Privacy Policy

Draft for owner review — complete the controller identity, contact details, actual retention schedule, processors and transfer arrangements before launch.

Who is responsible

The controller of account and service administration data is [full legal business name and registered address]. Privacy contact: [insert monitored privacy email]. See Contact Us for current contact details.

Information processed

Sphedora stores your account name and email, password hash managed by WordPress, timezone, social account identifiers, account labels, connection status, encrypted access credentials, uploaded images, post content, schedules, publishing results and subscription identifiers/status. Payment details and billing information are handled by Stripe and the payment seller shown at checkout; this plugin does not collect full card numbers or card security codes. Registration abuse prevention uses a temporary salted hash derived from the connecting IP address. Hosting and other installed website software may maintain additional security logs.

Purposes and legal bases

We process information to operate your account, connect authorised social accounts, publish your instructions, manage subscriptions and respond to support requests, based on performance of our contract or steps requested before it. Security and abuse prevention rely on legitimate interests, subject to your rights. Legally required accounting and compliance processing relies on legal obligations. Optional marketing or non-essential cookies require an appropriate separate legal basis and consent where required.

Who receives information

Content and relevant account identifiers are sent to the social networks you choose for publication. Our hosting provider, payment service and authorised support personnel may process information needed for their roles. Complete provider list and processing locations: [insert verified hosting, payment, email, backup and other service providers]. Social networks also process published content under their own policies. Uploaded image URLs used for publication may be publicly accessible; never upload confidential material.

Security and retention

Social access credentials are encrypted on the server. Passwords are managed by WordPress. No system can guarantee absolute security. Data is retained for the purposes described here and applicable legal obligations. Exact retention periods and backup deletion schedule: [insert verified periods for account data, credentials, uploaded media, post archives, logs, payment records and backups]. Removing a social connection cancels its queued posts and removes its stored credentials, while its publishing archive remains. Cancelling a subscription does not automatically erase your WordPress account or archive. Contact us for a deletion request.

International transfers

Some providers or destination networks may process information outside the European Economic Area. Countries, transfer mechanisms and how to obtain details: [insert verified arrangements, such as an applicable adequacy decision or standard contractual clauses].

Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability or object to certain processing. Where consent is used, you may withdraw it without affecting earlier lawful processing. Contact the privacy address above; we may need proportionate identity verification. You may complain to your relevant data protection authority. There is no automated decision-making with legal or similarly significant effects implemented by this plugin.

Cookies and other website tools

WordPress uses login/session cookies needed for the workspace. Additional analytics, advertising or other plugins may have their own cookies; the site owner must disclose these and configure any required consent before enabling them. Cookie inventory and durations: [complete after checking the live website].

Business content and updates

If you upload personal data relating to your customers or other people, ensure you have authority and a lawful basis. Where Sphedora acts as a processor for business customers, appropriate data processing terms must be agreed before that processing. We will publish updates to this notice and notify material changes where required.