Kredia Privacy Policy

1. Who we are and what this policy covers

Kredia (“Kredia”, “we”, “our”, or “us”) is a social media management platform that lets marketing agencies and businesses compose, schedule, approve, publish, and analyse content across connected social media accounts, including Instagram, Facebook, TikTok, YouTube, and LinkedIn. Kredia is operated by Kredia, LLC, a limited liability company registered in the State of Delaware, United States.

This Privacy Policy explains what information we handle, why, who we share it with, how long we keep it, and the choices and rights available to you. It applies to our website, dashboard, client portal, and related services (together, the “Service”). It does not cover the practices of the social media platforms themselves or any third-party websites we link to.

2. Our role: controller and processor

Kredia is used by agencies that manage social media accounts on behalf of their own clients. Our role under data-protection law depends on the data in question:

• As a controller — for the account data of the people who sign up to use Kredia (agency team members and their login details), we decide how and why that data is processed.
• As a processor — for the social media accounts, content, messages, and audience data that an agency connects and manages through Kredia, we act on the instructions of that agency, which remains the controller of that data. In those cases, the agency is responsible for having a lawful basis to use Kredia and for informing the individuals concerned.

Where we act as a processor, this policy is supplemented by the agreement between Kredia and the agency.

3. Information we collect

• Account & identity data — name and email address you provide when you register, and, if you sign in with Google, the basic profile information that sign-in returns.
• Authentication data — passwords (stored only as salted hashes, never in plain text) and session tokens.
• Connected-account data — access and refresh tokens and profile details (such as account name, username, follower counts, and profile picture) obtained from the platforms you connect, with your explicit authorization.
• Content & engagement data — posts, drafts, scheduled content, media you upload, comments, and the analytics and insights returned by the connected platforms.
• Messages — direct messages and comments from connected Instagram and Facebook business accounts, only when you access messaging features, and only to the extent needed to display and respond to them in Kredia.
• Technical data — limited log and device information (such as IP address, browser type, and timestamps) generated when you use the Service, used for security, troubleshooting, and rate-limiting.

4. How we use information and our legal bases

We use information to operate and improve the Service. Where the GDPR or similar laws apply, we rely on the legal bases noted below:

• To provide, maintain, and secure the Service, including authentication, multi-tenant access control, and publishing or scheduling content to your connected accounts — performance of a contract.
• To display analytics, insights, and engagement, and to enable you to read and reply to messages and comments — performance of a contract.
• To protect the Service against abuse, fraud, and security incidents, and to keep it reliable — legitimate interests.
• To send service-related communications, and, where required, marketing you can opt out of — legitimate interests or consent.
• To comply with legal obligations — legal obligation.

We do not use your content or connected-account data to train advertising profiles, and we do not sell it.

5. Social media platform data

When you connect a social media account, you authorize Kredia through that platform's official login (OAuth) to access specific data and perform specific actions on your behalf. We request only the permissions needed for the features you use, and you can review or revoke them at any time in the platform's own settings.

Our use of data from Meta's platforms (Instagram and Facebook) complies with the Meta Platform Terms and Meta Developer Policies. Our use of data from TikTok, from LinkedIn, and from Google services (including YouTube) complies with the respective platform developer terms and policies. We use this data only to deliver the features you have chosen, do not transfer it to data brokers, and do not retain message content beyond what is needed to display it within the Service.

6. How we share information

We do not sell or rent your personal information. We share it only in these situations:

• Connected platforms — we send and receive data to and from the social media platforms you connect, in order to publish content and retrieve insights on your behalf.
• Service providers (sub-processors) — vendors that host and operate the Service under contract, including our cloud database provider (MongoDB Atlas), our infrastructure and queue provider (DigitalOcean), and our customer-support tooling (HubSpot). These providers may process data only on our instructions.
• Within your organisation — data is visible to the members and roles of the agency or workspace that owns it, according to the permissions configured there.
• Legal and safety — where required by law, regulation, or legal process, or to protect the rights, property, or safety of Kredia, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

7. International data transfers

Kredia and its service providers may process data in countries other than the one in which you are located. Where we transfer personal data across borders, we use appropriate safeguards recognised under applicable law (such as the European Commission's Standard Contractual Clauses) to protect that data.

8. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service. When you disconnect a social media account, we remove its stored access tokens and the connection's cached data. When you delete your account, we delete or anonymise the associated personal data within a reasonable period, except where we must retain certain records to comply with legal obligations, resolve disputes, or enforce our agreements. Backups are purged on a rolling schedule.

9. Security

We apply technical and organisational measures designed to protect your information, including encryption of social media access tokens at rest, encryption of data in transit over HTTPS, scoped and tenant-isolated access controls, secret management for credentials, and restricted internal access on a need-to-know basis. No method of transmission or storage is completely secure, but we work to protect your data and to address vulnerabilities promptly. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities where required by law.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data; to restrict or object to certain processing; to withdraw consent; and to lodge a complaint with a data-protection authority. If you are a California resident, you may have rights to know, delete, and correct your personal information and to opt out of its “sale” or “sharing” — note that we do not sell or share personal information in that sense.

To exercise any of these rights, contact us using the details in Section 14. We will respond within the timeframes required by applicable law and will not discriminate against you for exercising your rights. Where Kredia acts as a processor for an agency, we will direct requests to that agency or assist it in responding.

12. Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the Service, such as keeping you signed in and securing your session. We may also use limited analytics or support tools to understand and improve how the Service is used. Where required by law, we ask for your consent before using non-essential cookies, and you can manage cookies through your browser settings.

13. Children's privacy

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children under the age required by applicable law in your jurisdiction. If you believe a child has provided us personal data, please contact us and we will take steps to delete it.

14. Contact us

For privacy questions or to exercise your rights, contact us at [email protected] or at Kredia, LLC, a limited liability company registered in the State of Delaware, United States.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service. Your continued use of the Service after an update means you accept the revised policy.