Privacy Policy

Last updated: 1 November 2026 · Version 1.0

This Privacy Policy explains how AG IT-Solutions ("AGITS", "we", "us") handles personal data when you visit https://autofeed.be, create an AGITS account and use AutoFeed, our social media planner (the "Service").

We wrote this policy to be read, not just to be signed. If something is unclear, email privacy@agits.be.

1. Who is responsible for your data


Controller	AG IT-Solutions (trade name AGITS), legal form
Registered office	registered office address
Enterprise number (KBO/BCE)	enterprise number
Privacy contact	privacy@agits.be
General contact	hello@agits.be

Two different roles

We are the controller for the data we need to run your account and our business: your AGITS account, subscription and billing data, support conversations, security logs and the website.
We are a processor for the personal data contained in the content you and your team put into AutoFeed (posts, captions, images, media, comments and metrics of your connected social accounts). For that content, you (the customer) are the controller and we process it on your behalf under our Data Processing Agreement.

This policy mainly covers the first role. It also explains, for transparency, what happens with data in your workspaces.

2. What data we collect and why

2.1 Your AGITS account

One AGITS account (email address and password) gives access to all AGITS apps, including AutoFeed.

Data	Purpose	Legal basis (GDPR art. 6)
Email address	Sign-in, account communication, password reset	Contract (6.1.b)
Password	Authentication. Stored only as a salted hash by Amazon Cognito; we never see it	Contract (6.1.b)
Preferred language	Showing the app and emails in your language	Contract (6.1.b)
Date, time and version of the terms you accepted	Proving which terms apply to you	Legal obligation and legitimate interest (6.1.c, 6.1.f)
IP address at sign-up and sign-in	Rate limiting and preventing abuse, fraud and automated account creation. Kept for a maximum of 30 days	Legitimate interest (6.1.f)
Display name and profile details you choose to add	Showing who did what inside a shared workspace	Contract (6.1.b)

2.2 Workspaces ("spaces") and team members

When you create a workspace or are invited to one, we store your membership and role, the email address of invited members and an activity trail (e.g. who created or approved a post). Legal basis: contract (6.1.b) and our legitimate interest in letting teams collaborate securely (6.1.f).

2.3 Connected Instagram and Facebook accounts

When you connect a channel via Instagram Login or Facebook Login (Meta Platforms Ireland Ltd), we receive and store:

an access token, which we store encrypted (Fernet, AES-based) and only decrypt when needed to perform an action you asked for;
the page or account ID, name, username and profile picture URL;
for reporting: post metrics (likes, comments, shares, saves, reach, views) and follower counts.

We use this data only to publish and schedule the content you ask us to publish, and to show you analytics. We do not use it for advertising, profiling or any other purpose. Legal basis: contract (6.1.b). See Data deletion to disconnect a channel or revoke access.

2.4 Content you create

Posts, captions, hashtags, images, videos, templates, brand settings, media descriptions, comments, strategy notes and chat conversations with the assistant. We store this to provide the Service. Where this content contains personal data of other people, you are the controller (see section 1).

2.5 AI features

When you use AI features (captions, hashtags, image generation and editing, image descriptions, template suggestions, strategy suggestions, chat), the relevant prompt and context (for example a draft, your brand settings or an image) are sent to the Google Gemini API to produce the result. We use the paid API tier, under which Google does not use prompts or outputs to train its models. We do not use your content to train AI models. More in our AI transparency notice.

2.6 Brand import from your website

If you enter your website URL, our servers fetch that public website once to extract colours, fonts and your logo. We only process what is publicly available on that page.

2.7 Brand fonts in templates (Google Fonts)

The website and the app interface use self-hosted fonts and make no requests to Google Fonts. However, inside the signed-in app, template previews and the template editor load the brand fonts you selected from Google Fonts (fonts.googleapis.com and fonts.gstatic.com, operated by Google LLC). To deliver the font files, Google necessarily receives your IP address and browser user agent. Google sets no cookies for this. Purpose: rendering your chosen brand typography accurately. Legal basis: performance of the contract (6.1.b) and our legitimate interest in offering a broad font library without hosting every font ourselves (6.1.f).

2.8 Stock photo search

When you search for free stock photos, only your search terms are sent to a third-party image search service. No account data or other personal data is sent.

2.9 Subscription and payments

Payments are handled by Stripe Payments Europe Ltd. Your card details go directly to Stripe and never touch our servers. We store your Stripe customer ID, subscription plan and status, and invoices. Legal basis: contract (6.1.b) and legal obligation under Belgian accounting and tax law (6.1.c).

2.10 Support and communication

When you email us, we use your message and contact details to help you. We send transactional emails (account verification, password reset, invitations, publishing errors, billing). We do not send marketing emails without your prior consent. Legal basis: contract (6.1.b), legitimate interest (6.1.f) or consent (6.1.a) where required.

2.11 Technical and security logs

Our servers log technical data (IP address, timestamps, request paths, error details) to keep the Service secure and working. These logs are kept for a maximum of 90 days. Legal basis: legitimate interest (6.1.f).

3. What we do not do

We do not use tracking cookies, advertising cookies or third-party analytics. The only third-party request from your browser is Google Fonts for brand fonts in templates (section 2.7). See our Cookie & local storage policy.
We do not sell or rent personal data.
We do not show ads or build advertising profiles.
We do not use your content to train AI models.
We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

4. Who we share data with

We only share data with service providers (sub-processors) that we need to run the Service, under contracts that oblige them to protect it. The current list, with locations and safeguards, is published on our Sub-processors page. In short:

Amazon Web Services EMEA SARL – hosting, database, file storage, sign-in (Cognito), email delivery; EU region (Ireland). Content delivery (CloudFront) uses global edge locations.
Google LLC – Gemini API for AI features; Google Fonts for brand fonts in template previews and the template editor (IP address and user agent only).
Stripe Payments Europe Ltd – payments.
Stock photo search provider – search terms only.

Meta (Instagram, Facebook) receives the content you choose to publish, under its own terms and privacy policy. Meta acts as an independent controller for data on its platforms.

We may also disclose data when required by law or a binding order of a competent authority, or to protect our rights in legal proceedings.

5. International transfers

We host your data in the European Union (AWS region eu-west-1, Ireland). Some providers process data outside the EEA:

Google (Gemini API and Google Fonts) – United States/global. Safeguards: EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses (SCCs).
AWS CloudFront – published images are cached on edge servers worldwide so that Meta and your audience can fetch them. These images are by nature intended to be public.

6. Public files

Images you publish must be reachable by Meta via a public URL. Rendered and published images are therefore stored at hard-to-guess URLs that are accessible to anyone who has the link. Do not put confidential information in images you intend to publish.

7. How long we keep data

Data	Retention
Account data	As long as your account is active
Workspace content	Until you delete it, and at the latest 30 days after the workspace or account is deleted
Database backups (point-in-time recovery)	35 days, rolling
IP addresses for abuse prevention	Max. 30 days
Technical and security logs	Max. 90 days
Invoices and accounting records	The period required by Belgian accounting and tax law (currently 10 years)
Support emails	Up to 2 years after the conversation ends, unless needed longer for a dispute

8. Security

We protect data with encryption in transit (TLS 1.2+) and at rest (AES-256), encrypted storage of platform tokens, least-privilege access, multi-factor authentication for administrative access, access logging and regular backups. Details are in the annex of our Data Processing Agreement. Found a vulnerability? Please report it to security@agits.be.

9. Your rights

Under the GDPR you have the right to:

access your personal data and receive a copy;
rectify incorrect data;
erase your data ("right to be forgotten");
restrict processing;
data portability (receive your data in a structured, machine-readable format);
object to processing based on legitimate interest;
withdraw consent at any time, where processing is based on consent.

To exercise these rights, email privacy@agits.be from the email address linked to your account. We respond within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to verify your identity.

If your request concerns content in a workspace that belongs to another customer (for example a company that featured you in a post), we will forward it to that customer, who is the controller.

To delete your account or disconnect channels yourself, see Data deletion.

10. Complaints

We would appreciate the chance to resolve any concern first via privacy@agits.be. You always have the right to lodge a complaint with the supervisory authority:

Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) Drukpersstraat 35, 1000 Brussel, Belgium https://www.gegevensbeschermingsautoriteit.be

11. Children

AutoFeed is a professional service and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact privacy@agits.be and we will delete it.

12. Changes to this policy

We may update this policy when the Service or the law changes. For material changes we notify account holders by email or in the app at least 30 days in advance. The version and date at the top always show the current version.

13. Language

This policy is available in English and Dutch. Both language versions are equally authoritative.