Privacy Policy

The data controller is DIGISPARK S.R.L., Via Bianca Ceva 6, 20152 Milano (MI), Italy, VAT 14554820960. For any question or request about personal data, write to [email protected] or to the certified email [email protected]. The same addresses are the contact point for data protection matters.

The Service is used only by Digispark operators, who sign in with an account created for them. The social media accounts connected to it belong to Digispark or to its apps (for example the official Memet accounts). The Service is not offered to the public and does not process data of people who follow or watch those accounts.

Operator accounts. Name, email address, a hash of the password, and session data (IP address and browser user agent) used to keep the operator signed in.

Connected platform accounts. When an account owner connects an account through the platform's own login screen, we receive and store:

• the platform identifier of the account (TikTok open_id, Instagram professional account ID, Facebook Page ID and the ID of the Facebook user who connected it, YouTube channel ID);
• its username or display name and the address of its profile picture;
• the OAuth access token and, where the platform issues one, the refresh token, together with the granted permissions and their expiry dates. Tokens are encrypted with AES-256-GCM before they are stored and are never shown in the interface or sent anywhere other than the platform that issued them.

Content and publishing records. The video files, captions, hashtags, titles, schedule and per-platform settings of each post, the operator who approved it, and the responses of the platforms (post IDs, links, processing status and error messages).

Technical logs. Server logs with IP addresses and request details, needed to run and secure the Service.

We use the data only to:

• show the operator which account each video will be posted to;
• publish the videos the operator approved, at the time they chose;
• show the status of each post and alert the team when something fails;
• keep the Service secure and fix problems.

We do not use the data for advertising, we do not sell or rent it, we do not build profiles of people, and we do not use it to train artificial intelligence models. We do not read followers, messages, comments or analytics of the connected accounts.

Legal basis: the processing is necessary for the legitimate interest of DIGISPARK S.R.L. in publishing content on its own accounts (Article 6(1)(f) GDPR), and for operator accounts, for the performance of the working relationship with the operator.

The Service uses TikTok Login Kit and the TikTok Content Posting API with the permissions user.info.basic (to show the account name and picture) and video.publish (to post the approved video). Before each post the Service reads the current creator information from TikTok (nickname, available privacy options, interaction settings and maximum video length) so that the operator chooses the privacy level and the interaction settings on the post itself.

You can revoke access from the TikTok app under Settings and privacy, Security and permissions, Apps and services, or by disconnecting the account in the Service. See also the TikTok Privacy Policy.

The Service uses Facebook Login for Business and the Instagram Graph API and Facebook Pages API with the permissions pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish and business_management. They are used to list the Pages and Instagram professional accounts the person who logs in manages, to let the operator choose the one to connect, and to publish approved Reels to it.

You can remove the Service from Facebook under Settings and privacy, Settings, Business integrations, or from Instagram under Settings, Apps and websites. When you do, Meta notifies us and we delete the connected accounts and their tokens automatically. Instructions are also on our data deletion page. See also the Meta Privacy Policy.

The Service uses YouTube API Services. It asks Google for the scopes youtube.upload (to upload the approved videos as YouTube Shorts) and youtube.readonly (to show the name of the connected channel). By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google processes data according to the Google Privacy Policy.

You can revoke the Service's access to your Google account at any time from the Google security settings page at https://security.google.com/settings/security/permissions, in addition to disconnecting the channel in the Service.

Digispark Publisher's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Channel data stored by the Service (channel name and picture) is refreshed or deleted at least every 30 days.

Videos and captions are sent to the platform each post is meant for, at the time of publishing. The Service runs on servers rented from Hetzner Online GmbH (Gunzenhausen, Germany), which
acts as a data processor. We do not share data with anyone else, except where the law requires it.

• Tokens and profile data of a connected account: until the account is disconnected, or until the platform reports the access as revoked or expired. Disconnecting deletes them immediately. An account whose access cannot be renewed is deleted within 30 days.
• Video files: deleted 30 days after the last post that uses them has been published or cancelled.
• Publishing records (captions, schedule, status, platform links): kept while the app they belong to is active, so the team has a history of what was posted, and deleted on request.
• Operator accounts: until the operator leaves the team.
• Technical logs: for the time needed to secure and operate the Service.

Any connected account can be disconnected from the Service at any time: its tokens and profile data are deleted immediately and access is revoked with the platform where the platform allows it. You can also revoke access from the platform's own settings, as described above for each platform.

To ask us to delete any other data, write to [email protected]. We complete deletion requests within 7 days. Deleting data from the Service does not delete videos already published on TikTok, Instagram, Facebook or YouTube: those can be removed from the platform itself.

Access to the Service requires an operator account. Traffic is encrypted with HTTPS, tokens are encrypted at rest, the database is not reachable from the internet, and video files are only reachable through signed links that expire after a few hours.

The Service sets only a strictly necessary session cookie when an operator signs in. It uses no analytics, advertising or tracking cookies.

Under Regulation (EU) 2016/679 (GDPR) you can ask for access to your data, its rectification or erasure, the restriction of processing, data portability, and you can object to the processing, by writing to the contacts above. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

If we change how the Service handles data, we update this page and the date at the top. Material changes are communicated to the operators before they take effect.