1.In short
- We only collect what we need to run Selamia.
- We never sell your data and we don't show ads.
- We never know your social media passwords: you connect through each network's official login.
- You can view, export or delete your data at any time.
2.Data controller
The data controller is [To be completed: company name], [To be completed: registered office address]. For any question about your data: [To be completed: dedicated email address, e.g. confidentialite@selamia.com].
3.The data we process
Your account
Name, email address, profile picture (if you log in with Google), password (stored in encrypted form by our authentication provider).
Your business
Your industry, your business name and details, your Brand Kit (logo, colours, fonts), your visuals, captions, uploaded media and your publishing calendar.
Your connected social networks
The profiles, pages and accounts you choose to connect, access tokens (encrypted) and the posts sent through Selamia. Details are given in the next section.
Billing
Your plan, payment history and invoices. Card details are processed directly by our payment provider: Selamia never has access to them.
Technical data
Connection logs, IP address, device and browser type, used for security and to keep the service running smoothly.
5.Why we use it
- To provide the service (creating visuals, AI, scheduling, publishing): performance of our contract.
- To invoice you and keep our accounts: legal obligations.
- To send you useful emails (confirmations, publishing reminders, alerts): performance of our contract.
- To keep Selamia secure and improve it (abuse prevention, aggregated usage statistics): legitimate interest.
- To send you news and tips: only with your consent, which you can withdraw in one click.
6.Artificial intelligence
When you use AI features, the information needed (your industry, your tone of voice, your request) is sent to our AI model provider, OpenAI, solely to generate the response (text, photo reading, images). Under its API terms, this provider does not use this data to train its models. Please avoid including sensitive information about your customers.
7.Who can access it
Your data is only accessible to authorised members of our team and to the people you invite to your workspace. We work with carefully selected subprocessors:
- Application hosting: [To be completed: host name]
- Database, files and authentication: Supabase
- Payments: Stripe
- Artificial intelligence: OpenAI
- Transactional emails: Resend
- Social networks (Meta, LinkedIn…): only to publish what you've scheduled
[To be completed: check the final list of subprocessors before launch]
8.Transfers outside the European Union
Some of our providers are located outside the European Union, notably in the United States. These transfers are covered by appropriate safeguards: an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
9.How long we keep it
- Account data and content: for as long as your account exists, then deleted within 30 days of closing it.
- Invoices and accounting records: 10 years, as required by the French Commercial Code.
- Technical logs: 12 months maximum.
- Social network access tokens: deleted as soon as you disconnect an account.
10.Your rights
Under the GDPR and the French Data Protection Act, you have the right to access, correct, delete, restrict and port your data, to object to its processing, and to set instructions for what happens to your data after your death.
You can delete your account and all your data yourself, at any time: see how to delete your data. To exercise your other rights, email us at [To be completed: dedicated email address]. We'll reply within one month at most. If you believe your rights haven't been respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
11.Security
All traffic is encrypted (HTTPS), your network access tokens are encrypted in our database, and access to data is limited to the people who need it. No system is infallible: if an incident affects your data, we'll let you know within the legal deadlines.
13.Changes
We may update this policy. If we make a significant change, we'll let you know by email or in the app before it takes effect. The French version of this policy is the reference version.
4.Data from your social networks
When you connect a Facebook, Instagram, LinkedIn or other account, you authorise Selamia through that network's official window. We never receive your password, and we only use this access for the features you trigger: publishing, scheduling and showing how your posts perform.
What we receive and store
We don't read your private messages, we never publish without an action from you (an immediate or scheduled post you created), and we never sell any of this data. It isn't used for advertising or to train AI models.
How long we keep it
How to disconnect a network
To delete all your data, follow our guide on deleting your data.