ILOVEDIGITAL privacy policy

Last updated: 29 October 2026

1. Who controls the data

iLoveDigital Unipessoal Lda. · Portuguese company number (NIPC) 514 344 342 · Rua Infanta D. Maria, Lote 30A 1.º Esq., 3030-330 Coimbra, Portugal. This is an administrative and mailing address; we do not receive visitors there.

Privacy contact: [email protected].

2. What data we process and why

2.1 Emails and contact forms

When you write to us, we process your name, email, company and the content of your message to reply and, if you ask, to prepare a proposal. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

2.2 Free Studio tests

The speed, security and AI-readability tests have their own notice: Privacy in the Studio tests.

iLoveDigital Social is a platform where you schedule and publish to your own social media accounts yourself. For your account data, ILOVEDIGITAL is the controller. For the content you publish and the data of the accounts you connect, you (or your company) are the controller and ILOVEDIGITAL is the processor, under the Data processing agreement.

2.3.1 Your account

Sign-up details: name, email, password (stored only in a transformed form that we cannot read) and the organisation name. We use them to create and manage the account, confirm your email, reset your password and send you service notices, for example when a connection to a network stops working. Legal basis: performance of the contract (Article 6(1)(b) GDPR). The email and password are required: without them you cannot create an account.
Technical security data: IP address and browser identification at sign-up, and the server’s technical logs (IP address, date and time, page requested). We use them to protect the platform, detect unauthorised access and prevent abuse that would put the connection to the networks at risk for all users. Legal basis: legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).
Bot protection: on the sign-up page we use Cloudflare Turnstile, which checks technical signals from the browser to tell people from automated programs. It is strictly necessary for the security of the sign-up you asked for, so it does not ask for consent (Article 5(2) of Portuguese Law 41/2004). Legal basis: legitimate interest in security (Article 6(1)(f) GDPR).
Platform cookies: we use a session cookie to keep you logged in. It is strictly necessary. The platform uses no analytics or advertising cookies.
Marketing: we do not send you newsletters or marketing messages without your consent. If you ask not to receive them, you will not receive them again.

2.3.2 Accounts you connect and content you publish

When you connect an account, the network itself gives us an access token that lets the platform publish to that account. We never receive that account’s password. The exception is Bluesky, which connects with an app password you create in Bluesky’s settings: we store it encrypted, and you can delete it in Bluesky at any time.

For every network we process:

the access token and, where the network provides one, the token to renew it;
the ID, public name and profile picture of the connected account, so you can see it in the platform and know where each post is going;
the content you upload: text, images, videos, chosen networks, date and time;
the status of each post: whether it went out, its link on the network and, if any, the error message;
statistics for the connected accounts, on the networks that provide them. We do not keep a history: they are requested from the network when you open the statistics page and kept in temporary memory for 1 hour at most.

We use this data only to publish what you schedule on the accounts you connected, to show you the status and statistics, and to give you support when you ask. We do not use it for advertising, we do not sell it, we do not share it with other users and we do not send it to artificial intelligence models.

Facebook and Instagram (Meta). When you connect a Facebook Page or an Instagram professional account, we access the following through Meta’s APIs: the ID, name and profile picture of each Page and account you choose to connect, and the business portfolio that lists them; the access tokens Meta issues; the posts, images, videos and first comments you publish through the platform, with the ID and link Meta returns; reach, engagement and follower statistics for the connected Pages and accounts and for the posts made through the platform. We do not access your ad accounts or ads data.

TikTok. When you connect a TikTok account, we receive from TikTok:

through the user.info.basic scope: the account ID (open_id), the display name and the profile picture, to show the connected account and the account name on the posting screen;
through the user.info.profile scope: the username (@), so you can tell accounts apart and we can build the link to the videos you publish;
the access token and the refresh token;
through the video.publish and video.upload scopes: when you open the TikTok posting screen, your account’s options (who can view, whether comments, Duet and Stitch are available, and the maximum video length), so we show you only the options TikTok allows; and, after you post, the status of the upload;
through the user.info.stats scope: your number of followers, accounts you follow, likes and videos, for the statistics page;
through the video.list scope: the list of your 20 most recent videos (ID, cover image and title) and their views, likes, comments and shares, for the statistics and to find the video you published when TikTok does not return a public link (for example, for a private video).

The platform sends the video to TikTok only after you press publish, with the options you chose. We keep the access token, ID, name, picture and username while the account stays connected, and delete them within 30 days after you delete the channel or close your account. Statistics and the video list stay in temporary memory for 1 hour at most; for the video you published through the platform, we keep only its ID and link, with the post. We delete the video file 30 days after it is published. We do not access your messages, your comments or the list of your followers. To withdraw access, see section 6.

LinkedIn. From your personal profile we receive the ID, name and photo, and the access token, which LinkedIn expires after about 60 days (after that, you connect the account again).

Bluesky. We store the service address, your handle and the app password (encrypted), and we receive the profile name and picture. Posts on Bluesky are public on the network.

YouTube. Once YouTube is available, we receive the channel ID, name and picture, and the access token. The connection uses YouTube API Services: by connecting a channel, you agree to the YouTube Terms of Service, and Google processes the data under the Google Privacy Policy.

2.3.3 Support

Support is provided by people, by email. We process what you write to us in order to reply. Only people on the ILOVEDIGITAL team access your account data, and only when needed to answer a request from you, to keep the service secure or to comply with the law.

2.3.4 Content notices

If you report content, we process your name, email and the notice to assess it and reply to you, as the Digital Services Act requires (Article 6(1)(c) GDPR).

2.3.5 Payments

During the launch the platform is free and we process no payment data. When paid plans exist, we will update this policy beforehand.

2.4 Browsing this website

On ilovedigital.eu we use analytics cookies (Google Analytics) only if you accept them in the cookie notice. If you refuse, the site keeps working without those cookies. Technical security logs rely on our legitimate interest in keeping the site secure (Article 6(1)(f) GDPR).

Hetzner Online GmbH (Germany): hosting of the servers and backups, in the European Union.
Cloudflare, Inc. (United States): security, bot protection (Turnstile) and delivery of the website and the platform.
Amazon Web Services EMEA SARL (Luxembourg): sending the platform’s emails, from the European Union region.
The social networks you connect (Meta Platforms Ireland, Google Ireland/YouTube, TikTok Technology Limited, LinkedIn Ireland, Bluesky Social PBC): they receive the content you publish through the platform. Each one processes that data as an independent controller, under its own privacy policy.
Authorities, when the law requires it.

We do not sell data.

4. Transfers outside the European Economic Area

Cloudflare and some social networks (for example Bluesky, in the United States) may process data outside the EEA. Cloudflare’s transfers are covered by the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. Publishing to a network outside the EEA happens when you choose to publish there, and follows that network’s rules. You can ask us for more information.

5. How long we keep data

Contact messages that did not lead to a contract: 12 months.
iLoveDigital Social account: for as long as you keep it. We delete the user, organisation, connections, posts and files within 30 days after you close the account.
Access tokens and profile data of connected accounts: while the account stays connected. We delete them within 30 days after you delete the channel or close your account.
Images and videos: we delete them 30 days after the post goes out or is cancelled. The post stays on the network. Library files that no post used stay while the account exists; if you delete them from the library, we delete them the next day.
Post text, date, networks and status: while the account exists. You can delete them earlier.
Network statistics: 1 hour at most, in temporary memory.
Server technical logs: 90 days.
Backups: 30 days. Data we delete can remain in them for up to 30 more days.
Support requests and content notices: 12 months after they are resolved.
Billing data, once paid plans exist: 10 years, as tax law requires.

In the platform, you can disconnect or delete a channel at any time. You can also withdraw access on the network itself:

Facebook: Settings & privacy › Settings › Business integrations (or Apps and websites) › iLoveDigital Social › Remove.
Instagram: Settings › Website permissions › Apps and websites › Remove.
TikTok: Settings and privacy › Security › Apps and services › remove iLoveDigital Social.
YouTube / Google: myaccount.google.com › Security › Third-party apps connections.
LinkedIn: Settings › Data privacy › Permitted services.
Bluesky: Settings › Privacy and security › App passwords › delete the app password you created for iLoveDigital Social.

When you withdraw access, the platform can no longer publish to that account, and we delete its access token within 30 days. The Data deletion page explains how to have us delete the rest.

7. Your rights

You can ask for access to, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interest. Where you gave consent (for example, to analytics cookies), you can withdraw it at any time, without affecting processing carried out before. Write to [email protected]. We reply within one month.

If you appear in content that a company publishes through iLoveDigital Social, that company is the controller: send your request to it. If you write to us, we pass it on and help.

We do not make decisions with legal effects based solely on automated processing. Turnstile may block a sign-up that looks automated; if that happens to you, write to us.

You can lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

8. Changes

If we change this policy, we update the date at the top. If the change affects iLoveDigital Social, we email you beforehand.

A Portuguese version of this policy is available at /pt/privacidade/.

Shared organisations

Deleting your user account does not delete the data of an organisation that still has other active members. To close a shared organisation or request deletion of its data, write to [email protected] on behalf of the organisation.