SoMe Platform · AI AGENTEN AS
Privacy Policy
Last updated:
Who we are and what this policy covers
SoMe Platform at some.aiagenten.no is provided by AI AGENTEN AS, Norwegian organisation number 923065334. Contact: [email protected]. Registered business address: Hornsruds vei 9, 3612 Kongsberg, Norway.
This policy covers the website, user accounts, customer workspaces and enabled service modules: social content, articles, images and video, planning and approvals, connected social accounts, comments and analytics, newsletters, website integrations, media libraries, AI visibility assessments and support feedback. Availability depends on your agreement, enabled modules and third-party permissions.
Our role and your organisation’s role
AI AGENTEN AS is responsible as controller for its own account administration, service operation, security and support processing. When we handle customer content, contact lists and audience information on a customer organisation’s instructions, the customer determines the purposes and is the controller; we act as its processor under the applicable service and data-processing arrangements.
For personal data received from TikTok Developer Services in the EEA/UK context, TikTok’s Developer Data Sharing Agreement treats the developer as an independent controller, separate from TikTok. This is distinct from our processor role for content handled on a customer’s instructions.
Your organisation manages workspace membership and permissions. Authorised service administrators can access customer workspaces for administration and support. Social-account support authority is separate from permission to approve and publish content. Contact your organisation first about its marketing, newsletter recipients or content concerning you; you can also contact us for assistance.
Information we process and why
Accounts and workspaces: name, email, authentication information, organisation and brand details, membership, roles, preferences and security or access records, to provide access, separate customer workspaces, operate the service and investigate problems.
Content and media: prompts, brand instructions, websites you ask us to analyse, uploaded images, video and audio, captions, transcripts, articles, drafts, editing instructions, approvals, schedules, publication identifiers and status. These are used to generate, edit, organise, deliver and track the content you request. Digital-twin functionality, if used, submits supplied photographs for a custom image model and stores its model reference; obtain the depicted people’s permission before using it.
Social connections: provider account identifiers, profile names and images, granted permissions, access and refresh tokens, connection state and publishing receipts. These enable authorised account connections, renewal, account selection and delivery. Supported integrations include Meta (Facebook and Instagram), LinkedIn and limited-availability TikTok. The TikTok connection requests basic profile access and Direct Post permission; it is not a request for access to your TikTok password or private messages.
Comments and results: supported connected channels can supply comment text, author identifiers, replies, dates and post-performance metrics. Website, search and advertising integrations can supply traffic, search and campaign metrics. Coverage varies by provider and permission; the service does not collect every channel’s messages through every connection.
Newsletters and websites: customer-supplied subscriber email addresses, subscription and consent records, unsubscribe or suppression state, delivery events, campaign content and website publishing configuration. Customer website analytics may process page, referrer, device, session and company-identification information. The customer is responsible for its own visitor notices and consent choices.
AI visibility: websites, business and competitor information, questions, model answers, sources and measurement receipts used to assess how AI services describe a business. These are measurements of the configured services, not a guarantee of what every consumer AI application will show.
AI processing and service providers
Requested AI features send relevant prompts, selected content, images, audio or website information to the configured model or processing service. The code integrates OpenRouter and its selected downstream model providers, OpenAI, fal.ai and ElevenLabs; web collection can use Firecrawl and Microlink. Which service receives data depends on the feature and configuration. Do not submit secrets or sensitive personal information that is unnecessary for the task.
Supabase provides authentication, database and file-storage infrastructure; Netlify hosts the web application; video processing also uses AWS infrastructure and configured transcription/render workers. Resend is used for service email and enabled newsletter delivery. Connected Google Drive and Microsoft OneDrive libraries supply files and metadata when authorised. Social platforms and customer-selected website endpoints receive the content and account details necessary for the requested action.
These are functional integration disclosures, not a representation that every provider processes every customer’s data. Providers may process data in countries outside Norway and the EEA. Ask [email protected] for the current providers, processing locations, data-processing agreement and applicable international-transfer arrangements for your service before sending data with special requirements. This page does not promise an exclusive storage region or a universal no-training arrangement across all models.
Support feedback, screenshots and recordings
WhisperX transcription can run on Modal when selected and configured. Media prepared for publishing or sharing may be served through public file URLs so a recipient platform can fetch it; do not treat a hard-to-guess media URL as a confidentiality guarantee.
Feedback you choose to send can include your note, the page involved, account and organisation context, a screenshot and an optional audio recording. Audio may be transcribed using OpenAI. Where the feedback form discloses enabled support sharing, the report, image and transcript can be shared with the support team in Slack and used in AI-assisted investigation. Review the form’s current disclosure before sending and remove unrelated personal information or secrets.
Cookies and browser storage
The application uses authentication/session cookies and browser storage for sign-in, security, selected workspace or brand, and interface preferences. The public legal pages require neither login nor cookie acceptance. Loading the site also involves hosting requests and font resources, including Google Fonts, which receive connection information such as the requesting IP address.
Customer-installed website analytics and third-party services have separate processing contexts. The visitor-analysis integration can send the visitor IP address to IPinfo for company/network enrichment and store a hashed identifier and visit context rather than the raw IP in its visit tables. Hashing does not make all visitor information anonymous. This policy does not replace the customer website’s cookie or privacy notice. Clearing browser storage may sign you out or reset preferences; it does not delete server-side content.
Retention, disconnecting and deletion
Information is retained according to its purpose, the customer relationship, operational dependencies and applicable legal obligations. Different records have different lifecycles; there is no single deletion deadline for all service data. Original video sources have a separate cleanup mechanism, while finished media, drafts, publishing receipts and customer workspace data can remain. In-flight work, audit records, backups and provider-held copies may outlast a deletion action.
You can disconnect a social connection in settings. For TikTok, this invalidates local publishing access and requests revocation at TikTok; a failed provider revocation can require a retry. Connection and audit records may remain. Disconnecting does not delete posts already delivered to a platform, delete the customer workspace or sign you out of the provider’s own website.
Account deletion is available in account settings. Administrator responsibility may need to be transferred first. Deleting your login removes your identity access and memberships, not all shared organisation content. Workspace deletion and broader data-erasure requests are separate matters: contact your organisation administrator or [email protected]. We will clarify the affected records and any retention constraints; we do not promise instant deletion from every backup or third-party system.
Your rights and questions
Depending on the applicable rules and processing, you may request access, correction, erasure, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Contact [email protected] with the service and organisation concerned; do not send passwords or access tokens. We may need to verify your identity and, for customer-controlled data, coordinate with the customer.
You may complain to the Norwegian Data Protection Authority (Datatilsynet) or your competent supervisory authority. Contact us for questions about the purposes, legal basis, recipients or retention of a particular processing activity. We will update this policy when the service or its processing changes; the revision date appears above.