1. Data Controller
The data controller responsible for your personal data is:
For EU residents, if you have questions about how we process your data or wish to exercise your rights, contact us at the address above.
2. Information We Collect
We collect only the minimum data required to deliver, secure, and improve our service.
2.1 Account Information
- Full name and email address (provided during registration)
- Authentication identifiers managed by Clerk
- Subscription and billing status (if applicable)
2.2 Connected Social Media Accounts
When you connect a social account (Instagram, Facebook, YouTube, LinkedIn, X/Twitter), we store:
- OAuth access tokens and refresh tokens
- Platform-assigned user IDs and display names
- Page/channel IDs for Business accounts
These tokens are used exclusively to publish posts, retrieve analytics, and manage scheduled content on your behalf. We never access private messages, followers' data, or any information outside explicitly granted OAuth scopes.
2.3 Content You Create
- Post drafts, captions, hashtags, and scheduling metadata
- Images and videos uploaded for scheduling (stored temporarily on our servers and/or AWS S3)
2.4 Usage and Technical Data
- IP address, browser type, device type, and operating system
- Pages visited, features used, and session duration
- Error logs and performance diagnostics
2.5 Cookies & Tracking
We use strictly necessary cookies for session management and authentication. We may also use analytics cookies (e.g., anonymised analytics) to understand how users interact with the platform. You may disable non-essential cookies in your browser settings; this will not affect core functionality.
3. Legal Basis for Processing (GDPR – EU/EEA Users)
Under the GDPR, we process your personal data on the following legal bases:
| Purpose | Legal Basis (Art. 6 GDPR) |
|---|---|
| Providing and operating the service | Performance of a contract (Art. 6(1)(b)) |
| Account creation and authentication | Performance of a contract (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (where applicable) | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
4. How We Use Your Information
We use your data solely for the following purposes:
- Authenticating your identity and maintaining your account
- Scheduling, queuing, and auto-publishing posts to connected platforms
- Storing content drafts and post history
- Retrieving analytics and performance data from connected accounts
- Providing customer support
- Detecting, preventing, and investigating abuse, fraud, or policy violations
- Ensuring the security and integrity of our platform
- Complying with legal obligations
We will never
- Sell, rent, or trade your personal data to third parties
- Share your data for advertising or profiling purposes
- Use your content for AI training without explicit consent
- Monetize your profile or social media presence
5. Data Sharing & Third-Party Services
We share data only with trusted sub-processors necessary to operate our service:
| Service | Purpose | Data Shared |
|---|---|---|
| Clerk | Authentication & user management | Name, email, auth identifiers |
| Paddle | Payment processing and billing administration if paid billing is enabled | Billing contact details, subscription metadata, transaction details |
| Amazon Web Services (AWS S3) | Media file storage | Uploaded images/videos |
| Meta (Instagram, Facebook) | Content publishing via official API | OAuth tokens, post content |
| Google (YouTube) | Content publishing via official API | OAuth tokens, post content |
| Content publishing via official API | OAuth tokens, post content | |
| X / Twitter | Content publishing via official API | OAuth tokens, post content |
All sub-processors are bound by data processing agreements (DPAs) and handle data in accordance with applicable law. Each integration uses the official platform API and operates within the scopes you explicitly authorise.
6. International Data Transfers
araldo operates globally. Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. Where such transfers occur, we ensure adequate safeguards are in place through:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Transfers to countries with an EU adequacy decision
- Binding Corporate Rules or other recognised legal mechanisms where applicable
7. Data Storage & Security
We implement industry-standard technical and organisational security measures to protect your data:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Encrypted storage of OAuth tokens — never stored in plaintext
- Role-based access control limiting internal access to personal data
- Regular security audits and vulnerability assessments
- Incident response procedures meeting 72-hour GDPR breach notification requirements
While we take all reasonable precautions, no internet-based service is 100% secure. We encourage you to use strong passwords and report any suspected security issues promptly.
8. Data Retention
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:
| Data Type | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion request |
| OAuth tokens | Until account disconnection or deletion |
| Scheduled post data | Duration of account + 30 days |
| Uploaded media files | Until post is published or draft deleted |
| Technical/log data | Up to 90 days |
Upon account deletion, all personal data is permanently erased within 30 days, except where retention is required by law.
9. Your Privacy Rights
9.1 Rights Under GDPR (EU/EEA Residents)
Under the GDPR, you have the following rights:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data under certain conditions.
- Right to Restriction of Processing (Art. 18): Request that we limit how we use your data.
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
- Rights Related to Automated Decision-Making (Art. 22): We do not make solely automated decisions that produce legal or similarly significant effects.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
- Right to Lodge a Complaint: You have the right to complain to your national Data Protection Authority (DPA). A list of EU DPAs is available at edpb.europa.eu.
9.2 Rights Under CCPA (California Residents)
If you are a California resident, you have the following rights under the CCPA/CPRA:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected.
- Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt-Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioural advertising.
- Right to Limit Use of Sensitive Information: We do not use sensitive personal information beyond what is necessary for providing the service.
- Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.
To exercise any of the above rights, contact us at team+privacy@araldosocial.com. We will respond within 30 days (or 45 days for CCPA requests where permitted). We may require identity verification before processing requests.
10. Data Deletion Requests
To request deletion of your data, email us with the subject line "Data Deletion Request":
Upon confirmed request, we will permanently erase:
- Your account and profile information
- All OAuth access and refresh tokens
- All scheduled and published post records
- All uploaded media
- Analytics data linked to your identity
- All server logs containing your identifiers
Deletion is completed within 30 days of verification. We will confirm completion via email.
11. Children's Privacy
araldo is not directed at individuals under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without appropriate consent, we will delete it promptly. If you believe a child has provided us with personal data, contact team+privacy@araldosocial.com immediately.
12. Updates to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes to our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or via a prominent notice within the application at least 14 days before changes take effect. The "Last Updated" date at the top of this page indicates when the most recent revision was made.
Continued use of araldo after the effective date of changes constitutes acceptance of the revised policy.
13. Contact Us
For questions, complaints, or to exercise your data rights:
We aim to respond to all privacy-related enquiries within 72 hours.