1. Summary
- Tintaki is a tool that allows marketing agencies to prepare posts for their clients' brands, have them approved and publish them on their social networks.
- We process little personal data: that of the people who use the tool, that of those who approve posts and the minimum Instagram and Facebook data needed to publish.
- Data is stored on servers in the European Union (Germany).
- We do not sell data or use it for advertising. We do not use the content to train artificial intelligence models.
- You can request access to or erasure of your data at privacy email pending.
2. Who the controller is
- Controller: service owner pending
- Tax ID (NIF): tax ID (NIF) pending
- Address: registered address pending
- Privacy email: privacy email pending
- Data protection officer: not appointed, or name and email pending
When we are a controller and when we are a processor
Tintaki processes data in two different roles:
| Role | What data | Who decides |
|---|---|---|
| Controller | Data of the agencies that subscribe and of their Users; billing data; visits to our website; support. | Tintaki, in accordance with this policy. |
| Processor (on behalf of the agency) | Data of the agency's client brands and their contact persons, including those who approve posts; content of the posts; data of the connected Instagram and Facebook accounts. | The agency, under its own policy. Tintaki acts in accordance with the data processing agreement signed with it. |
If you are a client of an agency that uses Tintaki and you wish to exercise your rights, you can contact the agency. If you write to us, we will pass your request on to it without delay.
3. What data we process
3.1. Agency Users
Name, email, password (stored with irreversible encryption), role in the account, language, activity log (log-ins, posts created, approved or published) and IP address.
3.2. Billing
Company name, tax ID (NIF), tax address, billing email, subscribed plan and payment history. Card details are collected and stored by Stripe; we only see the last four digits, the card brand and the expiry date.
3.3. People who approve posts
Name, email or telephone number to which the agency sends the link, and the record of each decision: approved or changes requested, comment, date and time, device and IP address.
3.4. Instagram and Facebook data
See section 7.
3.5. Content
Texts, images, logos and other material in the posts. It may include personal data if the agency uploads, for example, photos of people. Tintaki processes it on behalf of the agency.
3.6. Website visits
Technical data (IP, browser, pages viewed) and the cookies explained in the cookie policy.
4. Purposes and legal basis
| Purpose | Legal basis (GDPR) | Data |
|---|---|---|
| Providing the subscribed service: account, posts, approvals, publishing on social networks | Performance of the contract (Art. 6(1)(b)) | 3.1, 3.3, 3.4, 3.5 |
| Charging and invoicing | Contract (6(1)(b)) and legal tax and commercial obligations (6(1)(c)) | 3.2 |
| Keeping the approval log as evidence | Legitimate interest of the agency and of Tintaki in being able to prove what was approved (6(1)(f)) | 3.3 |
| Security and prevention of fraud and abuse | Legitimate interest (6(1)(f)) | 3.1, 3.6 |
| Handling support and requests | Contract (6(1)(b)) | 3.1 |
| Service notices (publishing failures, changes to the terms) | Contract (6(1)(b)) | 3.1 |
| Commercial communications about Tintaki | Consent, or legitimate interest if you are already a customer (Art. 21 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI)). You can unsubscribe in every email. | 3.1 |
| Website usage statistics | Consent, if they use non-essential cookies | 3.6 |
We do not make automated decisions with legal effects on anyone.
5. Artificial intelligence
When a User asks Tintaki to generate a text or an image, we send the AI provider the instruction and the brand context needed (for example, tone, sector, product description).
- We try not to send personal data. The system does not send names, emails or contact details of the people who approve posts. If the User writes personal data in the instruction, it will be sent.
- The current providers are Anthropic (texts) and image provider pending (images).
- Under their commercial terms, they do not use data received via the API to train their models.
- The output is always reviewed by a person before it is published.
6. Who we disclose data to
We do not sell or transfer data. We share it only with providers we need in order to provide the service, under contract and with confidentiality obligations:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | Germany (EU) |
| Stripe Payments Europe, Limited | Payments | Ireland (EU); may transfer to the US |
| Anthropic | AI text generation | US |
| image provider pending | AI image generation | country pending |
| transactional email provider pending | Sending notices and approval links | country pending |
| Meta Platforms Ireland Limited | Publishing on Instagram and Facebook when the agency instructs it. Meta processes that data as a controller under its own policies. | Ireland (EU) |
| Metricool Software, S.L. | Scheduling posts in the agency's Metricool account, only if the agency connects it and instructs it. Metricool processes that data under its own contract with the agency. | Spain (EU) |
We will also disclose data to authorities when required by law.
Transfers outside the EU
Some providers (the AI providers and, in certain cases, Stripe) may process data in the United States. We only do so if the provider is certified under the EU-US Data Privacy Framework or, otherwise, under the standard contractual clauses approved by the European Commission and the necessary supplementary measures. You can ask us for a copy of those safeguards at privacy email pending.
7. Data we receive from Instagram and Facebook
When a brand (or someone at its agency with access) connects its accounts using Meta's login, it chooses which Instagram account and which Facebook Page it shares and accepts the permissions. We receive only:
| Data | What we use it for |
|---|---|
| Business identifier in Meta and access token | Publishing on its behalf without asking it to log in each time. The token is stored encrypted. |
| Identifier, username and profile photo of the Instagram professional account | Showing the agency which account is connected and knowing where to publish. |
| Identifier and name of the shared Facebook Pages | Allowing the agency to choose which Page to publish on. |
| Page posts made or read by Tintaki (text, date, link) | Showing them in the agency's calendar and being able to edit or delete them. |
| Identifier of the person in our app (assigned by Meta) | Managing their connection and their deletion requests. |
We do not read private messages, comments or follower data, nor do we manage ads. We do not use Meta data for advertising or profiling, nor do we sell it or transfer it to third parties. Its use complies with the Meta Platform Terms and the Developer Policies.
8. How to delete Instagram and Facebook data
You have four options, and any of them deletes the token and the Meta data in the table above:
- From Tintaki: Brand > Social networks > Disconnect. Deletion is immediate.
- From Facebook: Settings & privacy > Settings > Apps and websites, remove Tintaki and click Send request for deletion. You will receive a confirmation code and a link to check the status of your request.
- From Meta Business Suite: Settings > Integrations > Connected apps, remove Tintaki. Access is cut off immediately and we delete the data when we detect it, within 7 days at most.
- By email to privacy email pending.
Full instructions are in How to delete your data.
What is not deleted by this: posts already published on Instagram or Facebook (these are deleted from those platforms) and data we are required by law to keep, such as invoices. If something cannot be deleted, we will explain why.
9. How long we keep data
| Data | Period |
|---|---|
| Account and content | For the duration of the contract and 30 days afterwards so that the agency can download its material. It is then deleted; from backups, within a further 30 days at most. |
| Meta tokens and data | Until the account is disconnected, deletion is requested or the contract ends. They are deleted immediately. |
| Approval log | For the duration of the contract and 3 years afterwards, as evidence against claims. |
| Billing | 6 years (Art. 30 of the Spanish Commercial Code (Código de Comercio)) and whatever tax legislation requires. |
| Technical security logs | 12 months. |
| Support data | 2 years from the closing of the enquiry. |
10. Security
Encryption in transit (HTTPS) and of tokens in the database; hashed passwords; internal access restricted to those who need it; encrypted backups; access logs. If a security breach affecting your data were to occur, we will notify the authority and, where appropriate, those affected, within the time limits set by the GDPR.
11. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent where it is the basis for processing, by writing to privacy email pending. We will respond within one month at most.
If you believe we have not handled your data properly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD), the Spanish data protection authority (www.aepd.es).
12. Minors
Tintaki is a service for professionals. It is not directed at persons under 18 years of age.
13. Changes
If we change this policy in a significant way, we will notify customers by email and on the website before the change takes effect.