Privacy Policy

This policy explains how Innoweb, Comércio e Prestação de Serviços, Lda. ("Innoweb", "we") handles personal data in Innoweb Social (https://app.innoweb.agency), an internal tool that Innoweb's team and its clients use to plan, publish and analyse social media content for client brands. There is no public sign-up: accounts are created by Innoweb for its staff and for client representatives. It is written to meet the EU General Data Protection Regulation (GDPR) and Angola's Personal Data Protection Law (Law 22/11 of 17 June).

1. Who is responsible

Innoweb, Comércio e Prestação de Serviços, Lda., a company registered in Angola, taxpayer number (NIF) 5002669277, [MORADA DA EMPRESA], Luanda, Angola. Contact for anything about personal data: contact@innoweb.agency.

• Controller for the data of the app's users (Innoweb staff and client representatives) and for the security and operation of the service.
• Processor on behalf of each client for the client brand's social accounts, content and analytics: we process them only to provide the services agreed with that client and on its instructions. The client is the controller of that data.

2. Data we process

• App users: name, email address, role, language preference, sign-in times, session cookies, and the comments and approvals they record.
• Connected social accounts, only when an authorised person connects a brand's account through the platform's own login: account and page identifiers, names, usernames, profile pictures, access and refresh tokens (encrypted) and the permissions granted.
• Content: captions, images, videos, documents, covers and options that our users create to publish on the brand's accounts.
• Analytics each platform provides for the connected account: posts published on the account (including those made outside the app) and metrics such as reach, views, impressions, engagement, followers, video retention and aggregated, anonymous audience breakdowns (by country, city, age range or gender). We do not receive or store data that identifies individual followers.
• Google Business Profile: location details, local posts, daily performance metrics, monthly search keyword counts and review totals and ratings.
• Technical logs: errors and job results, kept without access tokens or passwords.

We do not process special categories of personal data (such as health or political opinions) and we do not knowingly process data of children.

3. Purposes and legal bases

• Publishing, scheduling, analytics dashboards, exports and PDF reports for a client brand: performance of our contract with the client (GDPR art. 6(1)(b)), acting as processor on the client's instructions (art. 28), with the authorisation given on each platform by the person who connects the account.
• User accounts, sign-in, client approvals and notifications: performance of the contract with the client and our legitimate interest in running the service for the people the client designates (art. 6(1)(b) and (f)).
• Security, error logs, backups and fraud prevention: legitimate interest in keeping the service and its data safe (art. 6(1)(f)).
• AI caption suggestions, only when a user asks for them: performance of the contract and legitimate interest (art. 6(1)(b) and (f)); see section 6.
• Keeping records required by law (for example invoicing): legal obligation (art. 6(1)(c)).

We do not sell personal data, use it for advertising, build profiles of individual people, or take decisions based solely on automated processing that produce legal or similarly significant effects (GDPR art. 22).

4. Platform data

• Facebook and Instagram (Meta): accessed through Facebook Login for Business with the permissions shown on the consent screen (for example pages_show_list, pages_manage_posts, pages_read_engagement, read_insights, instagram_basic, instagram_content_publish, instagram_manage_insights, business_management). Data is used only for the brand's own Pages and Instagram professional accounts.
• TikTok: profile information, video list and statistics, and content posting, as authorised through TikTok's login.
• LinkedIn: organisation pages the user administers, their posts, and page, follower and post statistics. LinkedIn page analytics are only shown to administrators of that page and are kept for at most 12 months.
• YouTube: Innoweb Social uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's use of data is governed by the Google Privacy Policy. You can revoke our access at any time in Google security settings.
• Google APIs (YouTube and Google Business Profile): Innoweb Social's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Where the data is stored

The application and its database run on servers of Hetzner Online GmbH in Germany (European Union). Media files are stored with Cloudflare R2. Daily database backups are kept on the same provider infrastructure in the EU.

6. Who receives the data

• Hetzner Online GmbH (Germany): hosting of the application and database.
• Cloudflare, Inc.: media file storage (platforms fetch media from public URLs to publish it) and DNS.
• Brevo (Sendinblue SAS, France): delivery of notification and report emails.
• Anthropic, PBC (United States), only when a user clicks "Write with AI": the draft caption or brief, the brand name and notes, and up to five of the brand's recently published captions (as style examples). No account tokens, follower data or analytics are sent.
• The social platforms themselves, which receive the content we publish on the brand's behalf.
• Innoweb staff in Portugal and Angola who work on the client's account, under confidentiality obligations.

Each provider processes data under a data processing agreement and only on our instructions.

7. Transfers outside the European Economic Area

Some recipients are outside the EEA: Anthropic and Cloudflare (United States) and Innoweb's team in Angola. These transfers rely on the European Commission's adequacy decision for certified U.S. organisations (EU-U.S. Data Privacy Framework) or on the Commission's Standard Contractual Clauses, with additional security measures (encryption in transit and at rest, access limited by role). You can ask us for a copy of the safeguards at contact@innoweb.agency.

8. Security

Access tokens are encrypted at rest with AES-256-GCM, all traffic uses HTTPS, access is restricted by role and by brand, tokens and passwords are never written to logs, and report PDFs are only downloadable after a permission check.

9. How long we keep data

• Access tokens: while the account is connected; deleted immediately when it is disconnected.
• Analytics: while the client relationship is active, within each platform's limits: LinkedIn 12 months, Google Business Profile 30 days, and YouTube data refreshed or deleted as YouTube's policies require.
• Content and reports: while the client relationship is active.
• User accounts: while the person needs access; deleted on request or when the client relationship ends.
• Backups: up to 6 months, after which they are overwritten.
• All data for a social account is deleted on request (see the data deletion page) or when a client leaves Innoweb.

10. Your rights

Under the GDPR and Angolan law you can ask for access to your data, its rectification or erasure, restriction of processing, data portability, and you can object to processing based on legitimate interest. Write to contact@innoweb.agency; we answer within one month. If the request concerns a client brand's data, we pass it to that client and help it answer.

You can also complain to a data protection authority: in Portugal the Comissão Nacional de Proteção de Dados (cnpd.pt), in another EU country your local authority, and in Angola the Agência de Protecção de Dados (APD).

11. Cookies

We only use strictly necessary cookies: a session cookie to keep you signed in and a cookie that remembers your language. No consent banner is needed for these.

12. Changes

We will update this page when our practices change and show the date of the latest version at the top.