Privacy policy

Data controller

Publiqo Media, S.L., tax number B93820306, registered at Avenida de les Marines 36, bloque C, escalera A, planta 2, puerta 3, 08195 Sant Cugat del Vallès (Barcelona), Spain, and filed with the Registro Mercantil de Barcelona, is the controller of the personal data described in this policy. GoFeed is the trading name it provides the service under.

You can write to us at support@gofeedapp.com about anything to do with your data, including exercising the rights set out below.

Two roles are worth telling apart, because they are not the same. For the data of whoever contracts the service and of the people who access their workspace, GoFeed is the controller. For the content a workspace uploads to the platform and the data of that workspace own clients, GoFeed is a processor: the workspace decides what goes in and what for, and we handle it on their instructions.

Data we process

Account data: your name, your email address, the language you choose and, if you upload one, your photo. Passwords are stored as a hash, so nobody at GoFeed can read yours.

If you sign in with Google, we receive from Google your account identifier, your name, your email address and your profile photo. Your Google password never reaches us.

Billing data: the company name, tax number and address you give us, along with your subscription and payment history. Your card details are handled by Stripe directly and are not stored on our servers.

Workspace content: the posts, images, videos, documents, tasks, comments and messages you and your team create or upload, including data about your own clients when you choose to put it there.

Data from the social accounts you connect: profile identifiers, the access credentials the network hands us, and the metrics of your posts. We only reach what the permission you granted allows, and you can revoke it at any time from the network itself or from the application.

Technical data needed to run and protect the service: IP address, browser type and account activity logs. To stop automated submissions, the forms on the marketing site use Cloudflare Turnstile, which loads only when you start typing in one of them and receives your IP address and technical signals from your browser, never what you type.

Audience measurement data, on the marketing site only: we use Google Analytics and PostHog to see how many people arrive, where from, and which pages they read. Their cookies are only set if you accept them in the notice shown when you arrive: until you do, nothing is written to or read from your device. Google may still receive a cookieless signal, which does not identify your visit and only serves to estimate the total number of visits. Every cookie, and how to change your choice, is listed in our cookie policy, at /en/legal/cookies.

Product usage data, inside the application: which features you use, when, and from which workspace. PostHog collects it, tied to your account, and it never includes the content: not the text of a post, not a file, not a message. It tells us which parts of the product are used and which are not, and lets us test a change on some accounts before rolling it out to all of them.

Usage recordings, on new accounts only: for the fourteen days after an account is created, PostHog records how the application is used in it, that is, which screens are opened, where people click and how the page scrolls, so that it can be watched later like a video. It shows us where new users get stuck so we can fix it. The recording shows the screens as they appear, so it can include the account's content, such as the text of a post, with three limits: anything typed into a field is hidden; the text of the screens holding the account's clients' data, such as the message inbox, the CRM records and the leads, is hidden; and keys, secrets and access codes are not recorded. After those fourteen days the account is no longer recorded.

For the commercial communications described below we also use data about your account that we already process to provide the service: the steps you have taken or have yet to take (for example, whether you have connected a network or scheduled a post), the status of your trial or subscription, whether you have recently contacted support, and which of those emails we have already sent you. We use no data from outside sources for this.

Commercial relationship data: if you write to us through the contact form on the marketing site, we keep your name, your email address, your company name, your phone number if you give it, and your message. If you book a meeting with our team on the marketing site, on the demo page or through a booking link, we also keep the day and time you choose, your time zone, the answers you give in the form and, if you add them, the addresses of the people you invite. The meeting is created in the Google calendar of the team members who attend it, and Google sends you the invitation with the Google Meet link. We also email you to confirm it and remind you of it, with a link to reschedule or cancel. For customers and prospective customers, our team also records the history of the relationship, such as calls, notes, meetings and proposals, together with the business contact details of the people we speak to. Where we have no relationship with a company yet, those business contact details come from publicly accessible sources, such as its own website.

The cookies we set in the application are the one for that measurement and three strictly necessary ones: the one that keeps you signed in, the one that remembers the language you picked and the one that remembers the last workspace you opened.

On the marketing site we also use, if you accept them, advertising cookies from Google Ads, to tell which adverts bring visits that go on to register. We do not sell this data and we take no automated decisions producing legal effects for you. Nor do we build commercial profiles, with one limited exception explained below: choosing which tip to email you based on how you use your account. If you write to us through the contact or demo form after accepting advertising, the Google Ads tag also sends Google your email address transformed by a hash function, to tell which advert brought the enquiry.

Purposes of processing

Providing the service you contracted: creating and maintaining your account and workspace, letting your team and your clients in with the role each of them has, and keeping the content you upload.

Publishing to the social networks you have connected, at the time you schedule, and returning the metrics for those posts.

Handling sign-up, payments, renewals and invoicing.

Answering your support requests and telling you what affects your account: email verification, invitations, billing notices, changes to the service.

Keeping the platform secure, preventing abuse and fraud, and diagnosing faults.

Improving the product: knowing which features are used and which are not, and testing a change on a sample of accounts before rolling it out to all of them, by comparing how each group uses it.

Attributing advertising: knowing which campaigns bring accounts that go on to start a trial or pay. To do that, when an account is created, its first meaningful step is taken (for example a first draft, client, invitation or bio page), the subscription options are viewed, a checkout is started, a trial starts or the first invoice is paid, the application reports that fact to Google Analytics, and through it to Google Ads, with the measurement identifier the marketing site cookie assigned to your visit, if you arrived from an advert, with the identifier of that click, and with your email address transformed by a hash function, so Google can tell which advert brought the account even when the visit's identifier was lost along the way. It only happens if you accepted advertising on the marketing site: without that permission nothing tied to your visit or your email address is reported.

Sending you, by email, GoFeed's own commercial communications about GoFeed products and services similar to the one you contracted, during the free trial too: tips for getting more out of the product, chosen according to how you use your account (for example, a step you have not taken yet), summaries of your usage, product news and offers. We will never send you communications on behalf of third parties or about other companies' products or services.

These emails may carry an open pixel and links that pass through our tracking service with an identifier of that email, to measure opens and clicks. That identifier is linked to your address, so it lets us know whether you opened an email and which links you clicked. To tell whether the tips are useful we also compare how the accounts that receive them go on to use the product with a group of accounts that does not receive them. You can unsubscribe at any time, with the link in every email or in any of the ways explained below.

Answering whoever writes to us through the contact form and managing our commercial relationship with customers and prospective customers: calling them, following up, preparing proposals and holding the meetings booked with us. We do this in an internal tool that only the GoFeed team can access, kept separate from our customers' workspaces.

Meeting our legal obligations, in particular accounting and tax ones.

Legal basis

Performance of the contract (article 6.1.b GDPR) covers everything needed to provide the service: your account, your workspace, the content you upload, publishing to the networks you connect and collecting the subscription.

Compliance with legal obligations (article 6.1.c) covers keeping accounting and tax records and responding to requests from competent authorities.

Our legitimate interest (article 6.1.f) covers platform security, fraud and abuse prevention, and fault diagnosis. We have weighed that interest against your rights and it is limited to what the service needs in order to work and not to be used against other people.

The same legitimate interest (article 6.1.f) covers measuring how the product is used and testing changes on a sample of accounts. Weighing it against your rights, what tips the balance is what is not done: we process usage data and never the content, we build no profiles for advertising, and none of it is passed to anyone other than the provider that hosts it. You can object to this processing by writing to us at the address below. The same legitimate interest covers the usage recordings of new accounts. Weighing it, we have taken into account that they are limited to the first fourteen days, that they hide what is typed and the clients' data, that they are passed to no one but the provider that hosts them and that they are deleted after thirty days. If you object, we will stop recording your account.

Sending the commercial communications described under the purposes rests on article 21.2 of Spain's Law 34/2002 on information society services and electronic commerce (LSSI): there is a prior contractual relationship with you, the free trial included, and the emails concern GoFeed's own products and services similar to the one you contracted. The same law requires us to offer you a simple, free way to object, both when we collected your email address and in every communication we send you, and we do: with a box on the sign-up form and with an unsubscribe link in every email. That is why we only send these emails to people who had that box in front of them when they signed up.

Choosing which tip to send you based on how you use the product, and comparing the effect of these emails with a group of accounts that does not receive them, rests on our legitimate interest (article 6.1.f GDPR) in showing you what the product can do for you without writing to you about what you already use. Weighing it against your rights, we took into account that it only uses data we already process to provide the service, never your content or data from outside sources, that none of it is passed to third parties, and that you can object at any time.

Objecting to commercial communications does not affect the emails we need to send you to provide the service, such as security and sign-in alerts, billing and payment notices, messages about your account or your trial, and changes to our terms or to this policy. Those rest on the performance of the contract and, where applicable, on compliance with legal obligations, and you will keep receiving them.

Answering a request sent through the contact form relies on taking steps at your request before entering into a contract (article 6.1.b). Managing the commercial relationship with customers and prospective customers, including calls and follow-up with their business contacts, relies on our legitimate interest (article 6.1.f) in making our service known to businesses and keeping it there. In weighing it against your rights we took into account that these are business contact details, that they are not shared with third parties, and that you can object at any time by writing to the address below. If you do, we will stop contacting you.

Your consent (article 6.1.a) covers connecting third party accounts, such as your social networks, Google Drive or Google Calendar. You give it when you authorise the connection and you can withdraw it whenever you want, without affecting the lawfulness of processing before that.

Your consent also covers the analytics and advertising cookies on the marketing site, advertising attribution, and the reporting to Google of the facts described under the purposes above, together with your transformed email address, which only happens if you accepted advertising on the site. You give it, separately for analytics and for advertising, in the cookie notice, and you can withdraw it at any time through "Cookie settings" at the foot of any page of the site, without affecting the lawfulness of the processing before you did.

Recipients and processors

We do not sell your data and we do not pass it to third parties for commercial purposes. We share it only with the providers we need in order to run the service, who act as processors, under a signed agreement and only on our instructions.

Neon: hosts the database your workspace lives in.

Cloudflare: stores the files you upload, through its R2 service, and checks with Turnstile that whoever sends a form on the marketing site is a person.

Vercel: hosts and runs the application. Our execution region is Frankfurt, in the European Union.

Stripe: handles payments, subscriptions and invoicing. It is also the party that processes your card details, which never reach our servers.

Resend: sends the service email: verifications, invitations, alerts and notifications, and also the commercial communications described in this policy.

Zernio: publishes to the networks you connect and retrieves the metrics for those posts.

Google: identifies you when you choose to sign in with Google, gives access to Drive and Calendar only if you connect them, holds in our team's calendar the meetings you book with us, with their Google Meet link, and measures the audience of the marketing site through Google Analytics if you accept its cookies. It also receives, from the application itself, the sign-up facts: that an account was created, that its first meaningful step was taken, that the subscription options were viewed, that a checkout was started, that a trial started, and that the first invoice of a subscription was paid. We report them to Google Analytics, and from there they pass to Google Ads, together with the measurement identifier the marketing site cookie assigned to your visit, so we can tell which campaigns bring accounts and stop spending on the ones that do not; with the invoice travels the amount paid, net of tax. With each of those facts, and when you send the contact or demo form, your email address travels too, but never readable: before it leaves your browser or GoFeed it is lowercased and transformed with a hash function (SHA-256), which cannot be reversed. Google compares it with the addresses, transformed the same way, of people who saw or clicked its adverts, only to attribute the conversion and measure the campaigns better, and does not use it to send you anything or to put you in advertising audiences. All of this only happens if you accepted advertising on the marketing site: without that permission your sign-up carries no identifier from your visit and nothing tied to it or to your email address is sent. Your name and your content never travel. The provider is Google Ireland Limited.

PostHog: measures how the product is used inside the application: which features are used, when, and from which workspace, never the content. On the marketing site it also measures the audience, only if you accept analytics cookies. The provider is PostHog Inc., and the data is hosted in its European cloud, in Frankfurt. On new accounts, during their first fourteen days, it also records how the application is used, with what is typed and the clients' data hidden.

On top of that, when you publish to a social network, the content you publish and the data attached to it reach that network and become subject to its own terms and privacy policy, over which we have no control.

We will also disclose data to public authorities where we are legally required to.

International transfers

The application runs in the European Union, specifically in Frankfurt. The product usage data PostHog processes is also hosted in Frankfurt, in its European cloud.

Some of the providers listed above are United States companies or process data outside the European Economic Area. Where that happens, the transfer relies on the safeguards set out in chapter V of the GDPR: the standard contractual clauses approved by the European Commission and, where the provider is certified, the EU to US Data Privacy Framework.

If you want to know the specific safeguards that apply to a given provider, write to us at support@gofeedapp.com and we will send them to you.

Retention

We keep your account data and your workspace content for as long as the relationship lasts. When you ask us to close the account, by writing to support@gofeedapp.com, we delete or block that data within a reasonable period of your request, other than what we are legally required to keep.

Accounting and tax records are kept for the periods required by commercial and tax law, which oblige us to hold the documentation for several years from the close of the relevant financial year.

Files you send to the bin are permanently deleted thirty days later, and you can restore them at any point during those thirty days.

If a workspace without an active subscription goes ninety days without anybody entering it, we let you know by email and, if nobody enters it in the following fourteen days, the files stored in its Drive, bin included, and in its post media library are permanently deleted. The rest of the workspace content is kept.

Operational series, such as historical post metrics, activity logs and alerts, are kept for as long as the purpose behind them requires and are pruned according to the maximum windows we have defined, ranging from a few days for auxiliary counters up to thirteen months for metrics, a period that allows one stretch of time to be compared with the same stretch a year earlier.

Usage recordings of new accounts are permanently deleted thirty days after they are made.

Commercial relationship data is kept for as long as that relationship is alive. If it never begins, or if you object, we stop using it to contact you and delete or block it within a reasonable time, except for anything we must keep by law.

If you receive marketing emails from a brand that uses GoFeed, the record of each send is deleted after thirteen months, but we keep each email's unsubscribe link for as long as your profile with that brand exists, so that the unsubscribe and preference links of an old email keep working.

Your rights

You can exercise the rights of access, rectification, erasure, restriction of processing, objection and data portability, and you can withdraw any consent you have given, at any time and free of charge.

To exercise them, write to us at support@gofeedapp.com saying which right you want to exercise. We may ask you to prove your identity if we have reasonable doubts about who is asking. We will answer within one month of receiving your request, extendable by two further months if the request is complex, in which case we will tell you.

If the data you want corrected or erased sits inside a customer workspace, it is that workspace that decides about it, as controller. In that case we will pass your request on to whoever is responsible and let you know.

In particular, you have the right to object at any time to our processing your data to send you commercial communications, including choosing their content based on how you use the product (articles 21.2 and 21.3 GDPR and article 21.2 LSSI). If you object, we will stop sending them and stop using your data for that purpose. You can do it in any of these ways, all free of charge:

• by ticking the box "I don't want to receive tips, news or offers from GoFeed by email" when you create your account;
• with the unsubscribe link included in every one of those emails;
• by switching off "Tips and news from GoFeed" under Notifications, Email tab, in your account;
• or by writing to us at support@gofeedapp.com.

It takes effect without delay.

Security measures

All communication with the platform travels encrypted over TLS. Passwords are stored as a hash and cannot be recovered.

Access to information is separated by workspace and by role within it: each person sees only what their role allows, and the data of one workspace is not reachable from another.

We apply technical and organisational measures appropriate to the risk and review them periodically. If a security breach occurred that posed a high risk to your rights, we would tell you and notify the supervisory authority within the periods the law sets.

Complaints to the supervisory authority

If you believe the processing of your data does not comply with the law, you can lodge a complaint with the Agencia Española de Protección de Datos, at C/ Jorge Juan 6, 28001 Madrid, or through its website at www.aepd.es.

We would be grateful for the chance to sort it out first, at support@gofeedapp.com. That is not a requirement and you give up nothing by going straight to the authority.

Google Calendar

If you choose to connect your Google account to GoFeed's CRM, GoFeed asks permission to view and edit the events of your Google calendars (https://www.googleapis.com/auth/calendar.events) and to see the list of your calendars (https://www.googleapis.com/auth/calendar.calendarlist.readonly).

What we access. For the calendars you enable (only your primary calendar by default): each event's title, start and end time, all-day flag, location, description, video-conference link, organiser, attendees' names and email addresses and their responses, the event's link in Google Calendar, its recurrence identifier and its last-updated time. We also read the list of your calendars (name and id) so you can choose which ones to sync.

How we use it. Only to show those events as meetings in your workspace's CRM, to match attendees with the contacts and companies your workspace already holds so each client's timeline shows its meetings, and to keep them up to date when they change in Google Calendar. When you create a meeting in GoFeed and choose "Add to Google Calendar", we create that event in your primary calendar, with a Google Meet link if you ask for one, and Google sends the invitations to its attendees. We do not use Google Calendar data for advertising, we do not sell it, and we do not use it to train artificial-intelligence models.

Who can see it. The members of the GoFeed workspace you connected the calendar to, according to their permissions in that workspace. We do not share it with anyone else, except the infrastructure providers that host GoFeed under contract, and as required by law.

How it is stored. Synced events are stored as meetings in the workspace's database. Your Google access credentials are stored encrypted (AES-256-GCM) and are used only by the synchronisation.

Retention and deletion. You can disconnect Google Calendar at any time from the Calendar page in GoFeed. Disconnecting stops synchronisation immediately: we stop Google's change notifications, and we delete the list of your calendars, their sync state and the links between your calendar and the workspace's meetings. The meetings already recorded in the CRM stay in the workspace as part of its client history, like any other meeting a member logs, until a member deletes them or the workspace is deleted. To revoke GoFeed's access at Google as well, use https://myaccount.google.com/connections. Deleting your GoFeed account deletes your Google connection.

Limited Use. GoFeed's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

We may update this policy when the service changes, when the providers we use change, or when the applicable law changes. The date of the last update is shown at the top of this page.

If a change materially affects how we handle your data, we will tell you by email or through a visible notice in the application before it takes effect.

Contact

For any question about this policy or about how we handle your data, write to us at support@gofeedapp.com or to Publiqo Media, S.L., Avenida de les Marines 36, bloque C, escalera A, planta 2, puerta 3, 08195 Sant Cugat del Vallès (Barcelona), Spain.