In Súbelo you connect your Instagram, TikTok, YouTube and LinkedIn accounts and upload videos so they publish themselves. This involves managing your data and access credentials to your networks. Here I explain exactly what I keep, why, how long and how to delete it.
Who am I
Data controller: Rubén Hernández Alcaraz, NIF 23009135G, Cartagena (Murcia), Spain. Complete postal address for notification purposes, available instantly by writing to the email below.
Contact email for any privacy issues: hola@subelo.app
What data do I process?
Your account details. Your email and, if you register with Google, your name and profile photo. Nothing more: I don't ask for a phone number, postal address, or date of birth.
Billing details. If you subscribe, Stripe processes your payment. I do not see or save your card number at any time: I only receive from Stripe a customer ID, the last four digits, and the subscription status. The tax data needed for the invoice is stored and managed by Stripe.
Your videos and their texts. The video file you upload, the description, the title and the hashtags.
Credentials from your social networks. When you connect an account, the corresponding platform gives me access keys (tokens) that allow publishing on your behalf. I never know or receive your Instagram, TikTok, YouTube or LinkedIn password. You give the authorization directly on the website of each platform.
Pre-launch waiting list. If you joined the pre-launch waiting list, I save your email and, if you decide to reply to me, how many vertical videos you publish per week and on which networks. It is not necessary to create an account, and these two responses are voluntary: you can sign up by giving only the email.
Technical data. Application activity logs: what post was released, at what time, whether it succeeded or failed, and with what error. They serve to give you support and to retry what didn't work.
What do I use them for and on what legal basis
To provide you with the service: publish your videos on the networks you connect, show you the status of each publication and retry those that fail. Legal basis: the execution of the contract that you accept when registering.
To charge you and issue the invoice, if you contract a payment plan. Legal basis: execution of the contract and compliance with tax obligations.
To notify you when something breaks: a failed post, an expired connection, a declined payment. Legal basis: execution of the contract. These notices are not advertising and cannot be deactivated while you have an active account, because without them the service does not work.
To improve the tool and prevent abuse. Legal basis: my legitimate interest in the service being stable and not used to publish illegal content.
To notify you that Súbelo is open, if you join the waiting list. Legal basis: your consent, which you give when submitting the form. I use that email only for this purpose: I neither put you on an advertising list nor pass it on to anyone. You can leave whenever you want by writing to me at hola@subelo.app, and the opening notice will have its own link to unsubscribe.
To send you product news, only if you expressly mark it. Legal basis: your consent, which you can withdraw at any time from any email.
I do not sell your data to anyone. I do not provide them for advertising purposes. I do not train artificial intelligence models with your videos.
Your videos: where they are and how long they last
Videos are saved encrypted on Cloudflare R2. To publish them, Instagram and TikTok download them from a temporary and signed address that expires on its own; YouTube and LinkedIn receive them directly from my server.
I keep the video for 48 hours after all its posts have finished, so you can check the preview. Then I delete it in the next automatic cleanup, which runs every hour, or sooner if you delete it. If you still have pending submissions, drafts, or errors that you can retry, it is not deleted because you have finished one of your posts. After deletion I keep the record (title, date and result on each network), not the file or its preview.
Keep in mind one obvious but important thing: once published on Instagram, TikTok, YouTube or LinkedIn, that video is on their servers and is governed by the policies of each platform. Deleting it from Súbelo does not delete it from them.
Your connected accounts
Instagram and Facebook
I use the Meta Instagram Platform APIs to post to your professional account. I receive your account ID, username, profile photo, and permission to post content. I do not read your direct messages, I do not access your follower list and I do not publish anything that you have not created on Súbelo.
When you have Facebook Connection enabled, you can separately authorize a Page you manage. I use your ID, name and page permission to publish the reels you choose and check their status and link. I save the encrypted permission and the identifier of the user who authorized it to respond to its withdrawal or deletion request. The video is downloaded from a signed temporary URL from Súbelo storage. The page reels audience is public; indicated before publishing. This connection does not rely on automatic sharing from Instagram nor does it allow posting to personal profiles.
TikTok
I use TikTok's Content Posting API. I receive your handle, your username, your photo, and your account's posting settings: what privacy levels it supports and whether you have comments, duets, or stitches turned off.
You choose the privacy level of each video before publishing, on the Súbelo screen itself: the application does not decide it for you nor does it have a default value. It's what TikTok demands and it's what Súbelo does.
YouTube
Súbelo uses YouTube API Services. By connecting your channel you also accept the YouTube Terms of Service, and Google's processing of your data is governed by the Google Privacy Policy.
I ask for two permissions and no more: upload videos to your channel, and read the name and ID of the connected channel. This is needed to show the connected channel in your dashboard and help you avoid publishing to the wrong one.
I don't read your comments, I don't manage your playlists, I don't touch your existing videos, and I don't check your channel stats.
You choose, video by video, whether it is published public, unlisted or private. Súbelo does not decide that for you.
From YouTube I save only the name and identifier of your channel, and the identifier and link of the videos you publish from here. Their developer guidelines don't allow you to save that data for more than 30 days without refreshing it, so:
- Your channel name is automatically checked again every 25 days. Yes It is no longer possible (you have removed the permission, or the channel no longer exists), it is deleted.
- The identifier and link of each published video are deleted after 30 days. The video is still on your channel; What disappears is my copy of the data.
- If you press "Disconnect", I withdraw the permission in Google and delete the name and identifier of your channel and access codes.
You can revoke Súbelo access at any time from the Google Account permissions page.
I ask for three permissions and no more: openid and profile, which give me your identifier, your name and your profile photo so I can show you on the panel which account you have connected to, and w_member_social, which is the one that allows you to publish in your name. I do not read your network of contacts, I do not access your messages and I do not consult the publications you already had.
You choose who can see each video (anyone or only your contacts) before publishing. LinkedIn does not provide long-term permissions to applications like Súbelo: access expires after 60 days and you have to reconnect the account by hand. I'll let you know before it happens.
You can revoke Súbelo's access to your Google Account at any time from the Google security permissions page (also accessible at https://security.google.com/settings/security/permissions).
Limited Use. Súbelo's use of information received from Google APIs is in accordance with the Google API Services User Data Policy, including limited use requirements. In English, for the avoidance of doubt: "Súbelo's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
In practice this means that your Google account data is used only for the function you see: showing you which channel you are connected to and uploading the video you give me to that channel. They are not used for advertising, nor to segment, nor to sell or assign them to anyone, nor to train artificial intelligence models.
How are those credentials saved?
The access keys are encrypted with AES-256-GCM before being saved, and live in a table that no query made from the browser reaches: only the server can decrypt them, and only to publish what you have scheduled. If someone took a copy of the database, they wouldn't be able to publish on your behalf.
You can disconnect any network from your panel. By doing so, I immediately and permanently delete your credentials.
Who do I share data with?
Only with the suppliers necessary for this to work, all subject to a data processor contract:
| Supplier | For what | Where |
|---|---|---|
| Supabase | Database and user accounts | European Union (Paris) |
| Cloudflare R2 | Video storage | European Union |
| Vercel | Application Hosting | European Union |
| Stripe | Subscription collection and billing | European Union / USA |
| Meta, TikTok, Google, LinkedIn | Publication on the networks that you connect | According to each platform |
Transfers outside the European Economic Area, when they exist, are covered by the Standard Contractual Clauses approved by the European Commission.
In addition, I can communicate data to the authorities when a regulation obliges me.
How long do I keep each thing
The published videos, 48 hours from the end of their posts and until the next automatic cleaning (every hour), unless you delete them before. Files with pending posts are retained for completion. The credentials of your networks, while the connection is still active. If you disconnect it, they are deleted instantly. Your account data and posting history, while you have an open account and 30 days after you close it. The waiting list email, until Súbelo opens and notifies you, or until you ask me to leave. If a year after signing up I still can't open it, I'll delete it and start again: I'm not going to keep anyone's email indefinitely waiting for three platforms to approve me. The invoices, 6 years, because I am obliged by Spanish commercial and tax regulations. I can't delete this even if you ask me to.
Your rights
You can ask me to access your data, rectify it, delete it, limit or oppose its processing, and take it to another service. Write to hola@subelo.app from your account email and I will respond within a maximum period of 30 days.
How to delete all your data
From your panel, in Settings, you have a button to delete account. By pressing it, I immediately and definitively delete your videos, the credentials of all your connected networks and your personal data. Only the invoices survive, due to the legal obligation that I told you above.
If you can't log into your account, request it at hola@subelo.app.
If you think that I have not complied, you can complain to the Spanish Data Protection Agency.
Security
Everything travels encrypted via HTTPS. Your network credentials are also encrypted at rest. Access to the database is restricted by row-level policies, so that no user can see another user's data, even due to a programming error. If a breach ever occurs that affects you, I will inform you and notify the AEPD within the 72 hours established by law.
Minors
Súbelo is not aimed at minors under 18 years of age and accounts under that age cannot be created.
Changes
If I change anything relevant to this policy, I will notify you by email at least 15 days in advance. The date of the last update is at the top.