Privacy Policy

Who we are

Campflows is a platform for marketing agencies. This policy explains what data we process, why and on what legal basis, whether you are a member of an agency that uses Campflows or a client of one of those agencies.

Data controller: Anna Caroline Tamaio, a self-employed professional trading as Campflows and Caju Social Club. NIE (Spanish foreigner ID) Z3120317G. Address: Avda. Isabel de Valois 28, Bloque C, Esc. 2, Planta 4, Pta. 6, 28050 Madrid, Spain. Email: support@campflows.app.

What data we process

Account data: the name, email address and language of the people who work at an agency. If you sign in with Google, we receive your name, email address and profile picture.

Data about the agency's clients: the client's name, contacts, brand profile, competitors, contracted services and leads. The agency enters this data and is responsible for it.

Meta data (Facebook and Instagram): when a client or their agency connects an Instagram professional account (with Instagram Login or with Facebook Login for Business), we receive the account's ID, username, profile picture, bio, website and number of followers and posts; its posts (text, images, type, link and date) and their metrics (reach, views, interactions and followers); and, if it is connected through Facebook, the ID and name of the linked Facebook Page. We only publish to Instagram the posts the agency has approved, when it clicks Publish or on the date it schedules.

Instagram direct messages: if the agency measures a client's messages and the account holder authorizes it when connecting the account with Instagram Login, we read its conversations at that moment, once a day and whenever the agency syncs, to count how many messages it receives, how many it answers and how long it takes to answer. For the messages it receives, we keep the text, the date and the sender's username for up to 30 days, to show the agency examples; for the messages the account sends, only the date. Only the agency's members see them, not the agency's clients. We do not send, answer or automate messages.

Meta ads data: if the agency connects a client's ad accounts, we read their name, the business portfolio they belong to and their campaigns with their metrics (spend, reach, impressions, clicks and results). We do not create, change or pause ads.

Public Instagram profiles: with Campflows' own Instagram account and Meta's Business Discovery feature, we read the public data (username, bio, followers and recent posts with their public metrics) of professional accounts the agency names, such as its clients or its clients' competitors. Only professional accounts are read, and only what is already public.

TikTok data: when a client or their agency connects a TikTok account, we receive the account's ID, display name, username, profile picture, number of followers, following, likes and videos, and the list of its public videos with their views, likes, comments and shares. If the agency publishes to TikTok from Campflows, we check the account's privacy options and limits, and we send the account the video or photos, the caption and the posting settings (privacy, interactions, commercial content disclosure and AI-generated content) of the Post the agency has approved, when it clicks Publish or on the date it schedules. We do not change or delete any post on the account.

LinkedIn data: when a client or their agency connects a LinkedIn company page or profile, we receive the ID, name and logo or photo of the page or profile, its posts and its statistics (impressions, clicks, reactions, comments, shares and follower growth). We only publish to LinkedIn the content the agency prepares and schedules in Campflows.

YouTube data: when a client or their agency connects a YouTube channel, we receive the channel's ID, name, handle, image and subscriber count; and, to measure it, the list of its videos and the metrics of the channel and of each video (views, watch time, likes, comments, shares and subscribers gained and lost). If the agency publishes a Short from Campflows, we upload to the channel the video, title, description and visibility of the post the agency has approved, when it clicks Publish or on the date it schedules. We do not modify or delete any video on the channel.

Google Drive data: each agency member can connect their own Google Drive to bring photos and videos into a post. With the drive.file permission, Campflows can only open the files that person picks in the Google Picker, never the rest of their Drive. We store the email of the Google account that connected it, the connection date, its tokens (encrypted) and, for each client, the folder of the last pick, to open the Picker there. Each file you pick is copied into the post as one of its images or videos.

Campflows connector for Claude and ChatGPT: if an agency member connects Campflows to their Claude (Anthropic) or ChatGPT (OpenAI) account, we store the connection (the chosen agency, the connected assistant and the dates it was created and last used) and a hash of its credentials, never the credentials in plain text. The assistant receives the data of that agency it requests with its tools (clients, brand profile and posts) and can save posts and a client's brand profile. What you write in the assistant is processed by Anthropic or OpenAI under their own policies.

Technical data: access and error logs, with the screen where they happen, which we need to run the service. We always record them, even if you do not accept usage data. Server errors are linked to your account ID; browser errors are not identified, unless you accept usage data.

Usage data, only if you accept: if you work at an agency, the first time you enter Campflows we ask whether we may measure which screens and features you use and how long they take to load, linked to your user ID and your agency, never to your email or your name. If you accept, we also record some sessions with all text, fields and images hidden: they show where people click and how the screen changes, not what it says. If you do not accept, or you close the notice without answering, we do not measure or record anything. We do not measure or record the agencies' clients (client portal, review links, reports and proposals) or Campflows' demo accounts. We never send the clients' content.

What we use it for

To provide the service: showing the agency the performance of the connected accounts and of its campaigns, planning and publishing the content it approves, generating reports and managing its relationship with its clients.

For the AI features (copy, brand profile, analysis, reports and narration): we send the AI provider only the content needed for that task, such as the client's brand profile, the text of a post or the metrics of a report.

For the security and maintenance of the platform.

To fix errors: knowing what fails, where and for whom. The legal basis is our legitimate interest in keeping the service running (Article 6(1)(f) GDPR), which we have weighed against your rights: we do not send your clients' content, we do not store anything on your device and, without this log, the service would fail without anyone knowing.

To improve Campflows with usage data: seeing which screens and features are used, where someone gets stuck and which screens load slowly. The legal basis is your consent (Article 6(1)(a) GDPR and Article 22(2) of the Spanish LSSI). We store your answer and its date, and you can withdraw it at any time in Settings, as easily as you gave it.

We do not sell data or use it for advertising. We do not use Meta, TikTok, LinkedIn, YouTube or Google Drive data to train artificial intelligence models.

Meta Platform data

Access to Facebook and Instagram goes through Meta's API (Instagram Login and Facebook Login for Business) with the express authorization of the account holder. Access tokens are stored encrypted and are only used to read the authorized data and publish the posts the agency approves.

You can revoke access at any time from Campflows (Social → Disconnect), from your Facebook account settings (Settings → Business integrations) or from Instagram's settings (Apps and websites). When you disconnect, we delete the token immediately. If you remove Campflows from Facebook or Instagram, Meta notifies us and we disconnect the account; if you also request deletion of your data, we delete it and give you a confirmation code.

We comply with the Meta Platform Terms and its Developer Policies.

TikTok data

Access to TikTok goes through TikTok for Developers' Login Kit, Display API and Content Posting API, with the express authorization of the account holder and only with the permissions to read the profile and the list of videos and to post content. Tokens are stored encrypted and are only used to read the authorized data and to publish the Posts the agency has approved.

You can revoke access at any time from Campflows (Social → Disconnect) or from the TikTok app (Settings and privacy → Security and permissions → App permissions). When you disconnect, we delete the token immediately.

We comply with the TikTok for Developers Terms of Service and its data use guidelines. We do not use TikTok data to train artificial intelligence models.

LinkedIn data

Access to LinkedIn goes through the Community Management API, with the express authorization of the profile owner or a page administrator, and only with the permissions that authorization grants: reading the profile or page, reading its statistics and posting on its behalf. Tokens are stored encrypted and are only used for those tasks.

Campflows only publishes to LinkedIn the content the agency has prepared, on the date it chooses. It does not send messages or comment, react or share on anyone's behalf.

We keep LinkedIn data only as long as its terms allow: a page's statistics, up to one year; its posts, up to six months; and the content of a personal profile, 48 hours.

You can revoke access at any time from Campflows (Social → Disconnect) or from LinkedIn's settings (Data privacy → Permitted services). When you disconnect, we immediately delete the token and the data read from that account; reports already generated keep their figures within the periods above. If you request deletion, we delete everything within 10 days at most.

We comply with the LinkedIn API Terms of Use and the LinkedIn Marketing API Program terms. We do not use LinkedIn data to train artificial intelligence models.

YouTube data

Campflows uses the YouTube API Services (YouTube Data API and YouTube Analytics API) to read the channel a client or their agency connects and, if the agency publishes Shorts from Campflows, to upload them. It does so with the express authorization of the channel owner or of its Brand Account, with read permissions and, to publish, with the permission to upload videos (youtube.upload), never with the permission to manage the channel. By connecting a channel you agree to the YouTube Terms of Service. Google processes your account data under the Google Privacy Policy.

The access token is stored encrypted and is only used to read the data of the authorized channel and upload the Shorts the agency publishes. Each Short goes out with the visibility chosen in the post and with what the agency declares about whether it is made for kids; after uploading it, Campflows does not change or delete it, and it is managed from YouTube Studio. The channel's data is only seen by the agency that connected it, in Campflows and in the reports it shares with its client. While you connect the channel, we use a technical cookie in your browser to check that the return from Google is yours, and we delete it when the connection finishes.

We read the channel when it is connected and then once a day. On each read we update the name, the image and the titles and thumbnails of its videos, and we delete from Campflows the videos that have been deleted or are no longer public on YouTube. The reports the agency generates store the channel's figures and, for its best-performing videos, their figures, link, publication date and whether they are Shorts; they do not store the channel's name or the videos' titles or thumbnails. They only keep that data while the channel is connected: when the channel's data is deleted, it is also deleted from the reports, along with their audio summary if they have one.

You can revoke access at any time from Campflows (Social → Disconnect) or from your Google Account permissions page (myaccount.google.com/permissions). When you disconnect from Campflows, we immediately delete the token and the channel’s data, and we revoke access in Google unless the same channel is still connected to another client in Campflows; the channel’s figures in reports are deleted within 7 days at most. If you remove access from your Google Account, we detect it on the next daily read: the channel is marked as expired in Campflows and, if nobody reconnects it, we delete its token, figures and videos, also from reports, within 7 days at most. We also check at least every 30 days that the authorization is still valid and, if we cannot verify it, we do the same. You can also write to us at support@campflows.app and we will delete it within 7 days at most.

We comply with the YouTube API Services Developer Policies and the Google API Services User Data Policy, including its Limited Use requirements. We do not use YouTube data to train artificial intelligence models.

Google Drive data

Access to Google Drive goes through the Google Drive API and the Google Picker, with the express authorization of the person who connects it and only with the drive.file permission, so Campflows can only open the files that person picks. Each member connects their own Drive; nobody else in the agency can use that connection.

When you pick a file, your browser downloads it with a short-lived access token for your connection and uploads a copy to the post. That copy is part of the post, like any other file uploaded to it: the agency sees it, and so does its client if the agency shares the post with them; it is kept while the post exists and is deleted with the post or when the agency is closed. Campflows does not read your Drive in the background and does not create, modify or delete files in it.

You can revoke access at any time from Campflows (Settings → Google Drive → Disconnect Google Drive) or from your Google Account permissions page (myaccount.google.com/permissions). When you disconnect from Campflows, we revoke access in Google and delete your tokens immediately. The files you already brought into posts stay in them.

We comply with the Google API Services User Data Policy, including its Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, such as Google Drive, adheres to that policy, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

Who we share data with

Providers we need to operate: Supabase (database and authentication), Vercel (hosting and AI Gateway), Google (sign-in, Google Drive, YouTube API and Gemini models), Meta (Facebook and Instagram API), TikTok (Login Kit, Display API and Content Posting API), LinkedIn (Community Management API), Brevo (transactional email), PostHog (errors, usage analytics and session recordings with the content hidden, hosted in the EU, Frankfurt) and Canva (when the agency sends a design to its Canva account). Each one acts under its own data processing terms.

AI providers: the AI features use models from Google, Anthropic, OpenAI or Groq through Vercel AI Gateway, or directly with the key the agency sets up. They receive only the content of each task.

We do not share data with third parties for other purposes. We will only hand it over to an authority when the law requires it.

How we protect your data

We protect all the data we process, including Google user data (Google Sign-In, Google Drive and YouTube) and sensitive data such as access tokens and the data of connected accounts, with these technical and organizational measures.

Encryption in transit: Campflows is only served over HTTPS (TLS), with HTTP redirected to HTTPS and HSTS enabled. Our servers only talk to Google, Meta, TikTok, LinkedIn and our other providers over HTTPS.

Encryption at rest: the database and stored files are hosted on Supabase and encrypted at rest with AES-256.

Tokens and keys in a vault: the access and refresh tokens of connected accounts (Google Drive, YouTube, Facebook, Instagram, TikTok, LinkedIn and Canva) and the AI keys agencies set up are stored encrypted in Supabase Vault, apart from the rest of the data. Only our server can read them, at the moment it needs them, and they are never shown in Campflows. The only token that reaches the browser is a short-lived Google Drive access token, for the person who connected it, to open the Google Picker and download the files they pick. When an account is disconnected, its token is deleted.

Isolation between agencies: the database applies row-level security to every table, so each person only reaches the data of the agencies they belong to, and an agency's clients only see what the agency shares with them. Automated tests check these rules on every change.

Least privilege: we only request the permissions each feature needs. Google Drive uses the drive.file permission, which only gives access to the files you pick in Campflows; YouTube is read-only, except for uploading the Shorts the agency publishes.

Restricted access: the platform's secret keys are only on the server, in our hosting provider's protected settings. Only the Campflows staff who operate the service can enter the administration panel, always with two-step verification, and they only access an agency's data when needed to give support, fix a problem or comply with the law.

Your account: passwords are stored with a one-way hash, never in plain text. If you sign in with Google, Campflows does not receive your Google password.

Incidents: we log errors to detect failures. If a security breach affects personal data, we will notify the Spanish Data Protection Agency within 72 hours and the affected people without undue delay, as the GDPR requires.

How long we keep it

For as long as the agency keeps its account active. The metrics of a connected account are kept while the account remains connected and for up to 30 days after it is disconnected (10 days for LinkedIn, with the limits in its section, and 7 for YouTube, also in reports), unless deletion is requested earlier.

The text and usernames of Instagram direct messages, 30 days at most. They are deleted when the account is disconnected and, if it is no longer authorized or is reconnected without the messages permission, within one day at most. Of those messages, only the daily figures remain, like the other metrics.

Connections with Claude or ChatGPT expire after 90 days without use; you can also revoke them at any time from Settings.

When an agency is closed, all its data is deleted within 30 days at most.

Usage data is kept for one year and session recordings for 30 days.

Your rights

You can access, rectify, erase, restrict or object to the processing of your data, and request its portability. If you are a client of an agency, you can contact the agency or us directly.

Write to us at support@campflows.app. We will answer within 30 days at most. You can also file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

To withdraw your consent to usage measurement, go to Settings and turn off “Send usage data” in the Usage data section. From that moment we do not send page views, events or recordings of you from that tab or from the others open in the same browser. In other browsers and devices it stops when you return to a Campflows tab, or within a few minutes at most. Errors are still recorded so we can fix them; to object to that log, write to us.

How to delete your data

If you connected a Facebook, Instagram, TikTok or LinkedIn account, or a YouTube channel: go to Campflows, open the client, Social tab, and click Disconnect. The token and the data read from that account are deleted.

If you connected your Google Drive: in Settings → Google Drive, click Disconnect Google Drive. Google removes the access and we delete your tokens.

If you want to delete your Campflows account or all your agency's data, or if you are a client of an agency and want us to delete what we hold about you: send an email to support@campflows.app with the subject “Data deletion”, stating the affected email or account. We will confirm the deletion within 30 days at most.

When you ask us to delete your account, we also delete your usage data and session recordings in PostHog. If you only want to delete your usage data, turn off “Send usage data” in Settings and click “Delete sent data” (once a day), or request it by the same email: we stop sending it and delete it within 30 days at most. That deletion includes the errors linked to your account ID.

Changes to this policy

If we change this policy in a material way, we will notify agencies with an active account by email and update the date on this page.