Privacy Policy — Social by Start-Win

This Privacy Policy explains how Start-Win (EI Start-Win, SIREN 823 879 762), publisher of Social by Start-Win available at https://social.start-win.fr/, collects and processes personal data when you use this SaaS service for managing and publishing content on social networks.

For the publisher identity, hosting provider, and Data Protection Officer (DPO), see also our legal notice (French).

1. Data controller

The data controller is Start-Win — 105 La Fraise, 49370 Val d'Erdre Auxence, France — robin@start-win.fr.

Data Protection Officer: Robin Couet — robin@start-win.fr.

2. Data we process

Depending on how you use the service, we may process the following categories of data:

2.1 User account

Email address, first name and last name (or full name).
Password: stored only as a hash if you create an account with email and password (we never store passwords in plain text).
Google profile data: if you sign in with Google OAuth, we receive your email address, name and, where applicable, profile photo and Google account identifier.
Application role and subscription information (plan, status, trial period).

2.2 Workspaces and team

Workspace name, membership and role (administrator, editor, reviewer).
Team invitations: invited email address, proposed role, invitation token (stored securely) and expiry date.
Audit log: actions performed in the workspace (who did what, timestamp, technical details).

2.3 Social network connections

When you connect an account through the official OAuth interfaces, we store the information needed to publish and manage the connection, including:

Platform concerned (Facebook, Instagram, LinkedIn, X, Google Business Profile, TikTok).
Connected account name or label, technical identifiers and access tokens (and, depending on the platform, refresh tokens).
Page, location or professional account identifiers when you select them in the interface.

These tokens are retained so that we can publish at your request. You can disconnect a network at any time from the application. Deleting your account also deletes the associated connections.

2.4 Content and publications

Draft text, per-network variants, hashtags and scheduling metadata.
Media files (images, videos): stored temporarily on our servers for preparation and publication (limited duration — see section 7), then transmitted to the APIs of the social networks you chose.
History of published and scheduled posts (text, per-network results, timestamps).
Internal approval requests (submissions pending review, reviewer notes).

2.5 Subscription and billing

Stripe identifiers (customer and subscription), subscribed plan, subscription status and period or trial end date.
Payments are processed by Stripe. Start-Win does not receive or store full payment card numbers.

2.6 Artificial intelligence features

On plans that include this option, your draft text and target networks may be sent to OpenAI to generate suggestions (text improvement, per-platform variants, hashtags). These calls are only triggered when you explicitly use the feature. You remain responsible for the content you publish after review.

2.7 API keys

If you create API keys to automate actions, we store a label, an identifiable prefix, a hash of the key (the full key is shown only once at creation) and the last-used date.

2.8 Technical data

Session identifiers and authentication tokens (see section 8).
IP address, server logs, browser type and technical information related to security and debugging.

3. Purposes of processing

Creating and managing your account, authentication and session maintenance.
Providing the features: drafting, scheduling, publishing, history, workspaces and collaboration.
Connecting to social networks and executing the publications you request.
Managing subscriptions, trials and billing via Stripe.
Sending transactional emails (notably team invitations).
On-demand AI suggestions (eligible plans).
Service security, abuse prevention, support and product improvement.
Measuring audience on the marketing site when analytics are enabled (see section 8).
Complying with legal obligations and responding to requests from authorities or third-party platforms when required.

4. Legal bases

Performance of a contract: providing the service, account management, publications, subscriptions and subscribed features.
Legitimate interest: security, technical logging, fraud prevention, service improvement and workspace management.
Legal obligation: retaining certain billing data and responding to regulatory requests.
Consent: where required by law, in particular for certain non-essential trackers (analytics) or optional processing that needs your explicit agreement.

5. Recipients and processors

Your data is accessible to authorised Start-Win personnel and, where applicable, to the following providers:

OVH SAS — hosting of the application and PostgreSQL database (France / European Union).
Stripe, Inc. — payment processing and subscription management.
OpenAI — generation of text and hashtag suggestions when you use AI features (Pro and Team plans).
SMTP provider — sending transactional emails (team invitations), configured by Start-Win.
Umami (self-hosted by Start-Win, e.g. analytics.start-win.fr) — audience measurement on the site, without third-party advertising cookies, when enabled in production.
Connected social platforms — Meta (Facebook, Instagram), LinkedIn, X, Google (sign-in and Google Business Profile), TikTok: only in the context of publications and operations you initiate through their official APIs.

These providers act under their own terms and privacy policies for the data they process on their side. Some may be located outside the European Union; in that case, appropriate safeguards (standard contractual clauses or equivalent) are put in place where required.

6. Transfers outside the European Union

Primary hosting is in France. However, using services such as Stripe, OpenAI or certain social platforms may involve transfers of data to third countries. We ensure that such transfers are framed in accordance with the GDPR.

7. Retention periods

Account and content: retained while your account is active, then deleted or anonymised within a reasonable time after account deletion, subject to legal obligations.
Session tokens: limited duration (short-lived access token; refresh token up to 30 days depending on service configuration).
Temporary media: automatically deleted after a short period (about 20 minutes by default) if publication does not occur.
Team invitations: valid for 7 days, then expired.
Billing data: retained for the applicable legal period (accounting and tax law).
Technical logs: retained for a period proportionate to security and diagnostic needs.

8. Cookies and trackers

Social by Start-Win uses the following cookies and mechanisms:

Authentication cookies (access_token, refresh_token): strictly necessary for login and session security (HTTP-only cookies).
Workspace cookie (active_workspace_id): remembers the active workspace for the dashboard to function.
Interface cookie: remembers the sidebar menu state (display preference).
Umami (if enabled): audience measurement script hosted by Start-Win, intended for public site pages. It is not a third-party advertising network. You can refuse non-essential trackers via your browser settings.

We do not use third-party advertising or marketing profiling cookies on the application. Stripe payment pages may set their own cookies when you manage your subscription.

9. Security

We implement appropriate technical and organisational measures: encrypted communications (HTTPS), hashed storage of passwords and API keys, secure cookies in production, access limitation and backups hosted with our provider. No measure provides absolute security, however.

10. Your rights

Under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act ("Informatique et Libertés"), you have the following rights: access, rectification, erasure, restriction, objection, portability (where applicable) and withdrawal of consent for processing based on consent.

To exercise your rights, contact the DPO: robin@start-win.fr. We may ask for proof of identity where we have reasonable doubt.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

11. Data from Facebook and Instagram (Meta)

If you connect a Facebook or Instagram account, Meta may share data with us in accordance with its own policies and the permissions you grant. For a Meta-related data deletion request, contact us at robin@start-win.fr and include the email address of your Social by Start-Win account. A technical deletion endpoint is also available for Meta at /api/facebook/data-deletion on the service.

12. Minors

Social by Start-Win is intended for professionals and creators. The service is not directed at persons under 16. If you believe a minor has provided us with data, contact us to request deletion.

13. Changes

We may update this policy to reflect changes to the service or to the law. The last updated date appears at the top of this page. We invite you to review it regularly.

14. Contact

For any question about this policy or the processing of your data: robin@start-win.fr — Start-Win, 105 La Fraise, 49370 Val d'Erdre Auxence, France.