Privacy policy

Who is responsible

HERBST TECNOLOGIA E GESTÃO, UNIPESSOAL LDA (“HERBST”, “we”), a private limited company registered in Portugal with its seat at Rua Ribeiro Marmeleiro, n.º 100, R/C, Chão das Maias, 2300-227 Serra, Tomar, Portugal, tax and company number 518966917. Privacy contact: vitor@eaiagency.io.

This policy covers Nexxor Studio, available at studio.nexxor.app, and every social network integration the service offers. The Portuguese version prevails in case of discrepancy.

What data we process

Account data

• Name, email, password (stored only as an irreversible hash), language and time zone.
• The brands and teams you create, and the roles and permissions given to each person.
• Billing data when you subscribe to a paid plan: name or company, tax number, billing address and invoice history. Card details are handled only by the payment provider and never reach us.

Data from the social networks you connect

When you authorise Nexxor Studio to access an account, we receive only what that authorisation allows and what the service needs:

• Meta (Facebook and Instagram): ID, name and picture of the Pages and Instagram professional accounts you choose; access tokens; permission to publish content and to read the status and basic metrics of posts made through the service.
• LinkedIn: ID, name and picture of the profile or the company pages you administer and choose; access tokens; permission to post to those pages.
• YouTube (Google): channel ID, name and picture; access tokens; permission to upload videos and set their title, description, privacy and thumbnail.

We do not read private messages, we do not collect data about your followers, and nothing is published without an action by you or your team (scheduling, approving or publishing).

Content you create

Texts, images, videos, internal comments, notes, approval decisions and each post's history.

External reviewers

If you send a post for approval to someone without an account, we process that person's email and the decision they make.

Technical data

IP address, browser type, access and error logs, kept for security and troubleshooting. We use only cookies that are strictly necessary for the session. We use no advertising or tracking cookies.

Why we use the data

• To provide the service: store, schedule, send for approval and publish your content to the accounts you connected, and show each post's status.
• To manage the account, team, permissions and billing.
• To send service notices: failed posts, expired connections, approval requests.
• To keep the service secure, prevent abuse and meet legal obligations.

We do not sell personal data, we do not use it for advertising and we do not use it to train artificial intelligence models. Data obtained through the Meta, LinkedIn and Google APIs is used only for the user-facing features the user requested.

Legal bases

• Performance of a contract (GDPR article 6(1)(b)): everything needed to provide the service you signed up for.
• Legal obligation (6(1)(c)): invoicing and tax record keeping.
• Legitimate interest (6(1)(f)): security, fraud prevention and improving the service with aggregated data.
• Consent (6(1)(a)): connecting each social account, which you may withdraw at any time, and marketing emails if you opt in.

Google and YouTube services

Nexxor Studio uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the use of that data is also subject to the Google Privacy Policy.

You can revoke Nexxor Studio's access to your Google data at any time on your Google Account permissions page. Nexxor Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

• The social networks you connect (Meta, LinkedIn, Google/YouTube): only the content you tell us to publish, when you tell us to. These platforms process it as independent controllers under their own policies.
• Providers working for us, under data processing agreements and only as needed: server hosting (Hostinger, data centre in France), transactional email and payment processing.
• Authorities, where the law requires it.

Where the data is kept

Nexxor Studio's servers are in the European Union (France). When you publish to a social network, the content is sent to that platform, which may process it outside the EU under its own transfer mechanisms, such as standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

• Account data and content: while the account is active and up to 30 days after a deletion request. Backups are overwritten within a further 30 days at most.
• Social network access tokens: deleted as soon as you disconnect the account or delete the brand.
• Technical logs: up to 90 days.
• Invoices and tax data: 10 years, as Portuguese law requires.

Your rights

You may request access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time without affecting processing already carried out. Write to vitor@eaiagency.io; we reply within 30 days.

You also have the right to complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).

To delete your data and disconnect your social networks, follow the instructions on Data deletion.

Security

Encrypted connections (HTTPS), access tokens stored encrypted, each customer's data kept separate, internal access limited to what is needed, and regular backups.

Children

Nexxor Studio is meant for businesses and professionals. It is not intended for anyone under 16 and we do not knowingly collect their data.

Changes

If we change this policy in a meaningful way, we will tell you by email or inside the service before the change takes effect. The date at the top shows the version in force.