Privacy Notice
1. Data controller
SmartSocial — VAT no. 10698181210
privacy@smartsocial.it
The controller's full identification details are being published. In the meantime you can reach us at the address below.
2. What SmartSocial is
SmartSocial is a social media scheduling and publishing tool, self-hosted on a server operated directly by the controller. The service is open to registration: each user creates their own separate workspace, connects their own social channels and sees only their own data. The controller does not access other workspaces' content except for technical maintenance of the service.
3. Data we process
| Category | Data |
|---|---|
| Account | E-mail address, name, password (stored only as a hash), time zone, preferences. |
| Connected social channels | OAuth access and refresh tokens, profile id, name and picture, source platform. |
| Content | Post text, publishing dates and times, drafts, comments. |
| Uploaded files | Images and videos uploaded for publishing. |
| Statistics | Post performance metrics retrieved from the connected platforms. |
| Technical data | Server logs (IP address, timestamp, requested page, user agent). |
Uploaded files are public. Images and videos are stored under
https://smartsocial.it/uploads/… and can be reached by anyone who knows the URL, without
authentication. This is deliberate: social platforms fetch the file from that URL from their own
servers in order to publish it, and they send no cookies or credentials. Therefore
do not upload confidential material that is not meant to be published.
4. Purposes and legal bases
- Providing the service — authentication, scheduling and publishing content, retrieving statistics. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Security and diagnostics — technical logs used to detect abuse and faults. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Legal obligations — where retention is required by law. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
5. Who receives the data
We do not sell data and we do not share it for marketing purposes. Data only reaches the parties technically required to run the service:
| Recipient | What it receives | Why |
|---|---|---|
| Connected social platforms — X, LinkedIn, Meta (Facebook, Instagram, Threads), TikTok, Google (YouTube) | Post content and attached files | They are the platforms the content is published to, at your explicit request |
| OpenAI, L.L.C. | The text and instructions you enter into the AI assistance features | Assisted content generation. Data is sent only if you use those features |
| Contabo GmbH | Hosts the server and therefore, technically, all stored data | Hosting provider. The server is located in France, European Union |
Each platform is connected via OAuth: SmartSocial receives an authorisation token and never sees the password of your social account.
6. No tracking, no profiling
This site runs no third-party analytics, advertising pixels or tracking services. There are no profiling cookies. Only strictly necessary cookies are used, to keep a signed-in session alive: without them the application cannot work, which is why no consent banner is required.
7. Transfers outside the European Union
The server is in the European Union. Some recipients listed in section 5 are however based in the United States: those transfers rely on the Standard Contractual Clauses adopted by the European Commission or, where applicable, on an adequacy decision. In any case, the data sent to social platforms is the content you chose to publish.
8. How long we keep data
- Account and content: for as long as the account is active.
- Social channel tokens: until the channel is disconnected or the authorisation is revoked on the source platform; they are deleted on disconnection.
- Uploaded files: until manually deleted from the media library.
- Technical logs: a limited period, for security purposes.
9. Your rights
You may exercise the rights under Articles 15-22 GDPR at any time: access, rectification, erasure, restriction, portability and objection. You can also revoke SmartSocial's access to a social channel yourself, either from the application or from the security settings of the platform concerned.
To do so, write to privacy@smartsocial.it. If you believe the processing infringes the law, you may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali.
10. Changes
Any update to this notice is published on this page, together with a new last-updated date.