Privacy policy

1. Who is responsible

itsends is operated by David Paulos Da Fonseca, operating as an entreprise individuelle (sole proprietor) under the trading name Solfaia, 34 Boulevard Prince Henri, L-4280 Esch-sur-Alzette, Luxembourg. VAT identification: LU31854716. Luxembourg business permit (autorisation d’établissement): 10105084 / 2. Contact [email protected] for privacy questions or requests. This notice covers itsends.app, the Content Machine application at content.solfaia.com, its API and associated connectors. itsends is the public product name for Solfaia Content Machine; changing the name does not transfer your workspace or change the legal operator. Other Solfaia services have their own notices.

2. Our roles

We act as controller for account administration, service security, support, legal compliance and managing our relationship with you. When a business customer supplies or connects personal data for its own content management, that customer determines the purposes and we process it on its instructions. Our data processing terms govern that processing. Social platforms independently determine their own processing under their policies.

3. Information we process

Account information includes your name, email, password hash, verification and recovery records, session information and terms acceptance records. Workspace information includes briefs, drafts, captions, uploaded media, schedules, approvals, publication results and activity records. Connected-account information includes provider identifiers, profile information, permissions, encrypted access credentials, expiry and connection status. Depending on the platform and permissions you enable, we also process posts, engagement metrics, comments and supported private messages, including sender identifiers and timestamps. We receive this information from you, your authorized agents and workers, and official social APIs or webhooks. We do not obtain your social-platform password through OAuth.

4. Purposes and legal bases

We use information necessary to create your account, provide requested features, execute approved publications and respond to support requests to perform our contract with you (GDPR Article 6(1)(b)). Where you act for a business, we rely on our legitimate interest in administering that business relationship for its contact information (Article 6(1)(f)). Our legitimate interests also include securing the service, preventing abuse, diagnosing failures and establishing or defending legal claims, balanced against your rights. We process records required by law under Article 6(1)(c). Where consent is required for optional processing, we request it separately and you may withdraw it. OAuth permission enables API access; it does not replace the applicable GDPR basis. Account details are necessary to provide access; optional integrations can remain disconnected.

5. Publishing and connected accounts

Connecting an account authorizes only the permissions presented by that provider. Scheduling and automatic publishing require separate settings and approved content. Social platforms receive the content and metadata necessary to execute your instructions. Published posts may be public, and recipients may retain messages. Disconnecting itsends does not remove content already published on a social platform. You can revoke provider access through the platform itself and manage account and agent access in Connections.

6. AI tools and local agents

If you authorize an external agent, local worker or generation service, the data needed for that task may be read by that tool and processed under its applicable terms. This can include prompts, captions and selected media; inspect connector permissions and avoid sharing unrelated private information. Social provider tokens are not returned to browser or agent tools. We do not use customer content to train our own general-purpose AI models. This is not a promise about the independent retention or training settings of a third-party AI account you choose; review those settings before connecting it. We do not use the service to make solely automated decisions with legal or similarly significant effects about you.

7. Recipients and international processing

Cloudflare provides hosting, application execution, database, object storage and security infrastructure. Resend delivers transactional account emails and enabled notification emails. Authorized infrastructure operations may also process data on operator-controlled systems. Selected social platforms and user-authorized tools receive data for the features you request. Access by personnel and contractors is restricted to legitimate operational needs and confidentiality obligations. We may disclose information where legally required or necessary to establish or defend legal claims. We do not sell personal data. Infrastructure and selected providers may process data outside Luxembourg and the EEA, including in the United States; this is not an EEA-only service. Where required, transfers must rely on an applicable adequacy decision or contractual safeguards such as the European Commission standard contractual clauses, with supplementary measures as appropriate. Contact [email protected] for the safeguards applicable to your processing. See the service-provider register.

8. Security and confidentiality

We use HTTPS, hashed passwords, tenant-scoped authorization and encrypted storage for social access tokens and supported private message bodies and reply drafts. Authorized server code must decrypt relevant information to operate those features. This is not end-to-end encryption or a guarantee that the operator can never access data. Other workspace records and message routing metadata are accessible to authorized application systems. Access controls, limited agent scopes and operational safeguards reduce risk; no system is invulnerable. Historical backups may contain older representations of data and remain subject to access restrictions.

9. Retention and deletion

Account and workspace records are kept while needed to provide your workspace, subject to a deletion request or account closure. Archiving a record hides it from ordinary views and does not erase its stored media. Private-message content is cleaned according to the retention period displayed in Settings; routing and delivery metadata can remain for service operation. OAuth credentials are retained while the connection is needed and removed from active use on disconnection. Verification links expire after 24 hours, reset links after 30 minutes and sessions after up to 14 days; link expiry is not itself deletion of all associated records. Security, support and publication records are retained only while needed to investigate incidents, resolve delivery questions, meet legal obligations or defend claims, considering the incident, applicable limitation periods and provider restrictions. Restricted backup copies expire through the infrastructure backup lifecycle rather than every active deletion being immediately propagated to every snapshot. Deletion instructions must be reapplied following restoration. Request account closure, a data export or deletion at [email protected]; we verify identity proportionately. Mandatory legal retention and overriding provider deletion requirements apply. We explain any lawful retention exception in our response.

10. Cookies and browser storage

The service uses essential session cookies for sign-in and browser storage for application preferences and connection state. Session cookies last up to 14 days unless ended earlier. Browser preferences remain until changed or cleared. Disabling essential storage may prevent authentication or impair functionality. These legal pages contain no advertising trackers or third-party embeds. Optional non-essential tracking, if introduced, requires the applicable notice and consent before activation.

11. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Contact [email protected]; we normally respond within one month and explain any lawful extension. If your information was supplied by a business customer, we will help route the request to that controller. You may complain to the Luxembourg CNPD or another competent supervisory authority. You do not have to contact us before exercising that right.

12. Children and changes

The service is intended for adults, not children. Contact [email protected] if you believe a child has provided personal information. We update this notice when practices change and notify affected users of material changes as required. A policy update does not retroactively authorize a new purpose or replace required consent.

13. Early-access list

The early-access form sends your request to our existing signup service at resources.solfaia.com. We process your email address, consent version, confirmation status and request timestamps to send launch and early-access updates with your consent. A confirmation email is sent through Resend; you join the confirmed list only after deliberately confirming your address. Joining does not create a product account, payment or guaranteed place. Unconfirmed requests are removed after seven days. Confirmed entries remain until you unsubscribe or request deletion. Unsubscribing removes the stored email address; a keyed deduplication record may remain for up to 30 days. Every confirmation includes an unsubscribe link. Request counters use keyed identifiers rather than retaining raw IP addresses in those counters. Our providers may process network information for delivery and security.

14. Google and YouTube integrations

YouTube connection is being configured and is not yet available to customers. Where you enable an available Google or YouTube feature, itsends uses Google OAuth and YouTube API Services. Depending on the feature and permissions you approve, relevant data may include your channel identifier and profile, video metadata, uploaded content, publishing status and encrypted access credentials. Comment-management and analytics permissions will be requested only when the corresponding feature is implemented and disclosed; they are not currently enabled by this notice. We use that data to provide the feature you request, protect the connection and troubleshoot delivery. It is not sold, used for advertising profiles or used to train generalized AI models. itsends’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

You control external-agent access separately. We do not silently transmit Google data to an AI service: any enabled transfer must be necessary for your requested feature, clearly disclosed and authorized, and comply with Google’s policies. The Google Privacy Policy explains Google’s own processing. You can revoke access in Google account permissions, separately from requesting deletion of data already held by itsends at [email protected]. Revocation does not remove videos already published on YouTube. Provider-specific refresh, retention and deletion requirements take precedence over a longer general workspace-retention period.

15. TikTok integration

TikTok connection is being configured and is not yet available to customers. The initial integration covers creator identity and creator-authorized video publishing. Profile statistics, video lists, comment management and business messaging are separate capabilities that require their own implementation, permissions and, where applicable, provider access and account or regional eligibility. This policy does not claim those capabilities are currently offered. We do not request your TikTok password, and connecting an account alone is not authorization to publish or message.