Privacy Policy

1. Who is responsible for your data

Tallflo is operated under the Velentio brand by the Polish sole trader identified on our Company information page. That sole trader is the controller of the personal data described in this policy, except where section 2 says that we process data on your behalf. The Company information page forms part of this policy. For privacy questions and requests, e-mail support@tallflo.com.

2. What we process, why, and on what legal basis

• Account and subscription data (e-mail address, name, time zone, plan, subscription status and dates, Stripe customer ID): to provide Tallflo, manage your subscription and send messages needed for the service. Basis: our contract (Art. 6(1)(b) GDPR).
• Connected platform accounts (platform IDs, names, handles, profile pictures, access tokens, and the IDs and links of what we publish): to publish what you choose and show you the results. Tokens are encrypted at rest. Basis: contract. Details in section 3.
• Videos and post texts you upload: to prepare, schedule and publish them. Basis: contract. If they contain other people’s personal data, we process that data on your behalf as your processor (section 10 of the Terms), and you remain responsible for having a legal basis and informing those people.
• Agents and API keys you connect (name of the agent or key, permissions, when it was used): to let them work within the limits you set. Basis: contract.
• Security and activity logs (sign-ins, what was created, approved or published, by you, an agent or a key, with time, IP address and browser): to prevent unauthorised access, investigate incidents, fix faults and handle support. Basis: our legitimate interests in protecting users, keeping the service reliable and establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).
• Website statistics (pages viewed without their query strings, clicks on main buttons, referring site, browser, operating system, device type, screen size, language and country or region): to understand how our website is used and improve it. We use Umami, running on our own servers in the EU, without cookies. Your IP address is used only to work out your approximate location and an anonymous visitor code that changes regularly, and is not stored. If your browser sends “Do Not Track”, nothing is counted. Basis: our legitimate interest in running and improving the website (Art. 6(1)(f) GDPR); you can object at any time by e-mailing us or by turning on “Do Not Track”.
• Messages you send us (support, complaints, withdrawal, content reports): to answer them and meet our obligations. Basis: contract or steps you ask for before one (Art. 6(1)(b)); requests about your data under the GDPR and reports under the Digital Services Act: legal obligation (Art. 6(1)(c)).
• Service e-mails (sign-in links, your plan and payments, your data and account) and notifications about your posts and accounts: basis: contract. You can turn off the notifications in Settings → E-mails or with the link in each of them.
• News and offers by e-mail: only if you ticked the box for it. Basis: your consent (Art. 6(1)(a)), which we record with the date and the exact wording. You can withdraw it at any time in Settings → E-mails or with the link in each such e-mail; this does not affect e-mails sent before.
• Waitlist (your e-mail address, when you joined and the wording you saw next to the form): to e-mail you once, when Tallflo opens. Basis: your consent (Art. 6(1)(a)), given by submitting the form. You can withdraw it at any time by e-mailing us, and we remove your address. We do not use it for anything else and do not share it.

Your e-mail address is required to create and use an account, and your time zone to schedule posts correctly. Connecting platform accounts and uploading content are needed only for the features you use. Payment details are needed to start a subscription and go directly to Stripe. Without this information we cannot provide the related feature. Marketing consent and joining the waitlist are optional.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our software checks technical requirements and plan limits; connecting an AI agent never lets it approve posts that need your approval.

3. Data from YouTube, Instagram, Facebook and TikTok

When you connect an account, the platform gives us the account’s ID, name, handle and profile picture, and access tokens that let us publish on your behalf. When we publish, it gives us the ID and link of the published video. We use this data to show you your accounts and posts, carry out the publishing you authorise and report the results. Our hosting provider stores it for us. We do not sell it and do not use it for advertising.

If you connect an AI agent or another API client, that client can receive what the tools you authorise return, including connected account names and handles, post titles, publication links and publication status. It never receives platform access tokens. The client’s provider processes this information under its own terms and privacy policy, which may involve countries outside the European Economic Area. You can revoke an agent’s access at any time in the Agent section.

• YouTube. Tallflo uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy. You can remove Tallflo’s access at any time by disconnecting the channel in Tallflo or in your Google security settings.
• Instagram and Facebook. Data comes from Meta through Facebook Login for Business. You can remove Tallflo in your Facebook settings (Business integrations) or ask us to delete the data (see the data deletion page). If Meta sends us a deletion or deauthorisation request, we delete the linked platform data and stop publishing to those accounts.
• TikTok. Data comes from TikTok’s Login Kit and Content Posting API. You can remove Tallflo in the TikTok app under Settings and privacy → Security → Apps and services.
• How long. We read each account’s name, handle and picture again at least every few days. When you disconnect an account in Tallflo, delete your Tallflo account or ask us to delete platform data, we revoke our access and delete that account’s platform data at once. If you remove our access on the platform’s side, we notice it within a few days and delete the data 14 days later, so it is gone within 30 days of the removal. These deadlines include our backups (section 4). Deleting data from Tallflo does not delete videos or data stored by the platforms; use their own controls for that.

4. How long we keep data

• Videos: deleted 24 hours after they are published on all the platforms you selected, or 30 days after an unpublished draft was created. A small thumbnail image stays with the post until you delete the post or your account.
• Data from connected platforms: see section 3.
• Account data, posts and settings: until you delete your account. When you do, we close the account at once and erase the data 14 days later (until then you can ask us to restore it).
• Downloadable data exports: 7 days.
• Security and activity logs: 12 months, except specific records needed for an ongoing investigation or legal claim, kept only as long as that requires. Sign-in sessions end after 30 days without use.
• Website statistics: 24 months.
• Waitlist: until 30 days after we e-mail you that Tallflo is open, and at most 12 months after you joined. If you ask us to remove your address, we do it at once; if you delete a Tallflo account with the same address, it goes when the account is erased.
• Technical error logs of our servers, which normally contain no personal data: up to 30 days.
• Messages you send us: as long as needed to deal with them and with any related legal claims.
• Backups: copies of our database and servers are kept for up to 7 days for disaster recovery only. If we restore a backup, we apply all deletions again before the data is used.

5. Who receives your data

• Hetzner Online GmbH (Germany): servers, database, video storage and backups, in the European Union. Processor.
• Plus Five Five, Inc., trading as Resend (USA): sends our e-mails. E-mails are sent from its Ireland region, but e-mail metadata, logs and API records are stored in the USA. Processor.
• Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates, including Link, Stripe’s merchant-of-record service): payments, taxes, invoices, fraud prevention and transaction support. Card details go only to Stripe. For its own purposes, such as fraud prevention and legal obligations, Stripe acts as an independent controller; see the Stripe Privacy Policy.
• Cloudflare, Inc. (USA): the domain name system for tallflo.com, and forwarding of the e-mails you send to our tallflo.com addresses, such as support@tallflo.com, to our mailbox, with a log of each message’s sender, recipient and subject. It does not receive the content of your use of Tallflo. Processor.
• Google (Google Ireland Limited, and Google LLC in the USA): Gmail, the mailbox where your e-mails to us arrive.
• The platforms you connect (Google/YouTube, Meta, TikTok) receive the videos and texts you publish there, as separate controllers under their own privacy policies (section 3). AI agents and API clients you connect receive the data described in section 3.
• Public authorities, where the law requires us to disclose data.

Processors act on our behalf under data processing terms. For transfers to the USA we rely on the European Commission’s adequacy decision for companies certified under the EU–US Data Privacy Framework and on the Standard Contractual Clauses in our providers’ data processing terms. You can ask us at support@tallflo.com for information about these safeguards and a copy of them.

6. Your rights

Under the conditions in the GDPR you may request access to your data, its rectification, erasure or restriction of processing, and receive the data you gave us in a structured, machine-readable format or have it sent to another controller (Settings → Download my data does this for you). You may object, on grounds relating to your particular situation, to processing based on our legitimate interests. You may withdraw consent at any time without affecting earlier processing.

Send requests to support@tallflo.com, or use Settings → Download my data and Delete account. We answer without undue delay and within one month; if the GDPR allows an extension, we explain why within that month. For platform data see the data deletion page. You may also complain to the President of the Personal Data Protection Office in Poland (Prezes UODO, uodo.gov.pl) or to the supervisory authority where you live or work or where you believe your rights were infringed.

7. Cookies

Tallflo uses only cookies needed to sign you in, protect sign-in and connect the platform accounts you choose. The sign-in cookie lasts up to 30 days and is renewed while you use the service; the cookie used while you connect a platform account expires after 10 minutes. You can delete or block cookies in your browser, but sign-in and connecting accounts will then stop working. We do not use advertising or analytics cookies; our website statistics (section 2) work without cookies and without storing anything on your device. Pages of other services you open, such as Stripe Checkout or a platform’s login page, have their own cookie notices.

8. Changes

We will tell you by e-mail before material changes to this policy take effect.