Privacy Policy

Last updated: October 3, 2026.

This privacy policy is shub.social’s full privacy notice under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).

1. Who we are

The owner of shub.social (“shub.social”, “we”) is the controller of the personal data of its customers and users. For any privacy matter, contact [email protected].

2. Data we process

• Account and organization: name, email, hashed password, the public key of your passkeys (if you use them), the subscription of the browsers where you turn on notifications, profile picture, company, role, language and time zone.
• Subscription and billing: plan, payment status and history. Card data is processed directly by Stripe; we never receive or store it.
• Connected social accounts: the access tokens each network grants us, encrypted, and the data described in section 4. We never see or store your social network passwords.
• Content: text, images and videos you create, upload, schedule or publish through shub.social.
• Inbox: comments, mentions and messages that other people send to your connected accounts, and your replies.
• Artificial intelligence: the prompts you write to generate text, images or video, the results, and credit usage.
• Feedback and surveys: what you write to us from the dashboard and your answers to the recommendation survey, to improve the service.
• Technical logs: IP address, browser, timestamps and actions relevant to security and auditing.
• Tracked links: when you turn on click tracking, opening a short link (shub.social/l/…) records the date, approximate country, device type and referring site. We don’t store the IP address of the person clicking.

Sensitive data: we don’t ask for sensitive personal data. If your inbox messages or content happen to include it, we process it only to show it to you and publish what you decide.

Third-party data: inbox messages and clicks on tracked links belong to people who interact with your accounts. For that data we act as a processor: we handle it on your behalf and only to provide the service; you are responsible for processing it lawfully.

3. Purposes

Necessary for the service (they stem from our relationship with you and need no additional consent):

• Creating and managing your account, organization and team, and authenticating you.
• Connecting your networks, publishing and scheduling your content, and showing your inbox and analytics.
• Generating content with artificial intelligence when you ask for it.
• Charging the subscription and packs, invoicing and handling billing questions.
• Notifying you about your account (failed posts, approvals, payments, security) and providing support.
• Protecting the platform: preventing fraud and abuse, auditing access and complying with legal obligations.

Additional (you can refuse them without affecting the service):

• Sending you the monthly results report and getting-started tips.

To refuse the additional purposes, turn them off in My profile → Preferences or write to [email protected], at any time.

4. Social network data

We only request the permissions needed for the features you use: connecting the account, publishing, the unified inbox and analytics. This is what we obtain from each network:

We do not use social network data for advertising, we do not sell it, we do not use it to train artificial intelligence models, and we do not share it except with the essential service providers in section 6. Our staff only access it with your permission (for example, to provide support), for security, or when required by law.

5. Google and YouTube

shub.social uses YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and the Google Privacy Policy also applies to that data.

shub.social’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data we store is refreshed or deleted within 30 days. You can revoke access at any time from the Google security settings page.

6. Service providers and transfers

We share only the strictly necessary data with providers that process it on our behalf (processors), under contract and only to provide their service: infrastructure and network (servers and Cloudflare), payments (Stripe), transactional email, the content management platform that powers part of the service, and AI generation (Fal.ai, which receives your prompts and returns the result). Some are outside Mexico (for example, in the United States or the European Union); we require them to protect the data at a level equivalent to this notice.

When you publish, reply or view analytics, we send each social network what that action requires, because you ask us to. Otherwise, we only transfer data to authorities when a law or an order requires it, without your consent in the cases the Law allows. We don’t sell or rent personal data.

7. Retention and deletion

• A network’s tokens, inbox messages and metrics are deleted when you disconnect the account in My networks or revoke access from the network (we receive the notice and delete them automatically).
• Daily metrics history and clicks on tracked links are kept for up to 13 months; YouTube data for 30 days.
• Read notifications are deleted after 180 days; technical and audit logs after 2 years; single-use links and expired invitations within weeks.
• Your content and account data are kept while your account is active and for the applicable legal, tax or dispute periods. When you delete your organization, it is erased after 30 days.
• Encrypted backups rotate automatically and are deleted within 90 days at most.
• Full instructions at Data deletion.

8. Security

Tokens and secrets are encrypted with AES-256-GCM; we use encrypted connections (TLS), role-based access control, mandatory two-step verification for our staff, audit logging and daily backups.

9. Your rights (ARCO), consent and complaints

You may access, correct or delete your data, object to its processing, withdraw your consent or limit the use of your data for the additional purposes.

• Self-service: in My profile you correct your data, download a copy of your data (and your organization’s, if you are an owner), choose which emails you get and schedule your organization’s deletion.
• By request: write to [email protected] from your registered email with: your name; how to reply to you; a document proving your identity (or your representative’s and their authority); a clear description of the data and the right you want to exercise; and, for corrections, the changes and a supporting document.
• Deadlines: we reply within 20 business days of receiving the complete request and, if it applies, carry it out within the following 15 business days. These periods may be extended once for an equal period when justified, and we will tell you.
• Withdrawing consent is not retroactive and, for the necessary purposes, may mean we can no longer provide the service.
• If you believe your right to data protection was violated, you may contact the competent personal data protection authority.

10. Cookies and similar technologies

We only use the cookies needed for the service to work; we don’t use advertising or third-party tracking cookies.

• Session (shub_social_session): keeping you signed in (up to 7 days).
• Two-step verification: a 5-minute challenge when signing in.
• Language (shub_locale): remembering the language you chose (1 year).
• Theme: your light or dark mode preference is stored only in your browser.
• Network security: Cloudflare may set its own cookies to protect the site against automated attacks.

You can delete or block them in your browser; without the session cookie you can’t sign in.

11. Children

shub.social is a service for businesses and professionals and is not directed at anyone under 18.

12. Changes to this notice

We will post any change on this page with its update date and email you about material changes before they apply.