Principles we apply to all of them
- Only what is needed: we request the minimum permissions for the feature you enable.
- Only for you: we use the data to provide the service in your workspace; nobody from another workspace can see it.
- Never sold or used to train models: we do not sell, rent or share platform data, we do not advertise with it and we do not use it to train artificial intelligence models.
- Encryption: access tokens are stored encrypted with AES-256-GCM, with a key that is not in the database.
- Deleted on disconnect: when you disconnect an account we delete its tokens and deactivate its destinations.
Meta: Facebook and Instagram
| Permission | What we use it for |
|---|---|
| pages_show_list | List the Facebook Pages you manage so you can choose where to publish. |
| pages_read_engagement | Read basic Page data and the response to your posts to show you results. |
| pages_manage_posts | Publish the text, links, photos and videos you schedule to your Page. |
| instagram_basic | Identify the Instagram professional accounts linked to your Pages. |
| instagram_content_publish | Publish the images and reels you schedule to your Instagram professional account. |
| business_management | Access the Pages and Instagram accounts you manage through a business portfolio. |
We store the identifier and name of each Page and account you choose, their access tokens and the identifier and link of each post. We comply with the Meta Platform Terms.
| Permission | What we use it for |
|---|---|
| openid, profile, email | Know which person authorises the connection. |
| rw_organization_admin | List the organization Pages you administer so you can choose where to publish. |
| w_organization_social | Publish what you schedule on behalf of those organizations. |
| r_organization_social | Read the organization's posts and their response to show you results. |
We only publish to organizations you administer, never to your personal profile unless you ask. We comply with the LinkedIn API Terms of Use.
Google: YouTube
| Permission | What we use it for |
|---|---|
| openid, email | Know which Google account authorises the connection. |
| youtube.readonly | Identify your channel and read your videos' data to show you results. |
| youtube.upload | Upload the videos you schedule to your channel, with their title and description. |
We store your channel's identifier and name, the access tokens and the identifier of each uploaded video. The YouTube API data we store is refreshed or deleted within 30 days at most, as required by the YouTube developer policies.
TikTok
| Permission | What we use it for |
|---|---|
| user.info.basic | Show the name and profile picture of the connected account. |
| video.upload | Send the videos you schedule to your account. |
| video.publish | Publish those videos to your profile. |
We store your account's identifier and name, the access tokens and the identifier of each video. We comply with the TikTok Developer Terms of Service.
YouTube API Services
LaunchSuite uses YouTube API Services to upload videos to your channel and read its data. By connecting your YouTube channel:
- You agree to be bound by the YouTube Terms of Service.
- The Google Privacy Policy applies to Google's processing of your data.
- You can revoke LaunchSuite's access to your data at any time from the Google security settings page.
LaunchSuite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We also comply with the YouTube API Services Terms of Service.
Ads, insights and creatives
These connections are optional and read-only except for what you approve. Controller: Codelabs Studio S.L., Málaga.
- Apple Ads (your own account): we generate a key pair for you; we store the private key and the client, team and key identifiers you paste, encrypted, and read your campaigns and spend to show them to you and apply your limits. They are kept while the connection exists. When you disconnect from the dashboard we delete that whole record (not possible while Apple campaigns created from the platform exist); if you close your account, it is deleted with the workspace after 30 days.
- Meta Ads (Marketing API): with the ads_read and ads_management permissions we read your accounts and campaigns (budget and spend). And with read_insights and instagram_manage_insights, the reach, engagement and clicks of your posts and campaigns. The token is deleted on disconnect; the figures already read are kept while the project exists.
- Plausible (per project): we store the site and your Stats API key (encrypted) to bring in visits and conversions by UTM. When you remove Plausible in the project settings we delete the site, the key and the stored figures.
- Meta Ad Library: we read competitors' public ads (public data that Meta publishes) for competitor analysis. They contain no data about specific individuals and are kept while the project exists.
- AvatarSuite: a Codelabs Studio S.L. product acting as a processor. It only receives the brief of the creative you request (product, description, angle, style, format, channel, aspect ratio and language) and returns the generated piece.
Publishing through Zernio
On the networks where we do not yet have a direct connection you can publish through Zernio, an external provider that acts as a processor. It is optional: it is only used if you choose it in the project settings and your workspace has it enabled.
- One profile per workspace: each workspace has its own profile in Zernio. The accounts you connect from the settings are created inside that profile and you only see the ones in your profile.
- One key per workspace: requests to Zernio on your behalf are made with a key limited to your profile, which we store encrypted. We do not use a key shared by several customers to view accounts or to publish.
- Check before publishing: when you link an account and before every post we check with Zernio that the account is in your workspace's profile. If it cannot be checked, nothing is published and you see it in the log. The same account cannot be linked in two workspaces.
- What we send it: the text, the addresses of the images or videos and the destination account of what you schedule. The access permissions for those accounts are stored by Zernio, not by us.
- How to stop using it: in the project Settings, press Unlink on the account and we stop publishing to it. To have us remove it from Zernio as well, follow the data deletion instructions.
How long we keep the data
- Access tokens: while the connection is active. They are deleted when you disconnect, revoke the permission on the platform or request deletion.
- Connected pages, accounts and channels: while the connection is active.
- Post log and metrics: while the project exists; they are deleted with it or when you request deletion. YouTube data is refreshed or deleted within 30 days at most.
- Apple Ads, Meta Ads, Plausible and Meta Ad Library ads: the credentials, while the connection exists (deleted on disconnect or when you remove the integration); the figures read, while the project exists.
How to revoke access on each platform
- Facebook and Instagram: Facebook business integrations, find LaunchSuite and remove it.
- LinkedIn: Permitted services, find LaunchSuite and remove it.
- Google and YouTube: Your Google Account permissions, choose LaunchSuite and remove access.
- TikTok: in the app, Profile → Settings and privacy → Security → Apps and services, choose LaunchSuite and remove access.
- From the dashboard: in Connect accounts, click Disconnect on the network.
To delete the rest of your data as well, follow the data deletion instructions.