Data controller: Legal identity to be provided
France, Toulouse
Hosting: OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France — Téléphone : 1007 (France), +33 9 72 10 10 07 (depuis l’étranger) — https://www.ovhcloud.com — Serveur du site : Strasbourg, France
About this policy
This policy covers your use of Calendelo: your account, connected accounts, publishing, scheduling, statistics and saved ideas. The same principles apply to every connected platform. The information available depends on the features you choose and the permissions you grant. This policy also explains how to exercise your rights; accepting it does not waive those rights or authorize unrelated processing.
Information we process
Account: email, password hash, verification/reset tokens, session identifier and expiry, IP address, browser information, and the date and version of your policy agreement. Social connections: provider identifiers, profile name/avatar, granted OAuth scopes, encrypted access/refresh tokens and their expiry.
Content you provide: uploaded videos, captions, tags, publication settings, schedules, publication results and saved ideas. We do not obtain the passwords of your connected accounts.
Connected-account information: depending on the available features and your permissions, we may access profile or channel information, videos, playlists, comments, and performance, audience or revenue statistics. Video details can include titles, descriptions, thumbnails, publication dates, duration, links and cumulative view, like, comment and share counts, when provided by the connected service.
Some account statistics are saved as daily snapshots to track their changes. Video lists and reports requested when you open, refresh or paginate a statistics page are displayed during your visit, without being saved in our server database or a permanent server cache.
Contact messages contain the name, email, subject and message you submit.
Connected account permissions
You connect an account through the provider’s own authorization process. The permissions you grant determine which information Calendelo can access and which actions it can perform. Encrypted access and refresh tokens maintain this connection without giving us your platform password.
Dailymotion normally connects through OAuth. If you choose the optional organization connection instead, you provide a private client ID and secret. These credentials are encrypted on the server and used only to access the Dailymotion profiles covered by that key for the features you request.
If you enable Sign in with Snapchat, Login Kit provides an app-specific identifier and your display name. We keep a hash of that identifier and your display name to associate Snapchat with your verified Calendelo account and authenticate future sign-ins. Snapchat does not provide your email address. We do not match accounts using display names, and we do not store Login Kit access or refresh tokens. This sign-in method does not authorize publishing to Snapchat.
Available publication options are retrieved from the connected service. Publication follows the publishing or scheduling action you request, with your selected content, destination accounts and settings. Connecting an account alone does not authorize publishing.
Purposes and legal bases
Account management, authorized publishing, scheduling, statistics and ideas are necessary to provide the service you request (performance of the contract). Session security, abuse prevention and bounded operational logs serve our legitimate interest in protecting users and the service. Contact information is used to answer your request, perform pre-contractual steps where relevant, and meet rights-related legal obligations.
Data from your connected accounts is used only to provide or improve the visible features you choose. We do not sell it, use it for personalized advertising or train generalized AI models with it. Human access to this data requires your specific consent, except where necessary for security or legal compliance.
Storage and retention
A Snapchat sign-in association remains until you remove it in your account connections or delete your Calendelo account. Temporary sign-in attempts expire after ten minutes; their encrypted PKCE verification data is removed after successful sign-in or linking, or by hourly maintenance after expiry.
Account data and ideas remain while your account exists or until you delete the item. Application sessions expire after seven days. Verification links expire after 30 minutes and become unusable after use or replacement. Pending registrations remain for up to 24 hours after link expiry so a new email can be requested, then hourly maintenance removes them. Password reset links expire at the time stated in the email and become unusable after use; expired reset records are removed by hourly maintenance.
Queued videos are encrypted on the server until all destinations finish; a job requiring manual review can retain the encrypted file until resolution. Where a destination retrieves the file by link, it receives an unencrypted temporary copy through an unguessable signed HTTPS URL that expires within 24 hours. Expired copies are removed by hourly maintenance. Completed publication records are removed after 30 days; saved daily account statistics after 365 days.
Stored connected-account profiles are refreshed and authorization is checked at least weekly. Information subject to a provider’s 30-day freshness limit is refreshed or erased within that period. Disconnecting an account immediately stops access and pending publications and starts erasure. Deletion operations that require retries are tracked against a seven-calendar-day deadline. Authorization withdrawn directly with a provider is checked and processed within 30 days.
Deletion receipts contain an opaque reference and progress dates; they expire 30 days after completion. Publication form content stays in memory while the page is open; every visit or reload starts empty. Previously saved browser drafts are cleared when the publication page opens. Language/theme preferences remain until you clear them or your browser storage. Application diagnostic logs expire within 30 days and security event logs within six calendar months. Both also use size-based rotation.
Resend states that email and delivery log data is retained for 30 days on our Free plan, and its backups for seven days. If we close our Resend account, remaining customer data is deleted within 90 days. These periods concern Resend and are separate from retention in our contact mailbox. See Resend retention information.
Ordinary contact requests are kept while they are being handled and for six calendar months after closure, to allow follow-up. The operator then manually deletes the conversations and replies from the Gmail mailbox and permanently removes them from its trash. Archiving a message does not delete it. This period concerns ordinary contact correspondence, not the separate handling of rights requests or legal disputes.
Other server logs, backups and contact correspondence: Journaux de diagnostic applicatifs : 30 jours ; journaux de sécurité applicatifs : 6 mois calendaires ; sauvegardes contenant des données personnelles : 7 jours après création ; messages de contact ordinaires : 6 mois calendaires après clôture de la demande.
Security and local storage
Passwords are hashed. Social tokens, queued reset links and scheduled videos are encrypted. HTTPS, account ownership checks, CSRF protections and request limits protect access. Session and language/theme cookies are essential to the requested features; Calendelo has no advertising or audience-tracking cookies. Fonts are hosted on the site. You can clear saved preferences through your browser settings.
Your rights, withdrawal and erasure
Remove the optional Snapchat sign-in method in your account connections. Your email and password remain available. You can also remove Calendelo from the connected-app settings in Snapchat.
You may request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, or withdraw an optional consent without affecting prior lawful processing. Use the deletion page for self-service account erasure, or the contact form for other requests or if you cannot sign in. We verify identity proportionately, respond within one month subject to the legal extension rules, and explain any legally required retention.
Disconnect an account in your dashboard or request account deletion. Local tokens and associated data are erased. Where the provider supports automatic revocation, it is attempted immediately and retried on failure. To withdraw the authorization at its source, also remove Calendelo from the connected-app settings of the relevant service. The deletion page explains these steps for every supported platform.
Deleting data in Calendelo does not delete posts already sent to connected services. Manage those posts directly on their publication destination.
You may complain to your competent supervisory authority, including the CNIL.
Connected services and references
Connected services process the data they receive under their own privacy policies: TikTok, Google Privacy Policy (YouTube), and Meta/Instagram/Facebook, Dailymotion, Snapchat, LinkedIn, Pinterest.
Calendelo uses YouTube API Services. The use and transfer of information received from these services follow the Google API Services User Data Policy, including its Limited Use requirements where applicable.
In addition to deletion through Calendelo, you can revoke connected-service access in the provider’s app settings, including Google account permissions.
Privacy contact
Use the operator’s contact details above or the contact form, including for security reports. Do not send passwords, OAuth tokens or private videos through the form.
Contact us