Privacy policy

Controller

E-Mail: Show email

MADE-WITH.AI LTD 26 Anthipolochagou Georgiou M.Savva, Shop 1-2, 8201 Paphos, Cyprus

Access data / server logs

When you visit this website, the server processes technically necessary data (IP address, date/time, requested page, user agent) to deliver and secure the service (Art. 6(1)(f) GDPR). Log data is deleted after a short period.

Login & customer accounts

For suite customers we process email address, name, role and login timestamps to perform the contract (Art. 6(1)(b) GDPR). Passwords are stored exclusively as salted hashes (scrypt). Sessions use an httpOnly cookie and expire after 7 days at the latest.

Customer data in the suite

Content customers create in the suite (strategies, audiences, posts, media references) is processed solely to provide the service and stored with tenant separation. A data processing agreement is available on request (Art. 28 GDPR).

Technical infrastructure

This suite runs on our own, self-operated server infrastructure. All tenant and usage data (clients, user accounts, strategies, audiences, posts, approvals, activity log) is stored in a self-hosted database (Baserow, our own instance at baserow.made-with.ai) on our server in Germany, not with a third-party provider. Which AI services the suite uses and which data they receive is described in the section "AI in the suite". On request we conclude a data processing agreement with you under Art. 28 GDPR.

AI in the suite

The suite uses artificial intelligence to create texts, images, voices and videos for social media posts. Most of this work runs on our own servers. We call external services only where our own systems are not enough. Texts: Captions, slide texts and voiceover scripts are written by a language model (Gemma) on our own server (Ollama). This content does not leave our infrastructure. Brainstorming and website analysis: For the idea chat and the analysis of your website we use the language model Gemini by Google Ireland Limited, operated in data centers in the EU. Access runs through the EU endpoint of Eden AI SAS, 10 rue de Penthièvre, 75008 Paris, France, as processor under Art. 28 GDPR. We send your company's strategy, offers and audiences, your chat messages and publicly available content of your website. This endpoint technically rejects requests to models outside the EU. Images: We create and edit images for posts with a Gemini image model (Google Ireland Limited), also through the EU endpoint of Eden AI. We send an image description that is derived from the content of the post; when editing, also the selected image. Creative studio: For drafts, changes and suggestions in the creative studio we send your prompts, your company's offer and strategy data and small previews of the selected images to Gemini through the EU endpoint of Eden AI, and image editing and generation also run through Eden AI in the EU. Voice: Voiceovers for videos are generated by Piper on our own server. Avatar videos: Only when you explicitly order a video with an avatar do we send the avatar image, the script and the voice audio track to HeyGen Technology Inc., USA. The transfer to the USA is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). Anyone who uploads a face as an avatar needs the consent of the person shown. The providers do not use the transmitted data to train their models. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). Please do not enter personal data of your customers into these inputs.

Publishing on social media platforms

When you connect an account on a platform (Meta with Facebook and Instagram, LinkedIn, TikTok, Google with YouTube, Pinterest or X), we store the access credentials encrypted on our server. With them the suite publishes your approved posts through the platform's official interfaces and retrieves metrics such as reach and likes. Without a connected account we send nothing to the platform. Processing on the platform itself is governed by its own privacy policy. You can disconnect at any time. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

Files and media

Uploaded files (photos, videos, logos, music, avatar images) and the images, videos and PDFs created by the suite are stored in our Baserow database on our own server in Germany. The files have public but unguessable addresses. This is necessary because the platforms fetch the files from this address themselves when publishing. Anyone who does not know the address cannot find the file. So please upload only files that are meant for posts.

Tracking links and results

Posts contain a short link of the suite (social-marketingsuite.com/r/...). When someone clicks it, we forward them to the target right away and count the click. We store the time, the post, the referring site (only the domain name, e.g. linkedin.com) and the type of browser (e.g. Chrome or Instagram app). We do not store the IP address or the full browser identifier, and no profile of the person is created. We add UTM parameters to the target address (platform, topic, number of the post). This lets the company see in its own statistics where a visit came from. The legal basis is the legitimate interest of our customers and our own interest in measuring the success of posts (Art. 6(1)(f) GDPR).

Results from our customers' websites

Companies using the suite can report results from their own website to us, such as an inquiry, a sign-up or a purchase. This works through an interface or through an invisible counting pixel. What is reported is the type of result, the related post, optionally a value (e.g. the order value) and a source. The interface has no fields for names, email addresses or other details of visitors. With the counting pixel we do not store the IP address either. The company in question is responsible for the use on its website; we process this data on its behalf (Art. 28 GDPR).

Emails from the suite

For password resets and invitations to a team we send emails via Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France. Mailjet processes the data in the EU on our behalf. For this we transmit the email address, the name and the text of the email with a link. The link is valid for one hour (password) or seven days (invitation). It contains a random code of which we store only an irreversible fingerprint (hash). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Contact by form or email

E-Mail: Show email

When you write to us through the contact form or by email, we process your details (name, email address, message) to handle the request (Art. 6(1)(b) or (f) GDPR). Messages from the form are sent via Mailjet, provided by Mailjet SAS, 13-13 bis rue de l'Aubrac, 75012 Paris, France. Mailjet processes the data in the EU on our behalf. We delete inquiries once they are settled and no retention duty applies.

Cookies & tracking

This website uses no advertising cookies and no third-party tracking. We only set technically necessary cookies: the session after login and the cookie smt. Your choice between light and dark design is remembered by your browser itself. We set the cookie smt only when you reach our website through a short link from a post by social-marketingsuite.com itself. It contains only the code of that link and lasts 30 days. If you send an inquiry through our contact form during that time, we count it as a result of that post. We store nothing more: we do not link the result to your details from the form and we build no profile (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15-21 GDPR), as well as the right to lodge a complaint with a supervisory authority.