Privacy policy

1. Controller

Patriciu Lucian Nista Oltean, tax ID 24559683F, registered address Carrer de Baix Llobregat 21, 08223 Can Serra, Vacarisses (Barcelona), España. Contact: [email protected].

2. What data we process

• If you visit the website: nothing that identifies you. We count visits in aggregate, and our hosting provider logs technical data for each request (IP address, browser) to serve and protect the website.
• If you subscribe: your name, your company’s name, your email, your billing details and your tax or VAT number. Your card or bank details are handled by Stripe: we never see them.
• If you use your account: your brands and their material (logos, photos, texts, references), the posts you make, your commissions and what you write to us from the client area. Your keys, sessions and sign-in codes are stored only as hashes; your ElevenLabs key, if you connect it, encrypted.
• If you connect your social networks: the access each platform gives you and the profile’s basic data, as section 9 explains.
• If you write to us: your email and what you tell us.

If your brands’ material contains other people’s data (faces, names, voices), you are the controller of that data and we process it on your behalf, as the sales contract explains.

3. Why, and on what legal basis

• To provide the service you bought: create your account, make your posts, send you service emails (welcome, sign-in codes) and support you. Basis: the contract (Article 6(1)(b) GDPR).
• To publish to your social networks what you approve, when you decide. Basis: the contract (Article 6(1)(b)).
• To charge and invoice, and meet tax and accounting obligations. Basis: legal obligation (Article 6(1)(c)).
• To protect the service against fraud and abuse, and improve it with your feedback. Basis: our legitimate interest (Article 6(1)(f)), which does not override your rights.
• To show your testimonials, opinions and excerpts of your posts as references on our website and channels, as the sales contract says; we never assign or sell them. Basis: the contract and our legitimate interest; you can ask us to remove them at any time.

We will not send you advertising without your consent, we do not sell your data, and we do no profiling or automated decision-making that affects you.

4. How long we keep it

While you have an account. After that, we delete your brands, material and posts when you ask us to, and keep billing records for up to 6 years, as commercial and tax law require. Sign-in codes expire within minutes and sessions after 30 days.

5. Who we share it with

We run the API server, where your account and brands live, ourselves. Beyond that, we share data only with the providers we need to run the service, who process it on our behalf with GDPR safeguards:

• Vercel (website hosting);
• Cloudflare (private storage of posts);
• Resend (sending emails);
• Anthropic (the agent that makes custom scenes, with the brief you give us);
• ElevenLabs (generated music and, unless you connect your own account, the voice-over, with the text it speaks).

When you publish, we send the post and its text to the network you chose (Meta for Instagram and Facebook, TikTok, Google for YouTube, or X), which processes them under its own terms. We send them nothing else.

Stripe processes payments as controller of its own data, under its privacy policy. Your AI assistant and, if you connect it, your ElevenLabs account are yours: what you share with them is governed by their terms. We disclose data to authorities only where the law requires.

6. Transfers outside the EU

Some of these providers are in the United States. In those cases the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

7. Your rights

You can ask us to access, rectify or erase your data, object to or restrict its processing, or take it to another service (portability). Write to [email protected] and we will reply within one month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

8. Security

Material and posts are kept in private storage and can only be downloaded through signed links that expire. Keys are stored only as hashes, the access to your social networks and to ElevenLabs encrypted; connections are encrypted and each account only sees its own brands.

9. Social networks you connect

You can connect your brands’ profiles on Instagram, Facebook, TikTok, YouTube and X to publish to them from your account. This is what we process and how:

• What we receive: the access the platform grants us (a token and, where there is one, a refresh token) and the profile’s basic data so you can see which one is connected: its ID, its name or username and its picture. On Facebook, the Pages you choose when connecting; on TikTok, also your account’s privacy and interaction options, which we show you before each post. After publishing, the post’s ID and link, or the error if it fails.
• What we do not ask for: we do not read your messages, followers, comments, analytics or other posts, and we do not request permissions to do so. We only request the permissions to see the connected profile and publish to it.
• What we use it for: only to show you which profile is connected and to publish to it what you approve, with the text and settings you choose, right away or at the time you schedule. We do not use it for advertising, we do not sell it, we do not profile you with it, we do not train AI models with it, and we give it to no one other than the platform itself when publishing.
• How we store it: tokens are kept encrypted (AES-256-GCM) on our server; neither your browser nor your AI assistant ever sees them. We refresh them automatically while the connection is active.
• For how long: while the profile is connected. If you disconnect it, we immediately delete its tokens and profile data and ask the platform to revoke the access where it allows it. If a connection expires or you withdraw the access from the network itself, we detect it within a week at most and delete its data within 30 days at most. The history of what was published (post, date, link) stays in your account until you delete it.

You can withdraw the access from your account (Brand › Social › Disconnect) or from each platform: Instagram, Facebook, TikTok (Settings and privacy › Security and permissions › App permissions), Google (YouTube) and X. How to ask us to delete everything is explained on the data deletion page.

YouTube and Google. Maagma uses YouTube API Services: by connecting your channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies to the data Google processes. Maagma’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Minors

Maagma is for businesses and professionals: we do not knowingly process data of anyone under 18.

11. Changes

If we change this policy significantly, we will email you if you have an account. What we store in your browser is explained in the cookie policy.