SocialSway Privacy Policy

Operator: REI Boss, LLC d/b/a Envesto. Effective date: October 16, 2026.

This policy explains how we handle information when you use SocialSway, a workspace for managing brands, social accounts, media, publishing, reminders, analytics, and optional creative integrations.

Information we handle

We handle account details such as your name, email address, role and sign-in identifiers; brands and connected social-account identifiers; uploaded images and videos; post drafts, captions, schedules and publishing results; analytics returned by connected services; reminder preferences and posting activity; and billing or usage records used by the Spending page. Depending on enabled connections, billing records may include provider invoices, payment status and refunds. We also process operational information needed to authenticate requests, investigate failures and prevent misuse.

When you connect a third-party account, we receive the identifiers, permissions and authorization tokens needed for that connection. We do not ask you to give us your Canva password. Canva authorization happens on Canva's own site. SocialSway does not receive your entire Canva library simply because you connect: the current editing feature operates on the assets and designs involved in your editing sessions.

Why we use information

We use information to provide the features you request, enforce access to the correct brands, store and retrieve media, publish content you authorize, show available analytics and costs, send configured reminders and service notices, support you, and maintain the service. Posting reminders use your selected settings and brand-specific activity. Connecting Canva or importing an edited image does not itself publish a social post.

Services involved

SocialSway uses Vercel for application hosting and media storage, Supabase for authentication and application records, and Zernio for connected social-account functions. When you choose an AI creative feature, the relevant input media and instructions are sent to the configured AI provider; the provider and processing depend on the selected feature and configuration. Connected social networks, Canva and AI providers process information under their own terms and privacy policies. Email and optional billing connections process the information needed for the enabled feature. We share information with these providers to perform requested functions, with people you authorize to access a brand, or where required by applicable law.

Edit in Canva

When you choose to send an image to Canva, SocialSway uploads that image and creates a design at the source dimensions in your connected Canva account. When you explicitly import the edited design, SocialSway exports a single-page PNG, checks its actual dimensions and saves a new copy to the original brand. The original stays unchanged. We store the Canva user/team identifiers, encrypted authorization credentials, editing-session identifiers, source references, dimensions and import status needed to operate and resume this workflow. Canva's bundled asset-write permission includes asset modification and deletion, but the current SocialSway implementation uses it only to upload assets.

Disconnect Canva from SocialSway to revoke that connection and remove its stored credentials. Disconnecting does not delete designs already created in Canva, imported media in SocialSway, or editing history. Manage Canva designs within Canva; contact us for a SocialSway data-deletion request.

Storage, access and security

Authorization credentials for the Canva connection are encrypted on the server. Access to application records is subject to sign-in and brand permissions. Public media delivery links are used for publishing and integration workflows: anyone who obtains such a link may be able to retrieve that file. Do not upload confidential or regulated information that should never be accessible through a shareable media URL. No online service can guarantee absolute security.

Retention and removal

We retain account and workspace information while needed to provide the service, maintain editing history, address support requests, meet legal obligations and resolve disputes. The current Media Library's archive and soft-delete controls change availability within the application; they are not a promise of immediate removal of underlying storage or provider copies. Request permanent removal or account closure using the contact above. We verify authority, identify affected records and provider copies, and explain applicable retention exceptions or limitations. Backup and legally required records may be retained separately. We do not promise an automatic deletion schedule that the service does not implement.

Your choices and requests

You can manage connected accounts and reminder settings using available controls. Contact us to request access, correction, export, deletion, or information about how your personal information is handled. Applicable privacy rights vary by location; we will respond as required by applicable law. You may also have the right to contact a privacy regulator. Brand administrators may control workspace access and shared content.

International processing and children

Service providers may process information in countries different from your own. This service is intended for adults managing business or organizational social media; it is not intended for children under 18.

Changes

We will publish updates with an effective date and provide additional notice when required. Contact us with questions using the contact above.