Privacy Policy

Under the GDPR and other applicable data protection laws, we process your personal data on the following legal bases:

• Consent: For analytics cookies and optional data collection. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Performance of a Contract: Processing necessary to deliver the Service you have signed up for, including account management, content publishing, and social media integration.
• Legitimate Interest: For platform security, fraud prevention, abuse detection, and improving the Service. We balance our interests against your rights and freedoms and only rely on this basis where the impact on you is minimal.
• Legal Obligation: Where we are required to process your data to comply with applicable laws or regulations.

We use the collected information to:

• Provide, operate, and maintain the Shaflex Service
• Authenticate your identity and manage your account
• Publish and schedule content to your connected social media accounts
• Display analytics and engagement data from your connected platforms
• Improve features, performance, and user experience
• Communicate with you about your account, updates, and support requests
• Ensure platform security, prevent abuse, and detect fraud
• Comply with legal obligations and enforce our Terms of Service

We may share your information with the following categories of service providers, solely for the purposes of operating and improving the Service:

• Hosting: Vercel, for website and application hosting
• Analytics: PostHog, for anonymized usage analytics
• Email: Resend, for transactional and account-related emails
• Database: Secure cloud database providers for data storage and authentication
• Payments: Processed through third-party payment providers for subscription and billing management

We require all service providers to process your data only on our instructions and in accordance with applicable data protection laws. We may also share information when required by law, in response to valid legal process, or to protect the rights, property, or safety of Shaflex and its users.

We do not sell or share personal data for advertising purposes.

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy. Specific retention periods are as follows:

• Account data: Retained while your account is active. After you request account deletion, your data will be permanently removed within 30 days, unless retention is required by law.
• Analytics data: Anonymized usage data is retained for up to 26 months to identify trends and improve the Service.
• Necessary cookies: Session cookies expire when you close your browser. Authentication cookies expire after your session ends or after a reasonable inactivity period.
• Analytics cookies: Expire after 12 months from the date they are set.
• Legal obligations: Certain data may be retained longer if required to comply with applicable laws, resolve disputes, or enforce our agreements.

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it. These measures include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Personal data stored in our databases is encrypted at rest.
• OAuth token security: Social media OAuth tokens are stored securely using encryption and are never exposed to client-side code.
• Security practices: We review and improve our security measures on an ongoing basis as the platform evolves.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis.

However, no method of transmission over the internet or method of electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law without undue delay.

All Users: Regardless of your location, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data
• Withdraw consent for data processing where consent is the legal basis

GDPR Rights (EU/EEA Users): If you are located in the European Union or European Economic Area, you additionally have the right to:

• Data portability — receive your personal data in a structured, commonly used, machine-readable format
• Restriction of processing — request that we limit how we use your data
• Object to processing — object to processing based on legitimate interests
• Lodge a complaint with your local data protection supervisory authority

CCPA/CPRA Rights (California Residents): If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information (note: we do not sell or share your personal data for advertising)
• Non-discrimination — we will not discriminate against you for exercising your privacy rights

How to Exercise Your Rights: To exercise any of these rights, please contact us at support@shaflex.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

Shaflex integrates with third-party social media platforms to enable content publishing and analytics. These platforms include, but are not limited to:

• X (formerly Twitter)
• LinkedIn
• Threads
• Bluesky
• Mastodon

Each of these platforms is governed by its own privacy policy and terms of service. When you connect a social media account to Shaflex, we access only the data and permissions you explicitly authorize through the OAuth flow. We encourage you to review the privacy policies of any third-party platforms you connect to Shaflex.

We are not responsible for the privacy practices, data collection, or content policies of these third-party services.

Your information may be processed and stored in countries outside your place of residence, including countries outside the European Economic Area (EEA), where data protection laws may differ from those in your jurisdiction.

When we transfer personal data outside the EEA, we take steps to ensure appropriate safeguards are in place. Our third-party service providers (such as Vercel) maintain their own data protection commitments, which may include Standard Contractual Clauses or reliance on adequacy decisions by the European Commission.

For questions about how we protect your data during international transfers, please contact us at support@shaflex.com.