Privacy Policy

This instance is operated by an individual acting as the data controller under applicable data protection law, trading as Profile Tailors. The operator determines the purposes and means of processing for this instance.

The operator’s identity and contact details are listed in Section 10.

Processor relationship: When you use this instance to schedule and publish content to third-party platforms (such as LinkedIn), you determine the content and the publication instruction. The operator processes that content on your instructions as a processor for that specific purpose. For all other processing (account management, security, service operations), the operator acts as controller.

When you use this instance, we collect:

- Account data: email address, display name, avatar, and password (stored as a salted hash). - Session data: authentication tokens, refresh tokens, and session activity logs. - Workspace and membership data: workspace name, member list, roles, and permissions. - Social account connections: OAuth tokens and account identifiers for connected social platforms (e.g., LinkedIn). - Content and media: posts, drafts, scheduled content, uploaded media files, and publication metadata. - API keys and credentials: hashed API key verifiers, credential metadata, and access logs. - Audit and security logs: IP addresses, user-agent strings, request paths, timestamps, and access patterns. - Support and waitlist data: waitlist registration email, consent records, and any communications you send us.

We do not intentionally collect special categories of data (health, biometrics, political opinions, etc.). Do not upload such data to this instance.

We process your data for these purposes:

Account creation, authentication, and security — Contract necessity (performance of the service you signed up for).

Providing the content scheduling and publishing service — Contract necessity.

Processing your publishing instructions to third-party platforms (e.g., LinkedIn) — Your instruction (controller-to-processor direction).

Service security, abuse prevention, and incident response — Legitimate interest (protecting the service and its users).

Communications about service changes, security, or support — Contract necessity or legitimate interest.

Optional waitlist or marketing communications — Your consent (separately obtained).

Service improvement and analytics (non-identifying) — Legitimate interest (improving the service).

Where we rely on legitimate interest, you may object. Where we rely on consent, you may withdraw at any time.

We share your data only with these categories of recipients:

Infrastructure providers: - Cloudflare, Inc. — content delivery network, DNS, and edge security. Cloudflare acts as a processor. Data: IP address, request metadata, cached content. Region: global edge network. - Oracle Cloud — application hosting and PostgreSQL database. Acts as a processor. Data: all data stored or processed by the application. Region: Frankfurt, Germany.

Integrated platforms (when you use them): - LinkedIn — when you connect a LinkedIn account, your content and credentials are shared with LinkedIn as an independent controller or processor depending on the operation. See LinkedIn’s privacy policy for details.

We do not sell your personal data. We do not share data with advertising networks, data brokers, or analytics providers beyond what is described above.

All infrastructure providers are bound by data processing agreements that require them to protect your data and process it only on our instructions.

We retain your data for these periods:

- Account data: until you delete your account or the account is terminated. - Session tokens: up to 7 days (refresh token) or until logout. - Content and media: until you delete them or your account is terminated. - Published content: remains on the target platform according to that platform’s retention. - OAuth credentials: until you disconnect the social account or delete your Profile Tailors account. - Audit logs: up to 90 days. - Waitlist data: until you withdraw consent or the waitlist closes. - Backups: retained for up to 30 days after deletion, then securely erased.

When you delete your account, we initiate deletion of your active data within 30 days, except where we must retain data for legal obligations (e.g., tax records, if applicable).

Your data is processed in these locations:

- Application and database: Frankfurt, Germany. - CDN and edge network: Cloudflare global network (data centres worldwide). - Integrated platforms: LinkedIn servers (location depends on your region and LinkedIn’s infrastructure).

Where data is transferred from your country of residence to another country, we ensure appropriate safeguards are in place: - EU/EEA to third countries: Standard Contractual Clauses (SCCs) with infrastructure providers. - LinkedIn: Standard Contractual Clauses (SCCs) or other recognised transfer mechanism as adopted by LinkedIn Ireland. - Other regions: applicable transfer mechanisms as required by local law.

Contact us (Section 10) for a copy of the relevant safeguards.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

- Access: request a copy of the data we hold about you. - Rectification: correct inaccurate or incomplete data. - Erasure: request deletion of your data, subject to legal retention obligations. - Restriction: restrict processing in certain circumstances. - Objection: object to processing based on legitimate interest. - Data portability: receive your data in a structured, machine-readable format. - Withdraw consent: where processing is based on consent. - Lodge a complaint: with your local data protection authority.

To exercise any of these rights, contact us using the details in Section 10. We will respond within the timeframe required by applicable law.

If you are in the EU/EEA, you also have the right to lodge a complaint with your local supervisory authority.

This instance uses minimal browser storage:

Strictly necessary: - `pt_refresh` — HttpOnly cookie for session refresh (7-day expiry, Secure, SameSite=Lax). Cleared on logout. - `sidebar_state` — JavaScript-accessible preference cookie for sidebar state (7-day expiry). - Local storage: theme preference (marketing site), locale and theme settings (dashboard), active workspace, dashboard state, and publication drafts.

Analytics: - No advertising, tracking, or analytics cookies are used by default. Ahrefs Web Analytics may be loaded conditionally if configured by the operator; its default implementation is cookieless and does not use persistent identifiers.

Third-party: - When you connect a LinkedIn account, LinkedIn may set its own cookies according to its cookie policy. We do not control LinkedIn’s cookies.

You can manage cookies through your browser settings. Blocking strictly necessary cookies may affect service functionality.

We may update this policy when our data practices change, new features are added, or legal requirements evolve. Material changes will be notified through the application or via email.

The current version is always available at `/privacy/`. Your continued use after a change constitutes acceptance of the updated policy.

For privacy enquiries, data subject requests, or complaints, contact the operator:

Yuniel Acosta (trading as Profile Tailors) Email: contact@profiletailors.com

If you are in the EU/EEA and are not satisfied with our response, you may lodge a complaint with your local data protection authority.