Privacy Policy
Last updated: 11 October 2026
1. Who we are and what this policy covers
This policy explains how QuidRobo Ltd collects, uses, stores, shares and deletes personal data, including data we receive from Google when you connect a Google account. We are the developer and operator of the following products and websites, and this policy applies to all of them (together, "the Services"):
| Product | Who it is for | Web addresses |
|---|---|---|
| Sleek Social | Small businesses and small teams | sleeksocial.ai and its subdomains |
| The Social OS | Marketing agencies and their clients | thesocialos.com and its subdomains |
| QuidRobo | Our own agency service and website | quidrobo.com and its subdomains |
Sleek Social and The Social OS are social media content planning, creation, approval, scheduling, publishing and reporting platforms. They help you research ideas, create posts and carousels (with AI assistance or with your own designers), get them approved, publish them to the social and business accounts you connect, and see how they perform.
Data controller. QuidRobo Ltd, a company registered in England and Wales under company number 15341119, is the controller of the personal data described in this policy.
- Registered address: 3 Millway, Reigate, Surrey, RH2 0RH, United Kingdom
- Email: info@quidrobo.com
- Telephone: +44 (0) 794 084 5485
Agencies and their clients. When an agency uses The Social OS to manage a client's workspace, the agency decides what client content and accounts are added. For that client content, the agency acts as controller and we act as its processor under our terms with the agency. Questions about how an agency handles your data should go to that agency first; we will help them answer.
What this policy does not cover. Third-party websites and platforms we link to or publish to (such as Facebook, Instagram, LinkedIn, TikTok, Pinterest, X and Google) have their own privacy policies, which govern how they handle your data.
2. The data we collect
We collect only the data we need to run the Services. You can browse our marketing websites without giving us any personal data.
2.1 Data you give us
| Category | Examples | When we collect it |
|---|---|---|
| Account data | Name, email address, password (stored securely), language preference, role in a workspace | When you sign up, are invited or edit your profile |
| Business and brand data | Business name, business profile, website address, logo, brand colours and fonts, business phone, email and address, brand voice, content pillars, competitor names | During setup, in the Brand Kit, or when you ask us to read your website |
| Content | Post ideas, captions, images, videos, sounds, carousels, comments, approval decisions and feedback | When you or your team create, upload or review content |
| Billing data | Billing contact, billing address, VAT number, plan and subscription history, invoices | When you subscribe or update billing details |
| Communications | Messages to our support team, report recipients you choose, feedback | When you contact us or configure emails and reports |
Card details are entered directly with our payment processor. We do not see or store full card numbers.
2.2 Data from Google
You can choose to connect a Google account. We request only the permissions (scopes) needed for the feature you turn on, and Google shows you exactly what we are asking for before you agree.
| Google service | Google user data we access | Why we access it |
|---|---|---|
| Sign in with Google | Your name, email address and profile picture (scopes: openid, email, profile) | To create your account and let you sign in without a separate password |
| Google Business Profile | The business locations you manage, location details (name, address, opening hours, categories), posts, photos, reviews and replies, and performance insights for those locations | To let you create, schedule and publish Business Profile posts, reply to reviews, keep location details up to date, and report on performance inside the Services |
| Google OAuth tokens | Access and refresh tokens issued by Google | To keep your connection working until you disconnect it |
We do not access your Gmail, Google Drive, Google Calendar, Google Contacts or any other Google data that is not listed above.
2.3 Data from other platforms you connect
When you connect Facebook, Instagram, LinkedIn, TikTok, Pinterest, X or another supported platform, we receive what that platform makes available for the permissions you grant. This typically includes your account or page name and identifier, profile picture, pages, boards or channels you manage, the posts we publish for you, and engagement and performance statistics for those posts. We also store the access tokens needed to publish on your behalf.
2.4 Data we collect automatically
- Usage and device data: IP address, browser type, device type, pages and features used, and timestamps, used to run, secure and fix the Services.
- Logs and diagnostics: error reports and service performance data.
- Cookies: see section 10.
2.5 Publicly available data
To produce research and post ideas, the Services read publicly available information you point us to, such as your own website, competitor websites, public social profiles and other public sources. We use this to generate insights for your workspace.
3. How we use your data
We use personal data only for the purposes below. UK data protection law requires a lawful basis for each.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and run your account and workspaces | Account data, Google sign-in data | Performance of our contract with you |
| Research, idea generation, content and design creation | Business and brand data, content, public data | Performance of our contract |
| Approval workflows, scheduling and publishing to your connected accounts | Content, connected platform and Google data, tokens | Performance of our contract |
| Performance dashboards, reports and report emails you set up | Connected platform and Google insights, content | Performance of our contract |
| Billing, invoicing and VAT | Billing data | Contract and legal obligation |
| Security, fraud prevention, troubleshooting and service reliability | Usage, device and log data | Legitimate interests in keeping the Services safe and working |
| Service updates and support | Account data, communications | Contract and legitimate interests |
| Marketing emails about our products | Name and email | Consent, which you can withdraw at any time |
3.1 How we use Google user data
We use Google user data only to provide and improve the user-facing features you have chosen to use in the Services, as described in section 2.2. Specifically:
- Sign-in data is used to create your account, identify you and let you sign in.
- Google Business Profile data is used to show your locations, posts, reviews and insights inside the Services, to publish posts and review replies that you or your approved team members create or approve, to update location details you edit, and to include Business Profile performance in your dashboards and reports.
Limited Use disclosure. QuidRobo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In line with those requirements, we do not:
- sell Google user data, or transfer it to data brokers or information resellers;
- use or transfer Google user data for advertising, including targeted, personalised, retargeted or interest-based advertising;
- use Google user data to determine credit-worthiness or for lending purposes;
- use Google user data to build databases or data products, including our aggregated industry insights described in section 3.3;
- use Google user data, or transfer it to others, to develop, improve or train generalised or non-personalised AI or machine learning models;
- allow any person to read Google user data, unless you have given us permission for specific content (for example, to help with a support request), it is needed for security purposes such as investigating abuse, it is needed to comply with the law, or the data has been aggregated and anonymised and is used for internal operations in line with the law.
3.2 AI features
The Services use AI models to generate post ideas, captions, images, designs, report summaries and review reply suggestions. To do this, we send the relevant content and brand data to AI service providers (see section 4) at the moment you or your workspace request the output. Our agreements with these providers do not allow them to use the data we send to train their models. When a feature uses Google user data, such as suggesting a reply to a Google review, that data is sent only to produce the output you asked for and is never used to train any AI model.
3.3 Aggregated and anonymised insights
We may combine data from across the Services into aggregated statistics that cannot identify you, your business or any individual, for example which content formats perform well in an industry. We use these to improve the Services and may offer them as insights to customers. Google user data is never included in these statistics.
3.4 Automated decision-making
AI features suggest content for you to review. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
4. Who we share data with
We do not sell your personal data, and we do not share it for advertising. We share data only in the cases below, and only as much as each case needs.
4.1 Service providers that process data for us
These providers act on our instructions under written contracts that require them to keep data confidential and secure, and not to use it for their own purposes.
| Provider type | Purpose | Data involved |
|---|---|---|
| Hosting and infrastructure providers | Running and storing the Services | Data held in the Services |
| AI service providers | Generating the AI outputs you request | The content and brand data needed for each request |
| Monitoring and security providers | Keeping the Services reliable and secure | Logs and diagnostic data |
| Payment and tax service providers | Taking payments and calculating tax | Billing details and transaction information |
| Communication providers | Sending emails and notifications | Name, email address and message content |
Google user data is shared with a service provider only when it is needed to deliver the feature you are using (for example, generating a review reply you asked for), and always under the restrictions in section 3.1.
4.2 The platforms you publish to
When you publish or schedule content, we send that content to the platform you selected (for example Google Business Profile, Facebook, Instagram, LinkedIn, TikTok, Pinterest or X). Once published, the platform's own privacy policy applies to it.
4.3 People in your workspace
Content, approvals, reports and connected account data in a workspace are visible to the members of that workspace, according to their role. For The Social OS, staff of the agency managing your workspace can see it. Reports are emailed only to the recipients you or your workspace administrator choose.
4.4 Legal reasons and business changes
We may disclose data if the law, a court order or a regulator requires it, or to protect the rights, safety or property of our users, the public or QuidRobo. If we sell, merge or transfer all or part of our business, data may transfer to the new owner, who must continue to protect it in line with this policy, including the Google API Services User Data Policy.
4.5 International transfers
Some of our service providers may process data outside the UK. When data leaves the UK, we make sure it is protected by an adequacy decision or by appropriate safeguards approved under UK law, such as standard contractual clauses. Contact us for details of the safeguards for a particular transfer.
5. How we protect your data
We use technical and organisational measures designed to protect personal data, including Google user data, against loss, misuse and unauthorised access:
- Encryption: data is encrypted in transit and at rest. Access tokens for your connected accounts, including Google, are encrypted before they are stored.
- Access control: access to personal data is restricted by role, both inside your workspace and within QuidRobo, and limited to people who need it.
- Least privilege with Google: we request only the Google permissions each feature needs.
- Monitoring and incident response: we monitor the Services for security threats, and we will notify you and the Information Commissioner's Office of a personal data breach where the law requires it.
No system is completely secure, but we work to keep your data safe and review these measures as the Services grow.
6. How long we keep data and how to delete it
We keep personal data only as long as we need it for the purposes in this policy, then delete or anonymise it.
| Data | How long we keep it |
|---|---|
| Account, brand and content data | While your account or workspace is active. Deleted within 30 days of you deleting the workspace or account |
| Agency client workspaces removed by an agency | Deleted after a short grace period set out in the agency's terms |
| Google user data and Google tokens | Until you disconnect Google or delete your account. Tokens are revoked and deleted immediately on disconnection; other Google data is deleted within 30 days |
| Other connected platform data and tokens | Until you disconnect the account or delete the workspace; then deleted within 30 days |
| Invoices and tax records | 6 years after the end of the financial year they relate to, as required by UK tax law |
| Logs and diagnostics | Up to 90 days |
| Backups | Overwritten on a rolling cycle of up to 30 days after deletion from live systems |
| Marketing preferences | Until you unsubscribe, after which we keep only a suppression record so we do not email you again |
6.1 Disconnecting Google and deleting your data
You can stop our access to Google user data at any time by:
- disconnecting Google Business Profile in your workspace's connected accounts settings; or
- removing QuidRobo's access from your Google Account at myaccount.google.com/permissions.
To delete your account, a workspace or all your data, use the delete option in your settings or email info@quidrobo.com from the address on your account. We will confirm the deletion within one month.
7. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you and get a copy (a subject access request);
- have inaccurate or incomplete data corrected;
- have your data deleted;
- restrict or object to how we use your data, including for direct marketing;
- receive data you gave us in a portable, machine-readable format;
- withdraw consent at any time where we rely on consent, without affecting earlier processing;
- not be subject to decisions based solely on automated processing that significantly affect you.
To use any of these rights, email info@quidrobo.com or write to us at the address in section 1. We do not normally charge a fee, and we reply within one month. Complex requests may take up to two further months, and we will tell you if so. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Marketing
We send marketing emails only where you have agreed or where the law allows us to contact existing customers about similar services. Every marketing email has an unsubscribe link. Service emails, such as security alerts, approval requests and billing notices, are part of the Services and are not marketing.
9. Children
The Services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
10. Cookies and similar technologies
Our websites and apps use first-party cookies and local storage that are strictly necessary to sign you in, keep your session secure, remember your language and display settings, and protect against fraud. These do not need consent. If we use analytics or other non-essential cookies, we will ask for your consent first and you can change your choice at any time. We do not use advertising cookies.
11. Changes to this policy
We will update this policy when the law or our Services change. The "Last updated" date at the top shows when it last changed. If we make a material change, especially to how we use Google user data, we will tell you by email or in the app before the change takes effect, and ask for your consent where the law requires it.
12. Contact us
For any question about this policy or your personal data:
- Email: info@quidrobo.com
- Telephone: +44 (0) 794 084 5485
- Post: QuidRobo Ltd, 3 Millway, Reigate, Surrey, RH2 0RH, United Kingdom