Privacy policy

Data controller

Twofaces Recommerce S.L.U., tax ID (CIF) B22829170, Calle Cincel 5, 03690 San Vicente del Raspeig (Alicante), Spain. Contact: soporte@twofacesco.com.

Data we process

• Account: your email address, your password (stored hashed by our authentication provider; we never see it) and your language.
• Social accounts you connect: the account ID, username, display name, profile picture and the access tokens the platform gives us when you authorize the connection.
• Content: the text, images and videos you publish or schedule, the date, the target networks and the result of each post (status, link and ID on the network).
• API usage: your API keys, the webhook endpoints you configure and technical request logs (date, path, IP address and result) for security and support.
• Website: the email you leave on the waitlist and, only if you accept them, the ad measurement cookies described in the cookie policy.

Why we use it and on what legal basis

• Providing the service (performance of a contract): creating your account, connecting your networks, publishing and scheduling what you ask us to, notifying you by webhook and sending verification and password reset emails.
• Security and abuse prevention (legitimate interest): detecting unauthorized access, spam or uses that break platform rules.
• Measuring our ads (consent): only if you accept cookies, and you can withdraw it at any time.
• Complying with legal obligations, such as tax rules or requests from authorities.

We do not sell personal data or use it for third-party advertising, and we do not make automated decisions with legal effects on you.

Data we receive from platforms

When you connect a Facebook, Instagram, Threads, YouTube, TikTok, LinkedIn or other account, we only use the data that platform gives us for the features you request: showing the connected account, publishing and scheduling content and showing you the result. We do not sell it, use it for advertising or to train models, and we only share it with the providers we need to run the service. Nobody on our team looks at it unless you ask us to for support, for security, or when required by law.

Crier's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Crier uses YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and Google processes your data under the Google Privacy Policy. You can revoke Crier's access at any time from your Google account security settings.

You can disconnect any network from the dashboard or revoke access from the platform itself. The steps are on the Data deletion page.

Who we share it with

Only with providers that process data on our behalf, under contract and with data protection safeguards:

• Hosting, database, file storage and email delivery: Amazon Web Services, in the Frankfurt region (European Union).
• Social media publishing infrastructure providers, which deliver your content to the platforms you choose.
• Google (waitlist forms and, if you accept them, measurement cookies) and Meta (measurement cookies, only if you accept them).

Social networks receive the content you choose to publish on them and process it as independent controllers under their own policies.

International transfers

We store data in the European Union. If a provider processes it outside the European Economic Area, we rely on an adequacy decision (such as the EU‑US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Account data, connected accounts and posts: while you keep your account. When you delete it, we erase them within 30 days at most.
• A network’s access tokens: deleted as soon as you disconnect it.
• Uploaded files (images and videos): deleted automatically after 400 days, or earlier if you delete your account.
• Technical logs: 30 days.
• Backups: overwritten within 35 days at most.
• Anything the law requires us to keep (such as invoices), only for the legal period.

Your rights

You can request access, rectification, erasure, restriction, objection and portability, and withdraw your consent at any time, by writing to soporte@twofacesco.com. We will reply within one month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Security

We encrypt data in transit (HTTPS) and at rest, limit access to the people who need it and keep secrets (tokens and keys) in dedicated secret management services.

Children

Crier is a service for businesses and professionals and is not directed at anyone under 16.

Changes

If we make material changes to this policy we will let you know by email or in the dashboard. Last updated: 24 October 2026.