1. Who we are
Switch Socials ("Switch Socials," "we," "us," or "our") is a Delaware, USA company that operates an online marketplace for the buying and selling of social media accounts. For the purposes of the GDPR, we are the data controller for the personal data described in this policy. For the purposes of the CCPA, we are the "business."
Registered address: 123 Placeholder St, Wilmington, DE 19801, USA — UPDATE BEFORE LAUNCH
For all privacy questions, contact legal@switchsocials.com.
2. Data we collect
We collect the following categories of personal data:
- Account information — email address and username you provide at sign-up.
- Listing content — descriptions, screenshots, metrics, and other materials you upload when listing a social media account for sale.
- Transaction records — buyer/seller identifiers, listing references, amounts, payout wallet addresses, and timestamps for each transaction you participate in.
- Chat messages— messages exchanged between buyers, sellers, and our support team. Chat is stored on Switch Socials' internal infrastructure and is not processed by a third-party chat provider.
- Wallet addresses for crypto payouts — public blockchain addresses you supply so we can release funds owed to you.
- IP and device information — IP address, user-agent string, approximate location derived from IP, and device/browser characteristics, used for security, fraud prevention, and abuse detection.
- Analytics events — pages visited, features used, and aggregated interaction events used to improve the product.
3. How we use your data
- To create and operate your account.
- To list, browse, and complete marketplace transactions, including releasing payouts.
- To facilitate communication between buyers, sellers, and support.
- To detect and prevent fraud, account takeovers, and abuse.
- To comply with legal obligations (including tax, sanctions, and anti-money-laundering rules).
- To improve product quality, performance, and reliability via aggregated analytics.
- To send transactional notifications (e.g. listing status, payout confirmations) and, where permitted, product updates.
4. Legal bases under GDPR Art. 6
If you are in the EU, UK, or another jurisdiction with equivalent rules, we process your personal data under one or more of the following lawful bases:
- Performance of a contract (Art. 6(1)(b)) — to provide the marketplace, complete transactions, and release payouts.
- Legitimate interests (Art. 6(1)(f)) — to secure the platform, prevent fraud, debug issues, and improve the product, where these interests are not overridden by your rights and freedoms.
- Consent (Art. 6(1)(a)) — for non-essential cookies, optional analytics, and marketing communications. You can withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, sanctions, and other applicable laws.
5. Subprocessors
We share personal data with the following subprocessors, each bound by a written data processing agreement and required to apply appropriate safeguards. Chat and escrow are handled on Switch Socials' internal infrastructure and are not listed here.
| Name | Purpose | Jurisdiction |
|---|---|---|
| Supabase | Database and authentication | USA |
| Cloudflare | Hosting and Workers (edge compute, CDN, DDoS protection) | USA / global edge |
| Coinbase | Crypto payment processing | USA |
| Google Analytics | Product analytics (aggregated usage metrics) | USA |
6. International data transfers
Switch Socials is based in the United States, and several of our subprocessors operate globally. When we transfer personal data out of the EU, UK, or other regulated regions, we rely on appropriate transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and adequacy decisions where available. We review these mechanisms periodically and supplement them with technical and organisational measures (such as encryption in transit and at rest) where required.
7. Data retention
We keep personal data only for as long as we need it to deliver the service and meet our legal obligations. When you delete your account, we mark it for purge and permanently delete the underlying data 30 days after deletion is requested. The 30-day window allows accidentally-deleted accounts to be restored and lets us complete any in-flight transactions, dispute investigations, or regulatory checks.
Some records (for example, transaction logs required for tax or anti-fraud purposes) may be retained for longer where the law requires it; in those cases the data is minimised and access is tightly restricted.
When you delete your account, your profile is marked deleted immediately and removed from public view. Personal data is retained for 30 days for legal/dispute purposes, then permanently anonymized. Contact support to expedite.
8. Your rights
Under the GDPR (EU/UK)
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure— ask us to delete your data (the "right to be forgotten").
- Portability — receive your data in a portable, machine-readable format.
- Objection — object to processing based on our legitimate interests.
- Restriction — ask us to pause processing while a dispute is resolved.
Under the CCPA/CPRA (California)
- Right to know what personal information we collect, use, disclose, and (if applicable) sell.
- Right to delete the personal information we hold about you.
- Right to opt out of the sale or sharing of personal information. We do not sell your personal information and we do not share it for cross-context behavioural advertising.
- Right to non-discrimination — we will not deny service, charge different prices, or provide a different level of quality because you exercised a privacy right.
To exercise any of these rights, email legal@switchsocials.com from the address associated with your account. We will respond within the timeframes required by applicable law (typically 30 days under the GDPR; 45 days under the CCPA, extendable once). You also have the right to lodge a complaint with your local supervisory authority.
10. Security measures
We protect your data using a defence-in-depth approach:
- TLS encryption for all traffic between your browser and our servers.
- Encryption at rest for the database via our hosting provider (Supabase).
- Row-level security on every database table so users can only access data they are authorised to see.
- Principle of least privilege for staff access, with audited admin actions.
- Regular dependency updates and security scanning of our build pipeline.
No system is perfectly secure. To report a vulnerability or suspected abuse, email abuse@switchsocials.com.
11. Children
Switch Socials is not directed to anyone under the age of 18 and we do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact legal@switchsocials.com and we will delete it.
12. California-specific notices
This section supplements the rest of the policy for California residents under the CCPA/CPRA.
Categories of personal information collected (last 12 months):
- Identifiers (e.g. email, username, IP address).
- Commercial information (transaction records, listings).
- Internet or other electronic network activity (analytics events, device/browser data).
- Geolocation data (approximate, derived from IP).
- Inferences drawn from the above to detect fraud and improve the product.
Sale or sharing: We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
California residents may designate an authorised agent to exercise these rights on their behalf by writing to legal@switchsocials.com. We will verify the agent's authority before responding.
13. Changes to this policy
We may update this policy as our service evolves or as the law changes. When we do, we will revise the "last updated" date at the top of this page and, for material changes, give advance notice by email or in-app notification. Continued use of Switch Socials after the effective date constitutes acceptance of the updated policy.
14. Contact
- Privacy questions and rights requests: legal@switchsocials.com
- Security and abuse reports: abuse@switchsocials.com
- General support: support@switchsocials.com
- Postal: 123 Placeholder St, Wilmington, DE 19801, USA — UPDATE BEFORE LAUNCH