email Request
Email hello@soshlpylt.com with the subject line DATA DELETION REQUEST from your registered account email. All personal data will be permanently purged within 7 business days of a verified request.
Contact & Data Protection
For all privacy inquiries, data subject access requests, deletion requests, or to exercise any right described in this Policy, contact us at:
Privacy Contact
hello@soshlpylt.comLegal Contact
hello@soshlpylt.comsoshlpylt is operated by SoshlPylt Ltd., registered at 83 Burnvale, Livingston, Scotland, EH54 6DH, United Kingdom. This Privacy Policy is governed by the laws of Scotland.