Privacy Policy

1. Who is responsible

[Company name], [address] ("we", "us") operates Amaposta at [domain] and is responsible for personal data processed for running your account. For content you and your team put into a workspace, we process it on your behalf as a processor. [Add your data protection officer or representative, if you have one.]

2. What we collect

• Account details: name, email address and a hashed password. If you sign in with Google, we receive your Google account ID, email address (and whether Google has verified it), name and profile picture instead of a password.
• Workspace content: posts, captions, hashtags, media files, schedules, comments on reviews and the activity log.
• Connected accounts: the access tokens that platforms issue when you connect a channel, and basic profile details such as the account name, handle and avatar.
• Technical data: IP address, browser user agent, session records and request logs, used for security and troubleshooting.
• Billing details: handled by our payment provider; we receive the plan, status and billing contact, not full card numbers.

3. How we use it

To provide the service you asked for: publishing to your channels, sending notifications about reviews, failures and expiring connections, keeping your account secure and handling billing. [State your legal bases, for example contract, legitimate interests and consent.] We don't sell personal data and don't use your content to train models.

4. Platforms and service providers

When you publish, your content goes to the platforms you chose, which handle it under their own privacy policies. We also use service providers for hosting, file storage, email delivery and payments: [list providers and their locations]. They may only use the data to provide their service to us.

5. Cookies and fonts

Amaposta sets only the cookies it needs to work: a session cookie that keeps you signed in (30 days), a security cookie that protects forms (until you close the browser), a cookie that remembers the language you read the site in (1 year) and, while you sign in with Google, a short-lived cookie that ties the sign-in to your browser (10 minutes). There are no advertising or tracking cookies. The site loads its typefaces from Google Fonts, which means your browser contacts Google's servers. [Self-host the fonts or describe this in your policy.]

6. How long we keep it

Account and workspace data is kept while the workspace exists. [Say how long data is kept after a workspace is deleted, how long logs and backups are retained, and what billing records you must keep by law.]

7. Security

Passwords are stored as one-way hashes. Platform tokens and API secrets are encrypted at rest. Webhooks and Custom API requests are signed so receivers can check they came from us. Our staff can see account, workspace, billing and delivery details (such as names, email addresses, plans, connected channels and publishing errors) to run the service and answer support requests. They can't see the content of your posts or your media, every look at a workspace or person is logged, and staff access requires two-step sign-in. [Describe your hosting, access controls and incident response.]

8. Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict some processing, and complain to a data protection authority. Write to [privacy email]. If your data is in someone else's workspace, we may refer you to that workspace's owner.

9. International transfers

[Explain where data is stored and the safeguards for any transfers outside your region.]

10. Changes to this policy

We'll post updates here and email workspace owners about significant changes.

11. Contact

[Company name], [address]. Email: [privacy email].