Privacy Policy

1. Who we are

nomad social planner is a tool for planning social media content with clients and getting it approved. It is provided by Borbála Nagy, sole entrepreneur, trading as Nomad Creatives (“we”, “us”), Herman Ottó utca 4, 9024 Győr, Hungary, tax number 71769583-2-28.

We are the controller of the personal data described in this policy. For any question about your data, or to exercise your rights, write to bori.nagy@gmail.com.

Agencies, however, are the controllers of the personal data of their clients and client users that they put into the app. We process that data on the agency's behalf, as its processor, under the data processing agreement.

The app is not open for sign-up. People join by invitation from an agency administrator, as agency staff (administrators and employees) or as client users.

2. What data we process, why, and on what basis

For each kind of data below we say what it is, why we use it, and the legal basis under Article 6(1) of the General Data Protection Regulation (GDPR). The bases we rely on are:

• Contract (Art. 6(1)(b)): the data is needed to provide the app to you under our agreement.
• Legitimate interest (Art. 6(1)(f)): where you use the app on behalf of a client or agency that has the agreement with us, we rely on our interest, and theirs, in carrying out the agreed work, and on our interest in keeping the app secure and working. You can object to this (see section 7).
• Consent (Art. 6(1)(a)): only for the optional Google Drive and Canva connections. You can withdraw it at any time by disconnecting Google Drive or Canva in the app, or by writing to us.

How long we keep each kind of data is summarised here and set out in full in section 5. You need to give us your name and email address to have an account; everything else is either created as you use the app or optional.

Not all of this data comes from you. An administrator enters your email address and role when inviting you, the activity log records actions that you and others take in the app, and other people's comments, approvals and notifications may mention you.

Account data

Your name, email address and whether it is confirmed, an optional profile photo, your role, your agency, your notification preferences, your password (stored only as a hash, never readable), and when the account was created, updated, disabled or deleted. We use it to sign you in, show who did what, and send you the emails you need. Basis: contract, or legitimate interest where you act for a client or agency. Kept while your account exists.

Invitations

When an administrator invites someone, we keep the invited email address, the role offered and who sent the invitation. Only a hash of the invitation link's token is stored. Purpose: letting the invited person create their account. Basis: legitimate interest. Kept until the invitation is accepted or withdrawn; the link stops working after 7 days.

Sign-in sessions

When you sign in we create a session that records your IP address and your browser's user agent. Purpose: keeping you signed in and protecting your account. Basis: contract and legitimate interest (security). A session is valid for 30 days and is extended once a day while you use it, but never beyond 90 days after you signed in; then you sign in again. It is deleted when you sign out, when your password is reset (all your sessions) or changed (your other sessions), and when your account is disabled or deleted.

Client work

Plans, posts, captions, comments, images and videos, alternative grids, approvals, and a record of who submitted and approved what. Purpose: the planning and approval work itself, shared between the agency and the client. Basis: contract, or legitimate interest where you act for a client or agency. Kept as described in section 5 (deleted items are removed for good after 15 days).

Staff and client users can export a plan as a PDF. This is a copy of the plan, not a copy of your personal data; for that, see section 7.

Activity log

A record of who did what and when: the person's name at the time, their role, the action, what it concerned (for example an invited email address) and what changed. It also records sign-in, sign-out, password changes and resets, and account creation. It stores no IP address or browser details. Purpose: accountability for the shared work and the security of accounts. Basis: legitimate interest. Kept while the agency's account exists; if a person is deleted, their name is replaced by “Deleted user”.

Notifications and emails

In-app notifications (who they are for, their type, who triggered them, plan and post names, and short excerpts of comments or captions) and whether the matching email was delivered. We send emails to confirm your address, reset your password, invite you, tell you that you have been added to a client, and notify you about activity. Purpose: keeping you informed about the work you take part in. Basis: contract, or legitimate interest where you act for a client or agency. Notifications are kept while your account exists. An unsent notification email is retried for up to 24 hours.

You can turn notification emails off with the one-click unsubscribe link in each of them, or on your account page. Account and security emails cannot be turned off.

Presence and live updates

While you have a plan open, other signed-in people can see that you are viewing it. This record is deleted 10 minutes after your browser last checks in, or sooner when you close the tab or sign out. To refresh open pages when something changes, we keep short events that contain only internal ids; they are deleted after 24 hours. Purpose: working together without overwriting each other. Basis: legitimate interest.

Technical logs and error reports

Our hosting provider keeps technical logs of requests and errors, and error reports are sent to our error monitoring service. To limit repeated sign-in attempts we use your IP address in memory only; it is never stored for this. Purpose: keeping the app secure, working and fixed. Basis: legitimate interest. Logs and reports are kept for the period our providers keep them and are used for nothing else.

Google Drive connection (optional, staff only)

Where it is enabled, agency staff can connect a Google account to import files from Google Drive. We store the Google account's email address, an encrypted refresh token that lets the app reach Drive for you, and its permission, which covers only the files you pick. Google's file picker is loaded from Google (apis.google.com) when you open it, so Google receives the usual technical data of that request. Basis: consent.

You can withdraw consent at any time by disconnecting Google Drive in the app, or by writing to us. Disconnecting deletes the stored email address, token and permission, and asks Google to revoke the app's access. Imports already queued then fail. The connection is also deleted with your account.

For each import we keep the Drive file's id, name, type and size, and whether the import succeeded. This record stays after you disconnect. It is deleted when you dismiss a failed import, when the post or plan it belongs to is permanently deleted, or when your account is deleted.

Canva connection (optional, staff only)

Where it is enabled, agency staff can connect their own Canva account to import pages of their Canva designs. We store the Canva account's display name, encrypted access and refresh tokens that let the app reach Canva for you, and the permissions you granted (reading your profile, your designs' names and their content). The app fetches the names of your designs when you browse them and only the pages you choose to import. Basis: your consent (Art. 6(1)(a)).

You can withdraw consent at any time by disconnecting Canva in the app, or by writing to us. Disconnecting deletes the stored name, tokens and permissions, and asks Canva to revoke the app's access. The connection is also deleted with your account.

Instagram connection (optional, per client)

At the agency's request, a client's Instagram account and its Facebook Page can be connected to the app. We store the Instagram account's id and username, the Facebook Page's id and name, an encrypted Page access token, the permissions granted, and who connected it. Purpose: publishing approved posts to that Instagram account and reading their status. Basis: contract with the client, or legitimate interest in carrying out the work agreed with the client.

An agency administrator can disconnect the account in the app at any time, which deletes this stored data and the token. Facebook keeps its own record of the permission until the person who connected it removes it in their Facebook settings (Business Integrations). Otherwise the data is kept until the account is disconnected or the client is deleted.

We use no analytics or advertising trackers, we make no automated decisions about you, and we do not sell personal data.

3. Who receives the data

Agency staff and the client users of the same client see the client work, comments and approvals they share. We use the following service providers, who process data on our behalf and only on our instructions:

• Railway (Railway Corporation): hosting, database and server logs. Data is stored in its EU West region (Amsterdam, the Netherlands).
• Cloudflare R2 (Cloudflare, Inc.): storage of uploaded images and videos, under EU jurisdiction, so the files stay in the EU.
• Cloudflare Stream (Cloudflare, Inc.): processing and playing videos. It receives only the video file and an internal id, no account data. It runs on Cloudflare's global network (see section 4).
• Cloudflare Turnstile (Cloudflare, Inc.): a bot check on the sign-up form for new agencies. The check runs in the browser from Cloudflare; to confirm it, we send Cloudflare the check's token and the IP address of the person signing up.
• Resend (Resend, Inc.): sending emails, from its EU region (Ireland).
• Sentry (Functional Software, Inc.): error reports, stored in its EU region.

Only when the optional connections are used:

• Google (Google Ireland Limited and Google LLC): Google Drive import and the Google file picker.
• Canva (Canva Pty Ltd, Australia): the optional Canva connection and import.
• Meta (Meta Platforms Ireland Limited): the Instagram connection. Content is sent to Instagram at the agency's request, and Meta handles it under its own terms and privacy policy.

4. Transfers outside the EU

We keep data in the European Union where our providers offer it: the database with Railway in the Netherlands, files in Cloudflare R2 under EU jurisdiction, emails from Resend in Ireland, and error reports in Sentry's EU region.

Railway, Cloudflare, Resend, Sentry and Google LLC are companies based in the United States, Canva Pty Ltd is based in Australia, and Cloudflare Stream has no EU-only option, so video files may be processed outside the EU. Where data is transferred to or accessed from outside the EU, the transfer relies on the European Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

5. How long we keep data

• Recently deleted: deleted plans, posts, captions, comments, media and grids stay in Recently deleted for 15 days so they can be restored, then are deleted permanently, including the image and video files.
• Archived clients: plans and media of an archived client are kept until an agency administrator deletes the client. There is no automatic deletion.
• Agency deletion: an agency that an administrator schedules for deletion is deleted for good 15 days later: its clients with their plans, posts, comments and files (including trashed ones), client logos, the activity log, invitations and staff accounts. A client user whose only agency this was has their account anonymised as “Deleted user”; a client user who also works with another agency keeps their account and that agency. Nothing can be restored afterwards, and backups keep the data for up to 30 more days.
• Accounts: while the account exists; see section 6 for what deletion removes.
• Sessions: 30 days, extended once a day while used, at most 90 days after sign-in, and deleted on sign-out, password reset or change, or when the account is disabled or deleted.
• Invitations: until accepted or withdrawn; the link expires after 7 days.
• Activity log: while the agency's account exists; a deleted person's name is replaced by “Deleted user”.
• In-app notifications: while the recipient's account exists, and deleted with it. Unsent notification emails are retried for up to 24 hours.
• Presence: 10 minutes. Live-update events: 24 hours.
• Backups: kept for 30 days, so deleted data also leaves the backups within 30 days.

6. Deleting an account

Client users can delete their own account in the app, with immediate effect. An agency administrator can delete a person's account; administrators cannot delete themselves or other administrators. You can also ask us by email to delete your account.

When an account is deleted:

• the name is replaced by “Deleted user”;
• the email address, profile photo, password, sessions, notifications, email preferences, Google Drive connection and import records, Canva connection, and invitations are deleted;
• the person's name is removed from the activity log and from other people's notifications.

Comments, captions and approvals the person wrote stay, shown as “Deleted user”, because they are part of the shared work record of the agency and the client. Deleted data leaves our backups within 30 days.

Deleting a whole agency is covered in section 5, under “Agency deletion”.

An administrator can also disable an account instead. This can be undone, and it signs the person out everywhere.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased;
• have processing restricted;
• receive the data you gave us in a portable format (data portability);
• object to processing based on legitimate interest;
• withdraw your consent at any time, without affecting processing before the withdrawal.

You can change your notification preferences yourself on your account page. There is no self-service export of personal data: for access, a copy, or any other request, write to bori.nagy@gmail.com. We answer within one month. If a request is complex, we may extend this by up to two further months and will tell you why within the first month. We may ask you to confirm your identity before acting on a request.

8. Complaints

If you think we handle your data unlawfully, please write to us first so we can put it right. You can also complain to the Hungarian data protection authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
naih.hu, ugyfelszolgalat@naih.hu

You may also complain to the authority in the EU country where you live or work, and you have the right to go to court. In Hungary the case is heard by the regional court (törvényszék); you may bring it before the court of the place where you live or stay.

9. Cookies and browser storage

We use only our own cookies that the app needs to work. There are no analytics or advertising cookies, so we do not ask for cookie consent.

• better-auth.session_token (30 days, at most 90 days after sign-in): keeps you signed in.
• nomad_login_device (90 days): remembers that this browser has signed in before, so it is not caught by the lockout after failed sign-in attempts. It never signs anyone in.
• nomad_view_as (30 minutes): lets agency staff preview the app as a client sees it.
• nomad_unit (1 year): which client a client user is viewing.
• theme (1 year): your light or dark theme choice.
• drive_oauth, canva_oauth and meta_oauth (10 minutes): protect the Google, Canva and Meta connection steps.

The app also keeps a few settings in your browser's storage: your notification sound and pop-up settings, an id for the open tab, and the item you selected for review.

10. Security and backups

Passwords are stored only as hashes. Invitation links are stored only as hashes. Access tokens for Google, Canva and Meta are encrypted. Repeated failed sign-in attempts are limited, and an account can be disabled at once, which signs the person out everywhere.

We back up the database daily and keep each backup for 30 days, so we can recover from a failure. After that the backup is deleted, which is why deleted data can remain in backups for up to 30 days.

11. Changes to this policy

The date of the current version is shown at the top of this page. If we change this policy materially, we will ask you to accept the new version the next time you use the app.

12. Language

This policy is available in Hungarian and English. If the two differ, the Hungarian version prevails.