Privacy Policy

1. Data controller

This policy describes how Perroly (“we”) collects, uses and protects your personal data when you use the platform. Perroly is published by Thibaut Lafforgue, sole proprietor (micro-entrepreneur) — SIRET 934 396 508 00012 — Impasse Saint Etienne, 06480 La Colle sur Loup, France.

For any question about data protection, exercising your rights or deleting your data: admin@perroly.com.

2. Data we collect

We only collect the data required for the Service to work:

• Account data — email address, name, password (hashed, never stored in plain text).
• Social network connection data — access tokens provided by Instagram, Facebook, LinkedIn, TikTok and YouTube when you connect your accounts. These tokens are encrypted at rest (AES-256-GCM) and are never readable in plain text in our database.
• Content and messages — scheduled posts, messages received on your connected accounts (to give you a complete history), comments and related media.
• Statistical data — audience and performance metrics provided by the official interfaces of the connected platforms.
• Technical data — connection logs and information required for the security of the Service (IP address, device type).

3. Purposes and legal bases

Your data is processed to: (a) provide the Service (account management, platform connections, publishing, messaging, statistics) — performance of the contract; (b) secure the platform and prevent fraud — legitimate interest; (c) improve the Service and send you information about it — legitimate interest or consent; (d) comply with our legal and tax obligations.

Your data is not used for any other purpose, and is never sold.

4. Integrations with social platforms

By connecting a social account, you authorize Perroly to access, through each platform’s official interfaces (APIs), the data necessary for the actions you request: reading statistics, publishing content, receiving and sending messages. You remain the owner of your data and can disconnect a platform at any time from your “Accounts” area, which deletes the related access tokens.

4.1 Meta data (Instagram and Facebook)

When you connect an Instagram account or a Facebook Page, Perroly accesses the professional account information (name, ID, picture), published content and its statistics, as well as received messages and comments, for the sole purpose of providing the publishing, unified inbox, automation and analytics features you enable.

This data is never resold or shared with third parties, apart from essential technical processors and cases where the law requires it. It is processed in accordance with Meta’s platform policies.

4.2 Google data (YouTube)

Connecting a Google account provides access to authentication information and to the data of your YouTube channel necessary for the features offered (account connection, then publishing and statistics when available). You can revoke this access at any time from your “Accounts” area or from your Google account security settings.

Perroly’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: this data is only used to provide Perroly’s user-facing features, is never used for advertising purposes and is never sold.

4.3 LinkedIn and TikTok data

Connecting a LinkedIn or TikTok account allows Perroly to publish content on your behalf (profile or Company Page for LinkedIn) and to access the basic account information strictly necessary for that publishing. No other data is collected from these platforms.

5. Data sharing

Your data is never sold. It is only shared with: the social platforms you connect (Meta, LinkedIn, TikTok, Google/YouTube), strictly as needed for the actions you request; our technical processors (hosting, database, media storage, payment), bound by GDPR-compliant confidentiality commitments.

6. Data retention

Data is kept for the lifetime of your account, then archived for as long as strictly necessary to meet our legal and tax obligations. When you delete your account or disconnect a social network, the access tokens and related data are deleted within a maximum of 30 days, unless a legal obligation requires otherwise.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase (“right to be forgotten”), restrict, object to and port your data, as well as the right to withdraw your consent at any time. You can exercise these rights by writing to admin@perroly.com, or request the deletion of data linked to a social network directly from your “Accounts” area. You may also lodge a complaint with your supervisory authority (in France, the CNIL — cnil.fr).

8. Security

We implement appropriate technical and organizational measures: encryption of access tokens at rest (AES-256-GCM), encryption in transit (HTTPS/TLS), password hashing, cryptographic verification of incoming platform notifications, GDPR-compliant hosting within the European Union and access segregation.

9. Cookies

The Service only uses cookies strictly necessary for authentication and for the platform to function. No advertising or third-party tracking cookies are set.

10. Changes

This policy may be updated to reflect changes in the Service or in regulations. In the event of a substantial change, you will be informed by email or through the platform.