Privacy Policy

Last updated: MM/DD/YYYY · Version: 1.0

GDPR compliant (EU Regulation 2016/679) and aligned with third-party platform requirements (Meta Platform Terms, TikTok Developer Policy, Google API Services User Data Policy, LinkedIn API Terms). We apply principles of minimization, transparency, explicit consent and security by default.

1. Data controller

Publisher: Thomas Taggae
Address: [9 rue de Condé, 33000 Bordeaux, France]
SIRET: 979 493 392 00018
Contact / DPO email: contact.ariaceo@gmail.com
Official website: ariaceo.com

2. Data collected

Category	Specific data	GDPR legal basis
Account	First name, last name, email, password (bcrypt hashed), registration date	Contract performance (art. 6.1.b)
Billing	Billing address, payment history (amounts, dates, PDF invoices)	Legal accounting obligation (10 years, art. 6.1.c)
Payment	No banking data stored. Full processing by Stripe (PCI-DSS level 1).	Contract performance
Application usage	Action logs, submitted prompts, generated content, quota usage metrics	Contract + legitimate interest (product improvement)
Platform OAuth tokens	Access tokens, refresh tokens, granted scopes (AES-256 encrypted)	Explicit consent (art. 6.1.a)
Data from social networks	See section 4 (detailed by platform)	Explicit consent
Technical data	IP address, browser type, OS, language, pages visited, session duration	Legitimate interest (security, fraud prevention, aggregated stats)
Marketing communications	Email for newsletters, product notifications, commercial offers	Consent (opt-in, unsubscribe possible anytime)

3. Processing purposes

Create and manage your customer account
Provide Aria service features (content generation, scheduling, analytics, intelligence, automations)
Publish your content on platforms you connect (with your consent)
Process payments and issue invoices
Send service notifications (renewal, payment failure, system alerts)
Improve the service (aggregated and anonymized statistics)
Prevent fraud and ensure service security
Meet our legal obligations (accounting, administrative requests, GDPR)
Send marketing communications (only with your explicit consent)

We never sell your data to third parties. No personal data is used for external advertising purposes.

4. Data from third-party platforms (OAuth)

When you connect your account to a third-party platform via OAuth, Aria CEO accesses only the data strictly necessary for the requested features. You can revoke this access anytime from your account or the third-party platform settings.

4.1 Meta (Instagram & Facebook)

Scopes: instagram_basic, instagram_content_publish, pages_show_list, pages_read_engagement, pages_manage_posts, business_management, email, public_profile.

Data retrieved: basic profile info, list of your Facebook Pages and Instagram Business accounts, engagement metrics on your own posts, media published via Aria CEO.

4.2 TikTok

Scopes: user.info.basic, video.list, video.upload, video.publish.

4.3 Google & YouTube

Sign in scopes: openid, email, profile. YouTube scopes if enabled: youtube.upload, youtube.readonly. Compliance with Google API Services User Data Policy and Limited Use requirements.

4.4 LinkedIn

Scopes: openid, profile, email, w_member_social.

4.5 Apple (Sign in with Apple)

Data retrieved: Apple ID, email (real or relayed), name (optional). Compliance with Apple Sign In Guidelines.

5. Sub-processors and recipients

Sub-processor	Role	Location	Guarantees
Supabase	User database & auth	EU (Paris/Frankfurt)	GDPR · DPA · SOC 2
Vercel	Website & API hosting	USA	SCC · DPA · ISO 27001
Stripe	Payment processing	EU (Ireland) + USA	PCI-DSS L1 · SCC · DPA
Meta Platforms	OAuth Instagram & Facebook	EU + USA	SCC · DPA
TikTok	OAuth TikTok	EU + other	SCC · DPA
Google	OAuth Sign in / YouTube	EU + USA	SCC · DPA
LinkedIn	OAuth LinkedIn	EU (Ireland) + USA	SCC · DPA
Apple	Sign in with Apple	USA	SCC

6. Non-EU transfers

Some sub-processors are located in the United States. These transfers are governed by Standard Contractual Clauses (SCC) approved by the European Commission, ensuring protection equivalent to GDPR. For US transfers, we also rely on the Data Privacy Framework when sub-processors are certified.

7. Retention period

Active account data: for the entire subscription duration
Deleted account: complete erasure within 30 days
Billing data: 10 years (legal accounting obligation)
Technical logs: 6 months maximum
OAuth tokens: as long as connection is active; deleted within 24h of revocation
Generated content: for the entire subscription duration, deletable anytime
Marketing data: 3 years after last contact, or until unsubscribe
Data from social networks: immediate deletion upon disconnection of third-party account

8. Data security

Transit encryption: systematic TLS 1.3 (HTTPS)
At-rest encryption: AES-256 on all sensitive data
Passwords: bcrypt hashing with unique salt per user
OAuth tokens: AES-256-GCM encrypted in database
Authentication: 2FA available, secure session management
Internal access: least privilege principle, audit logs
Backups: automatic, encrypted, geo-redundant
Audits: regular review of access and incidents
Breach procedure: CNIL notification within 72h and to affected persons if high risk

9. Your GDPR rights

Right of access — get a copy of your data
Right of rectification — correct inaccurate data
Right to erasure ("right to be forgotten") — delete your data
Right to restriction of processing
Right to portability — retrieve your data in structured format (JSON, CSV)
Right to object to processing (notably marketing)
Right to withdraw consent anytime
Right to post-mortem directives on your data
Right not to be subject to exclusively automated decisions

To exercise these rights, write to contact.ariaceo@gmail.com with proof of identity. Response within 1 month maximum.

10. Account & data deletion

See dedicated page: Account deletion and User data deletion.

11. Cookies

Detailed in our Cookies Policy. No advertising or profiling cookie is used without your explicit consent.

12. Minors

Aria CEO is strictly reserved for adults (18+). We do not knowingly collect minors' data. If a minor created an account by mistake, contact us for immediate deletion.

13. Policy changes

This policy may be updated. You'll be notified by email of substantial changes at least 30 days before they take effect.

14. Contact & complaint

Email: contact.ariaceo@gmail.com
Website: ariaceo.com

If you believe your rights are not respected, you can file a complaint with the CNIL (French data protection authority): cnil.fr · 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.