Privacy Policy — Creator Socials

Section 1

Information We Collect

Account Information

When you create an account, we collect your email address, name, and any profile information you provide. If you sign in with Google, we receive basic profile data from Google's OAuth service.

Social Platform Tokens

When you connect a social media account (YouTube, TikTok, Instagram), we store encrypted OAuth access tokens that allow us to publish content on your behalf. These tokens are encrypted using AES-256-CBC and are never exposed in plaintext.

Content & Usage Data

We store the posts, videos, captions, and metadata you create within the platform. We also collect usage data such as pages visited, features used, and publish activity to improve our service.

Payment Information

Billing is handled by Stripe. We do not store your credit card details. We only receive subscription status and customer identifiers from Stripe.

Section 2

Legal Basis for Processing (GDPR)

Contract Performance

We process your account information and social platform tokens because it is necessary to fulfil our contract with you — operating the platform, authenticating your identity, and publishing content on your behalf.

Legitimate Interest

We process aggregated usage analytics based on our legitimate interest in improving the Service. This data is anonymised and does not identify individual users.

Consent

We send marketing communications only with your explicit consent. You can withdraw that consent at any time by clicking the unsubscribe link in any marketing email.

Legal Obligation

We may process or retain data where required to comply with applicable law, including tax, accounting, and anti-fraud obligations.

Section 3

How We Use Your Information

Service Delivery

We use your information to operate the platform — authenticating your identity, publishing content to connected social accounts, and maintaining your post history and analytics.

Communication

We may send you transactional emails (account confirmations, billing receipts) and, with your consent, product updates. You can opt out of marketing emails at any time.

Improvement & Analytics

Aggregated, anonymized usage data helps us understand how the platform is used and where we can improve. We do not sell this data.

Section 4

Data Sharing & Third Parties

We Do Not Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

Service Providers

We share data with trusted providers that power our infrastructure: Supabase (database & auth), Stripe (billing), and Resend (transactional email). Each provider is bound by a data processing agreement and handles your data only as instructed by us.

Social Platforms

When you publish content, the relevant data (video, caption, metadata) is sent to the respective platform API (YouTube, TikTok, Instagram) using your authorized token. Their own privacy policies govern how they handle that data.

International Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure adequate safeguards are in place — such as Standard Contractual Clauses — in accordance with GDPR requirements.

Legal Requirements

We may disclose information when required by law, court order, or to protect the rights and safety of our users and the public.

Section 5

Data Retention

Account Data

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by applicable law.

Connected Platform Tokens

OAuth tokens are deleted immediately when you disconnect a social account or delete your account.

Section 6

Security

Encryption

All social platform tokens are encrypted at rest using AES-256-CBC. Data in transit is protected via TLS. We follow industry best practices for access control and infrastructure security.

Row-Level Security

Our database enforces row-level security (RLS) policies — your data is strictly scoped to your account and cannot be accessed by other users.

Section 7

Your Rights

Access & Portability

You may request a copy of all personal data we hold about you at any time by contacting us at privacy@creatorsocials.es.

Correction & Deletion

You can update your profile information in the dashboard settings. To delete your account and all associated data, contact our support team at support@creatorsocials.es.

Restriction & Objection

You have the right to request that we restrict processing of your data, or to object to processing based on legitimate interest. Contact us and we will respond within 30 days.

Withdraw Consent

You can disconnect any social account at any time from the dashboard, which revokes our access to that platform. You can also unsubscribe from marketing communications at any time.

Lodge a Complaint

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) at www.aepd.es. Users in other EU member states may contact their national data protection authority.

Section 8

Cookies

Essential Cookies

We use session cookies required for authentication and to keep you logged in. These are strictly necessary for the Service to function and cannot be disabled.

Analytics

We may use privacy-respecting analytics tools that do not identify individual users. No third-party advertising cookies are used.

Section 9

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before they take effect. Continued use of the platform after changes constitutes acceptance.

Section 10

Contact

For privacy-related questions or data requests, contact us at privacy@creatorsocials.es. We aim to respond to all requests within 30 days. Also see our Terms of Service.