Privacy policy

Diffuz is a service for publishing and scheduling posts to social networks. This policy explains what data we process, why, for how long, and how you stay in control of it.

It is written to be read. If anything seems unclear, write to us: privacy@diffuz.app.

1. Two distinct roles, depending on the data

Diffuz is meant for professionals who build the service into their own product. This creates two different legal situations, and we handle them differently.

We are the controller for our Customers’ data — the people and organisations who open an account with us. We decide on this processing, and this policy governs it.

We are a processor for the data of our Customers’ end users — the people whose social accounts are connected to the service. We then act solely on the Customer’s instructions, under a data processing agreement concluded with them (Article 28 GDPR). It is the Customer who informs these people and obtains their consent.

By design, we do not know who the end users are. A connected social account is linked to an opaque reference chosen by the Customer. We receive neither their name, nor their email address, nor anything the Customer knows about them. We cannot disclose what we do not hold.

2. Data processed

2.1 Our Customers’ data — we are the controller

2.2 Data related to connected social accounts — we are a processor

When a social account is connected, the platform concerned sends us only what is strictly needed to publish:

Nothing else. We collect no follower list, no address book, and no published content beyond what you ask us to publish.

2.3 Published content

The content to publish — text and media — is supplied by the Customer at the time of the request.

Media referenced by a URL is never kept. It is sent to the destination platform from the URL supplied by the Customer, or relayed for the duration of one upload, and never stored.

A file uploaded from the console (from a computer or Google Drive), on the other hand, has to be kept until it is sent: it is stored in France (Paris), in a private storage space belonging to the Customer, and deleted automatically as soon as no pending post and no draft refers to it — at the earliest 24 hours after upload, and at the latest 7 days after a failed send. Until it is deleted, it can be read at an unguessable URL, from which the destination platform fetches it. Choosing a file in Google Drive uses the drive.file permission: Diffuz can access only the files chosen.

Only what is needed for tracking is kept beyond that: the caption, the date, the status, and the post’s identifier on the platform.

2.4 Audience statistics — counts, never people

Once a day, we read from the platform the public performance figures of the connected account and of its posts from the last thirty days: views, accounts reached, interactions, likes, saves, shares, and the number of comments.

We keep these figures with the date on which they were read, for a simple reason: the platform keeps no history of them, and without this it would be impossible to compare yesterday with today. They are aggregates. They say how many, never who: none of these values identifies a person, and we neither receive nor store the list of accounts that viewed, liked or commented. A post stops being measured thirty days after it is published.

2.5 Comments received — read on display, never kept

At the Customer’s request, the console displays the comments left under their posts, and lets them reply.

This content is never stored on our side. It is requested from the platform when the screen is displayed, and disappears with the response. There is no table, cache or log of its content — and therefore, deliberately, no search and no history on our side. All that remains with us of a comment is the count in §2.4, a number that names no one.

A reply is always written by a person, in the console. We send no automated, promotional or bulk messages, and run no chatbot.

What we owe you to say. People who comment have no contract with us or with our Customer. Their situation is being assessed with a legal professional; the analysis covers in particular the applicable legal basis. In the meantime, we have adopted the most protective position that still lets the service work: read without keeping. If you have commented and wish to exercise your rights, §7 applies to you too.

3. What we do not do

• We do not sell, rent or exchange any data.
• We do not use any data for advertising.
• We do not train any artificial intelligence model on Customers’ content or data.
• We do not keep the comments we display: they are read on request and discarded with the page (§2.5).
• We send no automated, promotional or bulk messages, and run no chatbot.
• We never publish without instruction: every post results from an explicit request by the Customer, through the interface or the API.

4. Retention periods

Keeping accounting records is a legal obligation: it survives a request for erasure, but these records are then set apart and used for that purpose only.

5. Recipients and processors

Your data is stored in the European Union. Two providers may access it from outside:

• Supabase (Singapore, United States), for technical support. These transfers are covered by the European Commission’s standard contractual clauses.
• Cloudflare (United States), for the website only: its visitors’ IP address, for the time needed to serve the page. Cloudflare is certified under the EU–U.S. Data Privacy Framework.

Social platforms are not our processors. Meta, TikTok, Google, LinkedIn and Pinterest are the recipients of the posts and independent controllers. Their own policies apply to the data once it has been sent.

Our service messages contain no personal data: they carry a link to the console, never a username, content or error message.

6. Security

• Access tokens are encrypted by the service before being stored (AES-256-GCM), with a key kept separately from the database. Access to the database alone does not allow any token to be read.
• Each Customer is isolated at database level, and this isolation is checked by internal intrusion tests.
• All communications are encrypted in transit (TLS).
• Access to tokens is logged.
• Backups are encrypted.

No system is invulnerable. In the event of a data breach likely to result in a high risk, we inform the people concerned and the CNIL (the French data protection authority) within the time limits set by Articles 33 and 34 GDPR.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability provided for by Articles 15 to 22 GDPR.

For Customers: write to privacy@diffuz.app. We reply within one month.

For end users: contact first the service through which your account was connected — it holds your identity and is the controller of this processing. You can also revoke our access directly from your account settings on the platform concerned, at any time and without going through us. This revocation makes the token unusable immediately.

The full procedure is described on the delete your data page.

You can lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

8. Cookies

No trackers, no audience measurement, no advertising pixels.

Only the cookies strictly necessary to keep an authenticated session are used. They are exempt from consent and disappear when you sign out or when they expire. That is why this site does not ask you to accept cookies. Fonts are hosted on our own servers: no request is sent to a third party when a page loads.

9. Automated decision-making

The service makes no automated decision producing legal effects concerning people, and carries out no profiling.

10. Changes

This policy may change along with the service. Any substantial change is notified to Customers by message and shown in the console at least 30 days before it takes effect. The version date appears at the top of this document.