WedaloHub – Privacy Policy

This policy explains what personal data the WedaloHub panel at hub.wedalo.dev (the “Panel”) processes, why, for how long and what your rights are. We apply the UK GDPR and the Data Protection Act 2018, and – for people in the European Union or EEA – the EU GDPR (Regulation (EU) 2016/679).

1.Controller

The controller of the personal data of Panel users is Wedalo Ltd, Company number 17499535, registered in England and Wales, registered office: 31 School View, Banbury, OX16 4SE, United Kingdom (the “Operator”). Contact for data matters: hello@wedalo.dev.

2.Two roles of the Operator

• Controller – for the data of people who have an account in the Panel (the account owner and their staff). This policy covers that data.
• Processor – for third-party data the customer processes in the Panel: authors of comments under the customer’s posts, people appearing in the customer’s videos, and data from the customer’s Google Analytics and Search Console accounts. The customer is the controller of that data and the Operator processes it only on the customer’s instructions, under the data processing terms in section 12 of the Terms of Service.

3.Data we process

• Account data: company or personal name, email address, password (stored only as a salted scrypt hash), chosen plan, notification settings.
• Sign-in security: encrypted two-factor authentication secret, active sessions, short-lived counters of failed sign-in attempts (kept in server memory; IP addresses are not stored in the database).
• Billing (when you pay online): subscription status, Stripe customer ID, billing address and VAT number. We do not store card details – only Stripe holds them.
• Connected accounts: encrypted (AES-256-GCM) access tokens for YouTube, Facebook, Instagram, TikTok, Google Search Console and Google Analytics; channel and page identifiers.
• Content and publishing: videos, titles, descriptions, hashtags, scheduled times and publishing results, replies to comments, auto-reply rules.
• Platform data: comments (author name and text), account statistics, Search Console queries and clicks, aggregated traffic data from Google Analytics.
• Websites and SEO: website addresses, uptime and audit results, tracked keywords and positions, content of pages built with the site builder and directory listings.
• Activity log: key account events (publishing, connection changes, password changes, Operator previews of the account) and email delivery history (address, subject, result).

4.Purposes and legal bases

• Running your account and providing the Panel, including email alerts and reports (you can switch them off in Settings) – performance of a contract (Art. 6(1)(b)).
• Billing and accounting records – legal obligation (Art. 6(1)(c)).
• Security (two-factor authentication, sign-in limits, activity log, backups), handling requests and possible claims – legitimate interests of the Operator and customers (Art. 6(1)(f)).

We do not sell data, use it for advertising or profile you. The Panel contains no third-party analytics or advertising tools.

5.Data from Google, YouTube, Meta and TikTok accounts

• You connect a platform account yourself with the “Sign in with…” button and approve the permissions on the platform’s own page.
• We use platform data only for the features you see in the Panel: publishing, comments, statistics and data about your website. We do not share it with other parties (except the infrastructure providers in section 6), do not use it for advertising or to train artificial intelligence models, and Operator staff do not read it except for support you ask for, fixing failures, or legal requirements.
• WedaloHub’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• By using the YouTube features you agree to the YouTube Terms of Service; Google also processes the data under the Google Privacy Policy.
• You can revoke access at any time in the Panel (Connections → Disconnect) or in the platform’s settings – for Google: myaccount.google.com/permissions. After disconnection we delete the token.

6.Who we share data with

Only with providers the Panel cannot work without. Currently:

This list is kept current – we add a provider before it starts processing data. Transfers outside the UK and the EU/EEA rely on adequacy decisions (including the EU–US Data Privacy Framework and its UK Extension) or standard contractual clauses.

The platforms you connect (Google, Meta, TikTok) are not our sub-processors – we exchange data with them on your instructions and under their own terms. If you add your own Anthropic API key in Settings (the “AI suggestion” feature), the text of the comment you are replying to is sent to Anthropic under your account and your agreement with Anthropic; without a key the feature sends nothing.

7.How long we keep data

• Account data and content – for the duration of the contract and 30 days after it ends (in case you return); then deleted. Accounts whose free trial or paid period ended without payment are deleted automatically after 30 days.
• Backups – a daily backup kept for 14 days (and up to 30 days if we use off-site backup storage). Deleted data disappears from backups after that time.
• Videos – until the post or account is deleted; files not linked to any post are deleted after 24 hours.
• Activity log and email delivery history – 12 months.
• Billing records – for the period required by tax law.
• Sign-in verification codes – 5 minutes; sign-in attempt counters – 15 minutes.

8.How we protect data

• HTTPS only; the session cookie is inaccessible to scripts and sent only over HTTPS.
• Passwords as salted scrypt hashes; platform tokens, integration keys and two-factor secrets encrypted (AES-256-GCM).
• Two-factor authentication for the Operator’s account and available to every customer.
• Each customer sees only their own data; the Panel is excluded from search engines, and customer content is private unless the customer publishes it and the Operator enables the public directory or pages.
• The Operator opens a preview of a customer account only at the customer’s request or to fix a failure or security incident; every preview is recorded in the log.
• Server in the European Union with automatic security updates; daily verified backups.

9.Your rights and data deletion

You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You can also lodge a complaint with a supervisory authority: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom (ico.org.uk). If you are in the EU or EEA, you may also complain to the supervisory authority in your country (in Poland: Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).

Deleting your data: email hello@wedalo.dev from the address linked to your account. We will delete the account together with its content, platform tokens and data fetched from platforms within 30 days and confirm by email. The same way you can get a copy of your data (JSON or CSV). You can revoke platform access yourself at once (section 5). These are also the data deletion instructions required by Meta and TikTok.

Deleting through Facebook: if you remove the WedaloHub app in your Facebook settings (Apps and websites) and ask for your data to be deleted, Meta sends us the request automatically. We immediately delete the Facebook and Instagram connections linked to your Meta account, together with the comments and statistics fetched from them, and Facebook shows you a confirmation code and a link to the status of the request.

10.Cookies

We use only cookies that are strictly necessary for the Panel to work – no analytics or advertising cookies – so we do not ask for consent.

11.Changes

We announce material changes by email or in the Panel at least 14 days before they take effect. The current version is always at hub.wedalo.dev/privacy.