Privacy Policy
Last updated: August 2026 · Contact: [email protected]
- 1. Who we are
- 2. What we collect
- 3. Why we use it and our legal bases
- 4. Who processes it for us
- 5. AI-generated content and your likeness
- 6. Social platforms
- 7. How long we keep it
- 8. Your rights
- 9. Cookies
- 10. International transfers
- 11. Age
- 12. Security
- 13. Changes
1. Who we are and how to contact us
Dr.Social is operated by ABFS Inc. ("Dr.Social", "we", "us"). We are the controller of the personal data described in this policy: we decide why and how it is processed. Dr.Social runs at dr-social.app and lets a person (a "talent") or an agency acting for its talents train a personal AI likeness, connect social accounts, and generate, review and publish social-media content on autopilot.
Questions, requests and complaints: [email protected]. Please write from the email address on your account so we can verify it is you.
2. What we collect
Account data
Your email address, password (stored only as a hash by our authentication provider — we never see it in clear text), display name, Dr.Social handle, and the agency workspace you belong to. For agencies: the workspace name, its plan, and the email addresses and roles of the operators and talents you invite, together with invitation records (when an invite was sent, claimed or revoked).
Likeness data — face photos and voice samples
To build your AI likeness you upload reference photos of your face and, optionally, a short voice sample. We also store quality scores computed on those photos and the identifiers of the trained likeness at our generation provider. Because face images and voice recordings can identify a person, some laws treat them as biometric or sensitive data. We collect them only with your explicit consent, given when you upload them; we use them only to generate content that depicts you for your own account; we never use them to identify you elsewhere, to build a face- or voice-recognition index, or to train models for other customers. You can withdraw consent at any time by deleting the photos and samples in your portal or by deleting your account (section 8).
Connected social accounts
When you connect Instagram, LinkedIn, Facebook, TikTok, X, YouTube or Reddit, you sign in on that platform's own official OAuth page. We never see or store your platform password. The OAuth tokens the platform issues are held by our connection provider, Composio; Dr.Social stores a reference to that connection, your handle and account id, and the profile and performance metrics the platform shares (followers, reach, views, engagement, and similar). If you turn on the inbox or engagement features we also receive the comments and direct messages sent to your account, so we can draft replies for you.
Content you create or approve
Your profile and preferences (bio, content pillars, writing style, do-not-say list, research directive, cadence and goals), every draft the service creates (captions, hashtags, images, carousels, reels, replies) with the prompts behind it, your approvals, rejections and rejection reasons, your chat with the assistant, and publish results.
Usage and technical logs
IP address (used for abuse prevention and rate limiting on sign-up and sign-in forms), browser type, request logs, workbench traces that record how a draft was produced, and error reports.
Billing data
Your plan, subscription status, trial dates, seat and reel-pack purchases, and invoices. Card details are entered on and stored by Stripe. We never hold your card number.
3. Why we use it and our legal bases
- To provide the service (contract). Creating and securing your account, training your likeness, drafting and rendering content, holding it for your approval, publishing to the accounts you connected, drafting replies, showing your growth, running your workspace, and billing.
- Likeness training (consent). Processing your face photos and voice samples to train and use your personal AI likeness relies on your explicit consent, which you can withdraw at any time.
- Keeping the service safe and improving it (legitimate interests). Rate limiting, abuse and fraud prevention, debugging, error monitoring, moderation of generated content, and understanding how features are used. We balance these interests against your rights and do not use your likeness data for them.
- Legal obligation. Keeping tax and accounting records, responding to lawful requests, and meeting our duties under data-protection and platform-transparency law.
We also email you about your account: set-up links, drafts waiting for approval, billing, security notices. We do not send marketing email without a separate opt-in. We do not sell personal data.
4. Who processes it for us
We use a small number of service providers ("processors") that handle data only on our instructions, under contracts that require confidentiality and security:
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | All account, profile, content and connection data; uploaded photos and voice samples | United States |
| Railway | Application hosting | All data passing through the application; request logs | United States |
| Stripe | Subscriptions, trials and payments | Email, workspace name, plan, payment details (held by Stripe) | United States, with global operations |
| Higgsfield | AI image, video and voice generation; likeness training | Face photos, voice samples, reference images, prompts, generated media | United States (provider's infrastructure may be global) |
| Composio | Official OAuth connections to social platforms | Platform OAuth tokens, handles, posts, comments and messages in transit | United States (provider's infrastructure may be global) |
| abfs.tech (LLM router) | Text generation with Claude models: captions, replies, research, moderation | Profile and style, drafts, comments and messages being replied to, post requests | United States (provider's infrastructure may be global) |
| GitHub | Automatically filed error reports for our engineers | Technical diagnostics only; emails, tokens and other identifiers are scrubbed before filing | United States |
Locations are each provider's primary region as we understand it; we update this table if a provider changes region.
We may also disclose data where the law requires it, to protect the rights and safety of our users, or to a successor if our business is transferred (we would notify you).
5. AI-generated content and your likeness
Dr.Social generates photos, reels, carousels, captions, hashtags and reply drafts that depict you or speak in your voice. Generation runs on Higgsfield (images, video, voice) and on Claude models through the abfs.tech router (text). Your likeness data and outputs are used only for your account.
You control publishing. Every draft waits in your portal for approval unless you switch on auto-approve for scheduled drafts, which you can switch off at any time. AI output can be wrong, so review what is published under your name.
Provenance metadata. Generated images may carry embedded AI-provenance metadata (for example C2PA or IPTC fields) added by the generation model. Each workspace has a setting that controls whether we keep that metadata or export images with conventional photo metadata instead; workspaces created before August 2026 default to the latter, and an operator can change it at any time. This setting does not change your obligation to label AI-generated content where a platform or law requires it (see the Terms), and we do not apply platform labels on your behalf.
6. Social platforms
The platforms you connect (Meta for Instagram and Facebook, LinkedIn, TikTok, X, Google for YouTube, Reddit) receive the content we publish for you and return metrics, comments and messages under their own privacy policies and terms. We are not responsible for how a platform uses your data. Disconnecting an account in your portal ends our access to it.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | While your account exists; deleted when you delete the account |
| Face photos, voice samples, trained likeness | Until you delete them or your account, whichever comes first; deletion is passed to Higgsfield |
| Generated content, approvals, chat history | While your account exists; individual items can be deleted at any time |
| Social-account connections and tokens | Removed when you disconnect the account or delete your account |
| Comments and direct messages we fetched for you | While your account exists; removed with the account |
| Workbench traces | Pruned after 30 days |
| Technical logs (IP address, request metadata) | No longer than 90 days |
| Error reports | Kept as engineering records, scrubbed of emails and tokens before filing |
| Billing records | As long as tax and accounting law requires |
| Sign-in cookies | Up to 30 days, or until you sign out |
| Nightly database backups | Kept for 30 days, then deleted |
Deleting your account removes your content, your uploaded files in storage and your login in one operation. Content already published on a platform stays there under your platform account.
8. Your rights and how to exercise them
Depending on where you live, you have the right to access your data, receive an export of it, have it corrected, have it deleted, withdraw consent (for your likeness data at any time, without affecting earlier processing), object to or restrict processing based on legitimate interests, receive your data in a portable format, and complain to a supervisory authority in your country. We do not discriminate against you for exercising them.
- In the app: disconnect any social account, delete photos, voice samples and generated content, and delete your account from your portal.
- By email: send access, export, correction or deletion requests to [email protected] from the address on your account. We respond within 30 days and confirm deletions by email.
If an agency invited you, its operators can see and act on the drafts, messages and metrics in that workspace and can delete your account. You can also contact us directly to have your data removed from an agency workspace.
9. Cookies
Dr.Social sets two sign-in cookies (an access token and a refresh token) to keep you signed in. They are strictly necessary, HTTP-only, hold no tracking identifier, and last up to 30 days or until you sign out. We set no advertising, analytics or third-party tracking cookies. Your browser's local storage may hold small interface preferences, such as the tab you last opened; nothing in it leaves your device.
10. International transfers
Dr.Social is hosted in the United States, and our processors operate mainly there. If you use the service from the EEA, the United Kingdom or Switzerland, your data is transferred to the United States. Where the law requires it, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with our processors, or on a provider's certification under a recognised adequacy framework. You can ask us for details of the safeguards in place.
11. Age
Dr.Social is for adults only. You must be at least 18 years old to create an account or to have your likeness processed by the service. We do not knowingly collect data from minors and delete any account we learn belongs to one.
12. Security
Data is encrypted in transit and at rest by our providers. Passwords are hashed, platform tokens never reach the browser, and sign-in and sign-up endpoints are rate limited. Each workspace's data is isolated in the application, and every publish requires an approval unless the talent has enabled auto-approve. Error reports are scrubbed of emails and tokens before they leave our systems. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any relevant authority as the law requires.
13. Changes to this policy
We post updates on this page and change the "last updated" date above. If a change materially reduces your rights or expands how we use your likeness data, we will email account holders before it takes effect and, where consent is required, ask for it again.