Privacy Policy

This policy explains how 8x Social, Inc. (“8x”, “we”, “us”) handles personal data in connection with Sonar: our website, app, reports and emails. It covers two groups of people: our customers and website visitors, and the creators and other people whose public social media content appears in Sonar. For 8x’s other products, see the 8x privacy policy.

Who we are

8x Social, Inc., a Delaware corporation at 1111B S Governors Ave STE 47647, Dover, DE 19904, United States, is the controller of the personal data described here. For any privacy question or request, email hello@8x.social.

What we collect

From customers and visitors

• Account details — your email address, password (stored in hashed form by our authentication provider), workspace or company name, and the email addresses of teammates you invite. If you sign in with Google, we receive your name, email address and profile picture from Google.
• What you put into Sonar — the brand names, websites, competitors and niche choices you give a run, messages you send the AI assistant, briefs, saved boards and notification settings, plus the reports and usage records those generate.
• Billing details — your plan, invoices and the Stripe customer and subscription identifiers we need to manage your subscription. Stripe processes your payment; we never see or store your full card number.
• Free report requests — the email address, brand and website you give us when you request a free report, and, where you provide them, your name, phone number, country and approximate monthly marketing spend.
• Technical data — IP address, browser type, the pages and features you use, request timestamps and error details, used to run, secure and rate-limit Sonar.
• Messages — anything you send us by email.

From public social media

• Public profiles — handle, display name, bio, profile picture, follower and engagement counts, links in the bio, and any contact email address published in the bio.
• Public posts and videos — captions, hashtags, thumbnails, view counts and dates. Videos are also analysed by AI models, which can describe who and what appears in them.
• What we work out from them — the niche a creator belongs to, which brands they appear to have worked with, how often they post and how their content performs.

We collect this from TikTok and Instagram, directly and through third-party data providers. We only collect content the account holder has made publicly visible — never private accounts or private messages. We do not set out to collect or infer sensitive information, such as health, ethnicity, religion or sexual orientation, and we do not use it to profile anyone.

How we use it

We use personal data to run analyses and deliver your reports, provide the AI assistant, manage your subscription, credits and billing, send service emails (for example when a report is ready or a payment fails), respond to support requests, keep Sonar secure and prevent abuse, fix problems and improve the service, and meet our legal obligations. We also use public social media data to build Sonar’s index, so customers can find the brands and creators in their market, and to write case studies for 8x’s blog.

We do not sell information about our customers or website visitors, and we do not share it for targeted advertising. Sonar makes public creator information, and insights derived from it, available to customers as part of the service. We do not make decisions about anyone based solely on automated processing that have legal or similarly significant effects.

Legal bases (EU, EEA, UK and Switzerland)

• Contract — to provide Sonar to you and manage your account, subscription and service emails.
• Legal obligation — to keep tax and accounting records and respond to lawful requests.
• Legitimate interests — to secure Sonar, prevent abuse, fix and improve the service, respond to free report requests, publish case studies, and build Sonar’s index from public social media data. For the index, our interest (and our customers’) is understanding the market and finding creators to work with. We limit it to information people chose to make public, mostly for professional reach, and we offer an easy way to object — see If you appear in Sonar below.
• Consent — where we ask for it. You can withdraw consent at any time.

Who processes your data

We use these service providers to run Sonar. Most process data only on our behalf; data providers and Sign in with Google also apply their own terms.

• Supabase — database, file storage and authentication (United States).
• Fly.io and Upstash — application hosting, background workers and job queue (United States).
• Stripe — payment processing; Stripe handles all card data directly.
• Anthropic — AI models that classify public content, write insights and power the assistant.
• Google — the Gemini API, which analyses public videos, and Sign in with Google.
• Voyage AI — text embeddings used to match creators and brands to niches; receives public post text and brand names.
• LangChain (LangSmith) — monitoring and debugging of our AI pipelines, which records the inputs and outputs of runs.
• Resend — sending service emails.
• Cloudflare — Turnstile bot protection on the sign-up, login and free report forms.
• Tavily — web search used to find brands’ websites and social accounts.
• RapidAPI and data providers available through it — retrieving public TikTok and Instagram data. They receive the handles, brand names and search terms we look up.

Under their terms for paid API use, Anthropic and Google do not use the data we send them to train or improve their models. We also disclose personal data to Sonar customers and people who request a free report (public creator data, as part of the service), to readers of 8x’s blog (in case studies), to people you send share links to, if the law requires it, to protect rights and safety, or to a buyer or successor if 8x is involved in a merger or acquisition.

If you appear in Sonar

If you post publicly on TikTok or Instagram, your public profile and posts may appear in Sonar. Brands use Sonar to understand their market and to find creators to work with. Sonar customers and people who request a free report can see creator profiles, posts and performance statistics, and reports they share can be seen by the people they share them with. Sonar’s public pages show only aggregate counts, but case studies on 8x’s blog may name creator handles and link to public posts as examples.

You can ask what we hold about you, ask us to correct it, or ask us to remove you from Sonar. Email hello@8x.social with your handle and platform, from the email address in your bio if there is one, or tell us how you would like to confirm the account is yours. Within 30 days we will remove your data from Sonar’s index and live views, remove your handle from published case studies, and take reasonable steps to stop it being collected again. Reports created before your removal may still include you. We cannot remove content from TikTok or Instagram themselves, or from copies customers exported.

Cookies and similar technologies

• Sign-in cookies — secure, httpOnly first-party cookies that keep you signed in, remember your active workspace, and protect the Sign in with Google flow.
• Local storage — your browser stores interface preferences, such as sidebar state, and work in progress, such as a draft analysis.
• Cloudflare Turnstile — runs a bot check on the sign-up, login and free report forms.

We do not use analytics, advertising or cross-site tracking cookies.

International transfers

8x is based in the United States, and Sonar stores and processes data in the United States. When personal data is transferred from the EEA, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses, the UK Addendum to them, or our providers’ certification under the EU–US Data Privacy Framework. Email hello@8x.social for a copy of the safeguards that apply.

How long we keep data

• Account and workspace data — while your account is open. When you ask us to delete your account, we delete this data within 30 days. Backup copies are overwritten on a rolling basis.
• Billing records — up to 7 years, to meet tax and accounting obligations.
• Free report requests — 12 months, unless you create an account.
• Logs and AI pipeline traces — for a limited period needed to debug and secure the service, after which they are deleted automatically.
• Public social media data — while it remains relevant to the markets Sonar tracks, or until the person it relates to asks us to remove it.

Your rights

Wherever you live, you can ask us for a copy of your personal data, or ask us to correct or delete it, by emailing hello@8x.social. We may need to confirm your identity first. We respond within 30 days for requests under the GDPR (extendable by two months for complex requests) and within 45 days for requests under US state privacy laws (extendable by 45 days).

EU, EEA, UK and Switzerland

You have the right to access, correct and delete your personal data, restrict our processing, receive your data in a portable format, and withdraw consent at any time. You can also complain to your local data protection authority — in the UK, the Information Commissioner’s Office.

Right to object. Where we rely on legitimate interests — including building Sonar’s index and publishing case studies — you can object at any time, and we will stop unless we have compelling legitimate grounds that override your interests.

Account details are needed to create and use a Sonar account; without them we cannot provide the service. Everything else you give us is optional.

United States

Depending on your state (for example California, Virginia, Colorado or Connecticut), you may have the right to know what personal information we hold, to correct or delete it, and to opt out of its sale, its sharing for targeted advertising, or profiling. We do not sell information about our customers or website visitors, or share it for targeted advertising. If you appear in Sonar as a creator, you can ask us to delete your data as described above. You can use an authorized agent, and we will not discriminate against you for exercising your rights. If we decline your request, you can appeal by replying to our decision. If you are not satisfied with the outcome, you can contact your state attorney general.

Children

Sonar is only for people aged 18 or over, and we do not knowingly collect personal data from children through our website or app. Sonar is not designed to include creators under 18, but because TikTok and Instagram allow users from age 13, some profiles in Sonar may belong to minors. If you believe one does, email hello@8x.social and we will remove it.

Security

Data is encrypted in transit and at rest with our hosting providers. Sign-in sessions are held in httpOnly cookies, and access to production data is limited to the people who need it. No system is perfectly secure, but we take reasonable measures to protect your information, and we will notify you and the relevant authorities of a data breach where the law requires.

Changes to this policy

We will update this policy when our practices change. We will tell you about material changes by email or in the app before they take effect, and show the new effective date at the top of this page.

Contact

8x Social, Inc., 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. For any privacy question or request, email hello@8x.social or see our contact page.