1. Preamble and Definitions
This Privacy Policy informs users of the Contenttosocial platform of how their personal data is collected, processed and protected, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (GDPR) and the French Data Protection Act No. 78-17 of 6 January 1978 as amended.
- "Personal data":
- any information relating to an identified or identifiable natural person.
- "Source Content":
- any text, caption, metadata, image or logo supplied by the User to the Service.
- "Rendered Assets":
- the images, PDF documents and posts produced by the Service from Source Content and brand settings.
- "Connected Account":
- a social media account the User links to their workspace to receive publications.
- "Publishing Provider":
- the third-party service through which accounts are connected and publications are made, currently Zernio Software SL (Girona, Spain).
2. Data Controller
The data controller is Marketing Ops, Simplified joint-stock company (SAS) with a share capital of €1,000, 229 rue Saint-Honoré, 75001 Paris, France, operating the Contenttosocial service.
Data protection contact: hello@contenttosocial.com
Given the nature and volume of the processing, the appointment of a data protection officer is not mandatory under Article 37 of the GDPR. You may nevertheless contact us at that address for any request regarding your personal data.
3. Data Collected
3.1 Account data
- Email address.
- When you use Google sign-in: the Google account identifier, name and profile picture that Google provides.
- Sign-in dates, session identifiers and password hashes, managed by our authentication provider Supabase Auth. Passwords are never stored in plain text.
3.2 Workspace and brand data
- Brand name, displayed author name, website address, logo, colours, font and closing message.
- When you enter your website before signup: its public business name, logo and address, used for your first workspace.
- When you type a website address on our site (the home page's field or the agency ranking's claim field): the address as typed, its domain, the page, the language and the date, whether or not you then create an account; attached to your account if you sign up in the same browser. No IP address is kept.
- Destination settings: which Connected Accounts publish, captions and calls to action per platform.
3.3 Content and publication data
- Source Content: texts, captions, article titles, descriptions and URLs supplied directly, through the API or another client.
- Rendered Assets, drafts, previews and schedules.
- Publication records: destination, provider identifiers, platform post identifiers and URLs, status, dates, errors and retries.
Source Content may contain personal data you choose to include. You are responsible for that content and should not include sensitive personal data in it.
3.4 Connected account data
- Platform, account name, account identifiers and the provider profile identifier of each Connected Account.
- The access tokens issued by the platforms are stored by the Publishing Provider, not by the Service.
3.5 Integration data
- Connection keys created for API clients, stored in hashed form.
- The address of the connected website and the events it sends (article published, updated or withdrawn).
3.6 Billing data
Payment processing is entirely delegated to Stripe through its Managed Payments service; subscriptions are sold through Link, and Sold through Link, LLC, an affiliate of Stripe, acts as merchant of record. We only retain the Stripe customer, checkout and subscription identifiers, the plan and its quantities, the status, amounts and dates. We never collect or store card numbers, security codes or full banking details; that data is processed exclusively by Stripe in compliance with the PCI-DSS standard. The details you enter at checkout, including your billing address and any tax identification number, are also processed by Stripe and Link under their own privacy policies, published on stripe.com and link.com.
3.7 Technical data
- IP address, browser type and version, request and error logs.
- Security events: failed sign-ins, revoked keys, rejected requests.
3.8 Support correspondence
Emails you send to our contact address, and our replies.
3.9 Free carousel maker
The free carousel maker requires no account. The text and files you submit are processed only to produce the requested download and are not retained; only technical logs are kept.
4. Purposes and Legal Bases
In accordance with Article 6 of the GDPR, each processing relies on an appropriate legal basis:
- Performance of the contract (Art. 6.1.b):
- creation and management of the account and workspace, rendering of assets, connection of accounts, publication to the chosen destinations, billing and customer support.
- Legitimate interest (Art. 6.1.f):
- security of the Service, prevention of fraud and abuse, deduplication of publications, aggregate usage statistics, defence of our rights, and keeping the website addresses typed on our site to know which agencies and freelancers are interested and which cities to add to the SEO agency ranking.
- Legal obligation (Art. 6.1.c):
- accounting and tax retention, response to requests from competent authorities.
- Consent (Art. 6.1.a):
- marketing communications, where any are sent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
6. Processors and Recipients
In accordance with Article 28 of the GDPR, we use the following processors, each bound by a data processing agreement:
| Provider | Location | Purpose |
|---|---|---|
| Supabase, Inc. | Singapore; data hosted in the EU (Paris) | Database, authentication, file storage |
| Vercel, Inc. | United States | Web hosting, application logs |
| Zernio Software SL | Spain | Connection of social accounts and publication |
| Stripe, including its affiliate Sold through Link, LLC | United States | Payments, invoices, taxes, merchant of record |
| Google LLC | United States | Google sign-in, only if you use it |
| Resend, Inc. | United States | Transactional emails |
| PostHog | EU project | Cookieless usage analytics, error reports, and masked session replay for signed-in users |
| AgentMail | United States | Support mailbox |
Each processor is responsible for GDPR compliance for the processing it performs. We never sell your data.
Data may also be disclosed to competent authorities where the law requires it, and to our advisers where necessary to defend our rights.
7. International Transfers
Your data is hosted in the European Union. Some processors are established in the United States or in Singapore, so transfers may occur, in particular for hosting logs, payments, Google sign-in, emails and provider support. These transfers rely on the following mechanisms:
- EU-U.S. Data Privacy Framework (DPF):
- European Commission adequacy decision of 10 July 2023, for certified providers.
- Standard Contractual Clauses (SCC):
- Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
Despite these safeguards, you are informed that third countries may have legislation offering a level of protection different from the European Union. By using the Service, you accept these residual risks.
8. Retention
| Data | Retention |
|---|---|
| Website setup before signup | Expires after 24 hours; expired unclaimed setups are removed when the next website setup request is processed. After signup, retained with the account. |
| Website addresses typed on the site | 24 months, then deleted automatically |
| Account, workspace and brand data | Duration of the account, then 30 days |
| Source Content, Rendered Assets, drafts | Until deleted by you, then at the latest 30 days after account deletion |
| Publication records | Duration of the account, then legal retention only |
| Connection keys and integration events | Until revoked, then 30 days |
| Billing records | 10 years, accounting obligations |
| Technical logs | 90 days at most |
| Support correspondence | 3 years after the last exchange |
Posts published on the platforms are not deleted by the Service; you manage them from your accounts.
9. Your Rights
In accordance with Articles 15 to 22 of the GDPR, you have the following rights:
- Right of access (Art. 15):
- obtain confirmation of the processing and a copy of your data.
- Right to rectification (Art. 16):
- correct inaccurate or incomplete data.
- Right to erasure (Art. 17):
- request the deletion of your data under the conditions provided by law.
- Right to restriction (Art. 18):
- temporarily limit processing.
- Right to portability (Art. 20):
- receive your data in a structured format.
- Right to object (Art. 21):
- object to processing based on legitimate interest.
- Right to withdraw consent:
- at any time, without affecting the lawfulness of prior processing.
- Right to define directives:
- on the fate of your data after your death.
To exercise your rights, send a written request to hello@contenttosocial.com
We respond within one month, extendable by two months for complex requests. Exercising these rights is free; for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act (Art. 12.5 GDPR). You may also lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.
10. Security
We implement appropriate technical and organisational measures: encryption in transit, access controls, hashed connection keys, encrypted secrets, isolation of each workspace by database access rules, and monitoring of security events. Authentication is managed by our provider Supabase Auth. In case of a personal data breach likely to result in a high risk for you, we notify you in accordance with Article 34 of the GDPR.
11. Limitation of Liability
11.1 Exclusion of indirect damages
In no event shall Contenttosocial be liable for indirect, incidental, special or consequential damages, including:
- Loss of profits, revenue, audience or business opportunities.
- Loss of data or file corruption.
- Damage to reputation or image.
- Business interruption.
11.2 Liability cap
The total cumulative liability of Contenttosocial for any claim arising from or related to this Policy shall in no event exceed one hundred (100) euros, without prejudice to the mandatory rights of consumers.
11.3 Specific exclusions
Contenttosocial expressly disclaims liability for:
- Personal data you include in Source Content and publications.
- The processing carried out by the platforms and by the Publishing Provider as independent controllers or under their own terms.
- Your use and distribution of Rendered Assets.
- Unavailability of third-party services.
11.4 Force majeure
Contenttosocial shall not be liable for any failure resulting from circumstances beyond its reasonable control, including natural disasters, network failures, cyberattacks, government decisions or the unavailability of third-party providers.
12. Indemnification
You agree to indemnify, defend and hold harmless Contenttosocial, its officers and providers from any claim, loss, damage or expense (including attorney fees) resulting from your use of the Service, the content you supply and publish, and any violation of third-party rights. This obligation survives the deletion of your account.
14. Minors
The Service is not intended for persons under 18. We do not knowingly collect data from minors. If you believe a minor has provided data, contact us immediately.
15. Modifications
Contenttosocial reserves the right to modify this Policy at any time. Modifications take effect upon publication on this page. Continued use of the Service after modification constitutes acceptance of the modified Policy. If you do not accept the modifications, you may delete your account.
16. Applicable Law and Jurisdiction
This Policy is governed by French law. In case of dispute, and after an attempt at amicable resolution, the French courts have jurisdiction, without prejudice to the mandatory rules of jurisdiction protecting consumers.
17. Contact
For any question about this Privacy Policy: hello@contenttosocial.com
Related document: Terms of Service
Related document: Legal Notice