Privacy Policy

This policy covers the Orange Grove Social client portal at app.orangegrovesocial.com (the “Portal”), operated by Orange Grove Social LLC, St. Petersburg, Florida (“Orange Grove,” “we,” “us”). It explains what information the Portal collects, why, who we share it with, and the choices you have. Our marketing website has its own privacy policy.

The Portal is a private, invite-only workspace where our clients review and approve social media content, see the performance of work we do for them, communicate with our team, and manage their account. It is used by our clients and their staff, and by Orange Grove's own team.

Information we collect

Account information

• Identity and contact details: your name, email address, phone number (optional), profile photo (optional), your role, and the client business you belong to. We create your account when your business becomes a client; you can't sign up on your own.
• Sign-in data: if you sign in with Google, we receive your Google account's email address, name, and profile picture. We use these only to identify you and match you to the account we already created for you. If you set a password, it is stored hashed by our authentication provider; we never see it. Email sign-in codes are single-use and expire.
• Notification preferences: whether you've turned on push notifications, and the device subscription needed to deliver them.

Content and activity in the Portal

• Content we prepare for you (captions, videos, images), your approvals and rejections, your comments, requests, ideas, files you upload, and survey responses (for example, a satisfaction score).
• Usage records such as when you signed in, what you approved, and technical logs (IP address, browser type, timestamps) kept for security and troubleshooting.

Business and billing information

• Your business's brand assets, brand guidelines, social media handles, and the integrations you connect (for example, a Slack channel).
• Invoices and payment status. We do not store card numbers. Payments are processed by Stripe, whose privacy policy governs the card data you provide to them.

Advertising and social media data (from Meta)

When we run paid advertising for you, and with the access you grant us as a Meta Business partner, the Portal reads data from Meta's Marketing API about your business's ad accounts, Pages, and Instagram accounts: campaign structure, spend, impressions, clicks, reach, results (such as leads or conversations), creative previews, and account settings. Our team may also create, pause, resume, and adjust campaigns through the Portal. We use this data to run and report on your advertising and for nothing else. We do not collect personal information about the individuals who see or click your ads; Meta provides aggregate figures only.

Information we do not collect

We do not use advertising trackers, analytics pixels, or third-party cookies on the Portal. The only cookies we set are the ones required to keep you signed in and to remember basic preferences.

How we use information

• To provide the Portal: show you your content calendar, collect approvals, deliver notifications, and keep the account working.
• To do the work you hired us for: prepare content, run and report on advertising, and communicate with you.
• To send service notifications you've chosen (in-app, push, email, or Slack) about posts awaiting approval, replies, reports, and account matters. These are transactional messages about your account, not marketing.
• To draft and summarize with AI assistance (see “Automated assistance” below).
• To secure the Portal, prevent abuse, and meet legal obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Automated assistance (AI)

Orange Grove uses Anthropic's Claude models, via Anthropic's commercial API, to help our team draft captions and messages, summarize comments, sort and triage requests, and answer questions about advertising performance. To do this, relevant Portal content (for example, a post caption, a comment thread, or aggregate ad metrics) is sent to Anthropic for processing. Under Anthropic's commercial terms, Anthropic does not use this data to train its models and retains API inputs and outputs for a limited period (currently up to 30 days) for abuse monitoring. AI-generated drafts are reviewed by a person before anything is sent to you or published. Any action that affects your money or your accounts (for example, launching or changing an ad) requires a human on our team to confirm it.

Who we share information with

We share information only with service providers that help us run the Portal, each bound to use it only to provide their service to us:

We may also disclose information if required by law or to protect the rights, safety, or property of Orange Grove, our clients, or others, and in connection with a merger, acquisition, or sale of our business, in which case this policy continues to apply to the transferred information.

Google user data

If you sign in with Google, the Portal requests only your basic profile (email address, name, and profile picture) to identify you. We use that information solely to sign you in and display your name in the Portal. We do not use it for advertising, do not sell it, and do not transfer it to anyone except as needed to provide the sign-in itself. Orange Grove's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the Portal's access at any time from your Google Account's third-party access settings.

Meta data

Access to your Meta assets is granted by you through Meta Business partner access, never by sharing your password. You can revoke it at any time in Meta Business Settings. When access is revoked, the Portal can no longer read or manage those assets. Details on deleting the data we hold are on our data deletion page.

How long we keep information

• Account information and Portal content: for as long as your business is a client and for up to 3 years afterwards, so we can honor our agreement, resolve disputes, and provide records you ask for — unless you ask us to delete sooner.
• Advertising performance data: for as long as needed to report on and improve your campaigns, and as part of the historical record of your account.
• Invoices and payment records: as required by tax and accounting law, typically 7 years.
• Security logs: up to 12 months.
• Push notification subscriptions: until you turn notifications off or the device unsubscribes.

Your choices and rights

• Access and correction: you can view and update your name, phone, photo, and notification preferences in your profile, or ask us for a copy of the information we hold about you.
• Deletion: you can ask us to delete your account and personal information at any time. See how to request deletion.
• Notifications: turn push notifications off in your profile or your device settings; email notifications include an unsubscribe method, and you can change your channel preference in your profile.
• Google and Meta access: revoke at any time in those services' settings.

We honor these requests regardless of where you live. If you are a California resident, you also have the rights described in the California Consumer Privacy Act to know, delete, correct, and to not be discriminated against for exercising them; we do not sell or share personal information. To exercise any right, email hello@orangegrovesocial.com. We will verify the request using the email address on your account and respond within 30 days.

Do Not Track: the Portal does not track you across other sites, so it does not respond to browser Do Not Track signals; there is nothing to opt out of.

Security

Access to the Portal is invite-only and enforced at the database level, so each client can see only their own data. Data is encrypted in transit and at rest by our providers. Our team's access is limited by role, and actions that affect clients are logged. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you without unreasonable delay and within the time required by Florida law (no later than 30 days after discovery).

Children

The Portal is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes to this policy

When we make material changes, we will update the date at the top, note the change in the Portal, and email account owners before the change takes effect. If a change affects how we use data you authorized through Google or Meta, we will ask for your consent again before using it in the new way.

Contact

Orange Grove Social LLC · St. Petersburg, Florida · hello@orangegrovesocial.com