Privacy policy

This policy explains what personal data MarketingBuddy ("we", "us") handles, why, and what your rights are. MarketingBuddy plans, writes and measures social media, link-in-bio pages and blogs, at marketingbuddy.eu and app.marketingbuddy.eu.

1. Two roles

We handle personal data in two different roles.

• As controller, for the people who visit our website, write to us, sign up and pay. We decide why and how this data is used.
• As processor, for the data our customers put into their account (their posts, pictures, products and team) and for the visitors of their link-in-bio pages and blogs. The customer decides why this data is used. We only process it on their instructions, to deliver the service.

2. What we collect and why

• Website: on your first visit we ask which cookies you accept, in three groups. Necessary (always on): remembers your choice. Statistics: recognises your browser, so we see how visits link up over days. Marketing: advertising cookies, and telling Google, Meta and TikTok that an ad led to a visit. Without your yes we still count visits, clicks and errors anonymously, without cookies: your IP address and browser become a code that changes every day, so you can't be followed from one day to the next. Our servers keep short technical logs (IP address, time, page) to keep the service secure. Legal basis: your consent for statistics and marketing; our legitimate interest for anonymous counting and security.
• Cookies on our website (all from EventsLake, an analytics service in the EU): _el_consent (necessary, remembers your choice, 6 months), _el_sec (necessary, tells real visitors from bots, 6 months), _el_id (statistics, recognises your browser, 13 months) and _el_s (statistics, groups the pages of one visit, 30 minutes). Marketing cookies are only set after you say yes to marketing. Change your choice at any time with "Cookie settings" at the bottom of every page.
• Contact form: your name, email address, business and message, so we can answer you. Legal basis: our legitimate interest in answering you, or steps you ask for before a contract.
• Your account: your name, email address, the brands you set up and your settings, so you can log in and use the service. Legal basis: performing our contract with you.
• Using the app: we record what you do in the app (for example adding a channel, planning or publishing a post, or buying credits), linked to your account and brand, so we can improve MarketingBuddy and help you when something goes wrong. In the app, EventsLake keeps one identifier in your browser to link your visits to your account. We never record the texts you write, the pictures you upload or the data of your own customers. Legal basis: our legitimate interest in improving the service.
• Connected accounts: when you connect an Instagram or Facebook account, we read it through Meta's official API: its profile (name, picture, followers), your posts with their numbers (likes, comments, reach, views) and the comments people left on them (their public username, the text and the date). Posts you import from a file, such as a LinkedIn export, are kept the same way. We use this to show you what works and to let our AI learn from your best posts. We never see your password, and the access is stored encrypted. Legal basis: performing our contract with you, and our customer's legitimate interest in understanding the reactions to their own posts.
• Payments: Stripe handles your card details. We never see or store your card number. We keep your plan, invoices and the VAT details the law asks us to keep. Legal basis: contract and legal obligation.
• Security and support: login and security events, and what you send us when you ask for help. Legal basis: our legitimate interest in keeping accounts safe.

3. Visitors of link-in-bio pages and blogs

• When someone visits a page or blog made with MarketingBuddy, we count the visit without cookies. We combine the IP address and browser into an anonymous code that changes every day, so a visitor is counted once but can never be followed from one day to the next. The IP address itself is never stored. We keep the page, the time, the source (for example Instagram), the kind of device and the country. Bots are not counted.
• When a brand connects its own EventsLake, these anonymous visits, clicks and reads also go to the brand's EventsLake project, on the brand's instructions. Never an IP address, a name or an email address.

4. AI

To write posts, plans and blog articles, we send the text needed for that task (for example your brand description, the theme of the week, or a picture you chose) to an AI provider. We use Google's Gemini models through Google Cloud. Under Google Cloud's terms, this data is not used to train their models. We only send what the task needs.

5. Who helps us (sub-processors)

• Amazon Web Services: hosting and file storage, in Paris (France).
• Cloudflare: network protection, the check on our contact form that you are not a robot, and fast delivery of our pages.
• Twilio SendGrid: our own emails, such as login links and the morning email.
• Stripe: payments and invoices.
• Google Cloud: AI models for writing and for describing pictures.
• EventsLake: counting visits to our website and how the app is used, in Paris (France).

When data leaves the European Economic Area, we rely on the European Commission's standard contractual clauses or an adequacy decision. If we add or change a sub-processor, we update this list.

6. How long we keep data

• Account data: as long as your account is active. When you ask us to delete your account, we remove its data within 30 days, apart from backups that expire within a further 30 days.
• Visits and clicks on link-in-bio pages and blogs: up to 2 years, without anything that identifies a person.
• Invoices and payment records: 7 years, as the law requires.
• Imported posts and comments: as long as the channel exists, or until you delete them. When you remove MarketingBuddy in your Instagram or Facebook settings, or ask Meta to delete your data, we delete the access and everything we imported from that account right away.
• Contact form messages: up to 2 years.
• Technical logs: normally no more than 90 days.

7. Security

Traffic is encrypted. You log in with one-time links or codes, not passwords. Access to production systems is limited to the people who need it. No system is perfectly secure, but we take care to protect your data, and we tell you and the authorities when a breach requires it.

8. Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Send us a message through the contact form and tell us which right you want to use. We answer within one month. If you are not happy with our answer, you can complain to your data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données.

9. Children

MarketingBuddy is for businesses and creators. It is not meant for people under 16, and we do not knowingly collect their data.

10. Changes

When we change this policy in a way that matters, we update the date at the top and tell our customers in the app or by email.

Questions about this page? Contact us.