Privacy Policy

This policy explains what personal data etouch Social Scheduler (social.etouch.co) processes, why, and what rights you have. The service is operated by ETOUCH IKE ("ETOUCH", "we"), VAT 801034328, Neochoriou 66, Vyronas, Athens, Greece.

1. Who is responsible

ETOUCH is the controller for the accounts of the people who use the service. For the content and social media accounts of our clients, ETOUCH processes data on behalf of each client, under our agreement with that client.

2. Data we process

• User accounts: name, email address, password (stored only as a one-way hash), role, and the client the user belongs to.
• Activity: posts created, approvals, change requests and comments, with the user and time, so the history of each post is clear.
• Content: the images, videos and captions prepared for publishing.
• Technical data: a session cookie and a security (CSRF) cookie, needed to stay logged in. We use no advertising or tracking cookies.

3. Data from connected platforms

When a client connects a social media account, we receive only what we need to publish its content and show its statistics.

TikTok. Through TikTok's official APIs (Login Kit and Content Posting API), with the permissions the account owner grants when connecting:

• basic profile information: TikTok user ID (open_id), display name and profile picture (user.info.basic);
• public profile details: username, profile link, bio and verification status (user.info.profile);
• account statistics: follower, following, like and video counts (user.info.stats);
• the account's videos and their public statistics: views, likes, comments and shares (video.list);
• permission to publish the videos and photos approved in the service to the account (video.publish, video.upload);
• the access and refresh tokens TikTok issues for these permissions.

We use TikTok data only to publish the client's approved content, show its statistics to the client and to ETOUCH, and prepare its monthly report. We do not use it for advertising, we do not sell it, and we do not share it with anyone other than the client it belongs to.

Instagram and Facebook (Meta). Through Meta's Graph API: the account or Page name, ID and picture, the published posts and their statistics, and aggregated audience data (age groups, gender, cities, countries) that Meta provides for business accounts.

4. Why and on what legal basis

• To provide the service to our clients: performance of our contract (GDPR art. 6(1)(b)).
• To keep the service secure and keep a history of approvals: our legitimate interest (art. 6(1)(f)).
• To send the emails the service needs (approval requests, reminders, monthly reports): performance of the contract.

5. Security

• The connection is encrypted (HTTPS).
• Access tokens of connected platforms are stored encrypted and are never shown to users or written to logs.
• Each client user can access only its own client's data.

6. Who receives data

Only the platforms we publish to (Meta, TikTok), when we publish or read statistics on the client's behalf, and the email provider that delivers our notifications. These providers may process data outside the European Union under their own safeguards. We do not sell or rent personal data.

7. How long we keep it

• User accounts and post history: for as long as the cooperation with the client lasts.
• Platform tokens: until the account is disconnected, when they are deleted.
• When a cooperation ends, or on request, we delete the client's data within 30 days, except what the law requires us to keep.

8. Disconnecting and deleting

You can stop our access to a TikTok account at any time from TikTok (Settings and privacy → Security → Manage app permissions), and to Instagram or Facebook from Meta's Business Settings. You can also ask us at info@etouch.co to disconnect an account and delete the data we received from it.

9. Your rights

You have the right to access, correct, delete, restrict and port your data and to object to its processing. Write to info@etouch.co. You may also complain to the Hellenic Data Protection Authority (www.dpa.gr).

10. Changes

We may update this policy; the date above shows the latest version. Our use of TikTok data also follows the TikTok Developer Guidelines.