Privacy Policy

1. Information We Collect

We collect the following categories of information:

Account information

Your name, email address, and a securely hashed password. We never store your password in plain text.

Billing information

When you subscribe, payments are processed by Polar. We do not receive or store your full card number. We store billing-related metadata such as your plan, subscription status, billing period, and limited identifiers (for example, a Polar subscription or customer ID) needed to manage your subscription.

Connected social accounts and access tokens

When you connect an account on Facebook, Instagram, LinkedIn, TikTok, YouTube, and X (formerly Twitter), we receive and store the access tokens issued by that platform (stored encrypted), along with account details such as the account or page/channel ID, handle or name, and avatar. Tokens let us publish on your behalf within the scopes you approve.

Content you create

The posts, captions, uploaded media, drafts, schedules, and related metadata you create or store in Spanlyfy so we can save, format, and publish them.

Usage and device data

Technical information such as your IP address, browser and device type, log data, timestamps, and actions taken in the Service, collected to operate, secure, and improve the Service.

Support communications

The contents of messages you send us and our responses, so we can provide support and keep records.

2. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service, including saving, scheduling, and publishing your content to the platforms you connect.
• Authenticate you and keep your account secure.
• Process subscriptions, payments, and refunds, and send related confirmations and account notices.
• Provide customer support and respond to your requests.
• Monitor, troubleshoot, and improve the Service, including for reliability and performance.
• Detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations and enforce our agreements.

3. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of our contract with you (to provide the Service); your consent (for example, when you connect a social account); our legitimate interests (such as securing and improving the Service); and compliance with legal obligations.

4. How We Share Information

We share personal information only as described here:

• Social media platforms: when you publish or schedule content, we transmit that content and the necessary data to the platforms you have connected and instructed us to post to.
• Service providers (subprocessors): trusted vendors who process data on our behalf to run the Service - including Polar (payments), our email provider, our hosting and storage providers, and error-monitoring tools - under contracts that limit their use of your data.
• Legal and safety: when required by law or legal process, or to protect the rights, property, or safety of Spanlyfy, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, where your information may be transferred subject to this Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Social Media Platform Data & Tokens

When you connect a social account, you authorize the specific permissions (scopes) shown during the platform's authorization flow. We access only what is needed to provide the Service - typically your basic profile, the pages or channels you manage, and the ability to create posts.

Access tokens are stored encrypted and used only to act on your behalf. You can disconnect any account in Spanlyfy at any time, which stops our access going forward, and you can also revoke access from within each platform's own settings.

6. YouTube API Services & Google Data

If you connect a YouTube/Google account, the Service uses YouTube API Services. We comply with the YouTube API Services Terms and Google's Limited Use requirements. The YouTube Terms of Service (https://www.youtube.com/t/terms) and Google Privacy Policy (https://policies.google.com/privacy) apply to Google's handling of your data.

We use data from the YouTube API Services only to provide the Service to you, do not use it for advertising, and do not transfer it except as needed to provide the Service, to comply with law, or as part of a merger or acquisition. You can revoke Spanlyfy's access at any time via the Google security settings page (https://security.google.com/settings/security/permissions).

7. Cookies & Tracking

We use a small number of strictly necessary cookies - primarily a session cookie to keep you logged in, a cookie to remember your privacy choices, and a preference setting to remember options such as your theme. These are necessary for the Service to function and are always active.

Any non-essential cookies, such as analytics to understand and improve how the Service is used, are off by default and load only after you opt in. When you first visit, a consent banner lets you accept all, reject non-essential cookies, or choose per category, and you can change your choices at any time using the "Manage cookies" control in our footer.

We do not use third-party advertising cookies to track you across the web, and we do not sell your personal information. For the full list of cookies we set, their purpose, and their lifetimes, see our Cookie Policy at spanly.app/cookies.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Connected-account tokens are retained until you disconnect the account or close your account. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain information to comply with legal, tax, or accounting obligations or to resolve disputes. Residual copies may persist briefly in routine backups.

9. Data Security

We use technical and organizational measures to protect your information, including encryption in transit (HTTPS), encryption of stored social-account tokens, hashing of passwords, and access controls limiting who can access data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond promptly to incidents.

10. Your Rights & Choices

Depending on where you live, you may have rights over your personal information, including the right to access, correct, delete, or receive a copy (portability) of it; to restrict or object to certain processing; and to withdraw consent. If you are in California, you have the right to know what we collect, to request deletion, and to not be discriminated against for exercising your rights; we do not sell your personal information.

You can update much of your information directly in your account settings, or disconnect social accounts at any time. To exercise other rights, contact us at privacy@spanly.app. We will respond within the timeframe required by applicable law and may need to verify your identity first.

11. International Data Transfers

We and our service providers may process and store your information in countries other than your own, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) to protect your information when it is transferred internationally.

12. Children's Privacy

The Service is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

13. Third-Party Links

The Service may contain links to third-party websites and platforms that we do not control. This Policy does not apply to those sites, and we encourage you to review their privacy policies.

14. Changes to this Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice (such as by email or an in-app notice) and update the effective date above. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

If you have questions or requests regarding this Policy or your personal information, contact us at privacy@spanly.app (or support@spanly.app).