Niche2SM
Privacy Policy
1. Who we are
Niche2SM is a service that helps creators research topics, generate video and image content, and publish it to their own social media accounts on a schedule.
The data controller is [[LEGAL ENTITY NAME]], tax identification number [[CIF]], registered at [[REGISTERED ADDRESS]], Spain. You can reach us at info@niche2sm.com.
2. What this policy covers
It covers the Niche2SM web application at niche2sm.com, its API, and the background services that generate and publish content on your behalf. It explains what we collect, why, how long we keep it, who we share it with, and how you can get it deleted.
3. Data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, display name, authentication identifiers, the date of your last sign-in | You, or the identity provider you sign in with (Google, Facebook) |
| Content data | The niches, topics, scripts, images, videos, captions, hashtags and brand assets you create or upload | You, and content our systems generate at your request |
| Connected account data | Access and refresh tokens for the social accounts you connect, plus the account's identifier, display name and avatar | The platform, once you grant consent |
| Publishing data | Scheduled and completed publications, the identifier and URL the platform returns, error reasons and a step-by-step activity log | Generated by the service and by the platforms |
| Analytics data | Aggregate performance metrics for content you published through us — views, watch time, likes, comments, shares and similar | The platform's analytics APIs |
| Technical data | Server logs, IP address, browser and device information, error reports | Automatically, when you use the service |
We do not collect special categories of personal data, and we do not knowingly collect data from anyone under 18.
4. Why we use it, and on what legal basis
- To provide the service — creating your account, generating content you ask for, publishing it to the accounts you connected, and showing you how it performed. Legal basis: performance of a contract.
- To keep the service working and secure — error monitoring, abuse prevention, debugging, backups. Legal basis: our legitimate interest in a reliable, secure service.
- To communicate with you — service notices, security alerts, and replies to your requests. Legal basis: contract and legitimate interest.
- To connect a social account — we access a platform only after you explicitly authorise it on that platform's own consent screen. Legal basis: your consent, which you can withdraw at any time by disconnecting the account.
- To meet legal obligations — accounting and tax records where applicable. Legal basis: legal obligation.
5. Data from connected social platforms
When you connect an account, the platform issues us a token scoped to the permissions shown on its consent screen. We use that access solely to operate features you asked for: to identify which account or page you selected, to publish the content you approved, and to read back performance metrics for that content.
We do not:
- sell, rent or trade platform data;
- use platform data to build advertising or marketing profiles;
- read your private messages, or post anything you have not approved;
- automate likes, follows, comments or direct messages;
- access accounts other than the ones you explicitly connected.
Access tokens are encrypted at rest with AES-256-GCM. Disconnecting an account in Niche2SM deletes the stored token immediately. You can also revoke our access from the platform itself at any time — see Delete my data.
YouTube
Niche2SM uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data. You can review and revoke Niche2SM's access to your Google account at myaccount.google.com/permissions.
Meta (Instagram and Facebook)
Where you connect an Instagram professional account or a Facebook Page, we use Meta's Graph API to publish the content you approved and to read its performance. Meta's own handling of your data is governed by the Meta Privacy Policy. You can review and remove Niche2SM's access under Settings → Business Integrations on Facebook.
6. Who we share data with
We do not sell personal data. We share it only with service providers who process it on our behalf, under contract, and only as far as they need to:
| Purpose | Providers |
|---|---|
| Hosting, database and authentication | Supabase (PostgreSQL and authentication, hosted in the EU), Railway (application and background workers), Vercel (web front end) |
| File storage and delivery | Cloudflare (R2 object storage and CDN) |
| Content generation | AI providers used to produce text, images, speech and video from your instructions — including OpenAI, Anthropic, ElevenLabs, Replicate, fal.ai and similar. Your instructions and the resulting content are sent to them for processing. |
| Stock media | Pexels, Pixabay, Freesound, Jamendo |
| Transactional email | Resend, Cloudflare Email Routing |
| Publishing and analytics | The social platforms you connect (Google/YouTube, Meta, TikTok) |
We may also disclose data where legally required, or to establish, exercise or defend legal claims.
7. International transfers
Our primary database is hosted in the European Union. Some providers listed above operate outside the European Economic Area, mainly in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the provider's own safeguards.
8. How long we keep it
- Account and content data — while your account is active.
- Access tokens — until you disconnect the account or delete your account, whichever comes first.
- Generated media — intermediate assets are purged automatically once a piece of content has been published; final files are kept while your account is active.
- Publishing and analytics records — while your account is active, so historical performance stays meaningful.
- Server logs — a rolling short-term window for debugging and security.
- After account deletion — personal data is deleted or irreversibly anonymised within 30 days, except where we must retain records to meet a legal obligation.
9. Security
Data is transmitted over TLS. OAuth tokens and third-party credentials are encrypted at rest with AES-256-GCM. Database access is restricted by row-level security so one account cannot read another's data. Administrative access is limited to the people who need it. No system is perfectly secure, but if a breach affects your rights we will notify you and the supervisory authority as the law requires.
10. Your rights
Under the GDPR you can request access to your data, correction of inaccurate data, erasure, restriction of processing, portability in a machine-readable format, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was done beforehand.
Write to info@niche2sm.com and we will respond within one month. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.
11. Deleting your data
Full instructions — including how to revoke our access from Facebook, Instagram and Google — are on the Delete my data page.
12. Changes to this policy
If we change this policy materially we will update the date at the top and notify account holders by email before the change takes effect.
13. Contact
Política de Privacidad (español)
1. Quiénes somos
Niche2SM es un servicio que ayuda a creadores a investigar temas, generar contenido en vídeo e imagen y publicarlo de forma programada en sus propias cuentas de redes sociales.
El responsable del tratamiento es [[RAZÓN SOCIAL]], con CIF [[CIF]] y domicilio en [[DOMICILIO SOCIAL]], España. Puedes escribirnos a info@niche2sm.com.
2. Qué datos tratamos
- Datos de cuenta: correo electrónico, nombre, identificadores de autenticación y fecha del último acceso.
- Contenido: los nichos, temas, guiones, imágenes, vídeos, textos y elementos de marca que creas o subes.
- Cuentas conectadas: tokens de acceso y actualización de las redes que conectas, más el identificador, nombre y avatar de la cuenta.
- Publicaciones: publicaciones programadas y realizadas, el identificador y la URL que devuelve la plataforma, motivos de error y un registro de actividad.
- Analítica: métricas agregadas del contenido publicado a través de nosotros.
- Datos técnicos: registros de servidor, dirección IP, información de navegador y dispositivo, informes de error.
No tratamos categorías especiales de datos ni recogemos conscientemente datos de menores de 18 años.
3. Para qué y con qué base legal
- Prestar el servicio — ejecución de un contrato.
- Mantenerlo funcionando y seguro — interés legítimo.
- Comunicarnos contigo — contrato e interés legítimo.
- Conectar una red social — tu consentimiento, revocable en cualquier momento desconectando la cuenta.
- Obligaciones legales — cumplimiento normativo.
4. Datos procedentes de las redes conectadas
Cuando conectas una cuenta, la plataforma nos entrega un token limitado a los permisos que aparecen en su pantalla de consentimiento. Usamos ese acceso únicamente para identificar la cuenta o página que elegiste, publicar el contenido que aprobaste y leer las métricas de ese contenido.
No vendemos ni cedemos esos datos, no construimos perfiles publicitarios con ellos, no leemos tus mensajes privados, no publicamos nada que no hayas aprobado, no automatizamos likes, seguimientos, comentarios ni mensajes directos, y no accedemos a cuentas distintas de las que conectaste expresamente.
Los tokens se cifran en reposo con AES-256-GCM. Desconectar una cuenta en Niche2SM borra el token de inmediato. También puedes revocar nuestro acceso desde la propia plataforma: ver Eliminar mis datos.
Niche2SM utiliza los Servicios de la API de YouTube. Al conectar un canal aceptas también los Términos del Servicio de YouTube, y a Google le aplica su Política de Privacidad. Puedes revocar nuestro acceso en myaccount.google.com/permissions. En el caso de Meta, puedes hacerlo en Configuración → Integraciones empresariales de Facebook.
5. Con quién compartimos datos
No vendemos datos personales. Solo los compartimos con proveedores que los tratan por cuenta nuestra y bajo contrato: alojamiento, base de datos y autenticación (Supabase, Railway, Vercel), almacenamiento y distribución de ficheros (Cloudflare), proveedores de IA que generan el contenido a partir de tus instrucciones (entre otros OpenAI, Anthropic, ElevenLabs, Replicate, fal.ai), bancos de recursos (Pexels, Pixabay, Freesound, Jamendo), correo transaccional (Resend, Cloudflare Email Routing) y las plataformas sociales que conectes.
6. Transferencias internacionales
Nuestra base de datos principal está alojada en la Unión Europea. Algunos proveedores operan fuera del Espacio Económico Europeo, principalmente en Estados Unidos; en esos casos nos apoyamos en las Cláusulas Contractuales Tipo de la Comisión Europea o en una decisión de adecuación.
7. Cuánto tiempo los conservamos
Los datos de cuenta y contenido, mientras tu cuenta esté activa. Los tokens, hasta que desconectes la cuenta o la elimines. Los archivos intermedios de generación se purgan automáticamente al publicar. Tras eliminar tu cuenta, los datos personales se borran o anonimizan de forma irreversible en un plazo de 30 días, salvo lo que debamos conservar por obligación legal.
8. Seguridad
Los datos viajan cifrados por TLS. Los tokens y credenciales de terceros se cifran en reposo con AES-256-GCM. El acceso a la base de datos está restringido por seguridad a nivel de fila, de modo que una cuenta no puede leer los datos de otra.
9. Tus derechos
Puedes ejercer los derechos de acceso, rectificación, supresión, limitación, portabilidad y oposición, y retirar tu consentimiento cuando el tratamiento se base en él. Escríbenos a info@niche2sm.com y te responderemos en el plazo de un mes. Si consideras que no hemos atendido bien tu solicitud, puedes reclamar ante la Agencia Española de Protección de Datos, www.aepd.es.
10. Cambios
Si modificamos esta política de forma sustancial, actualizaremos la fecha y avisaremos por correo antes de que el cambio surta efecto.