Privacy Policy
Effective date: 2026-11-01
Version: v1.0
1. Introduction
This Privacy Policy describes how AZWAUL LP, a limited partnership (LP) registered in Ontario, Canada, with its registered office at 1025 King Street East, Unit 107 #1697, Cambridge, ON N3H 3P5 (the “Company”, “we”, “our”), collects, uses, stores, and protects personal data in connection with Heraldly (the “Service”), available at heraldlyapp.com.
Heraldly lets creators, businesses and agencies publish and schedule content on social networks, group that content into campaigns, and measure the results. By using the Service, you (the “User”) acknowledge the practices described in this Policy.
In short:
- We access your social accounts only to publish what you or your team schedule, and to read the statistics of those accounts.
- We never read your private messages, never sell your data, and never use it for advertising.
- You can disconnect an account, export your data or delete everything at any time (see our Data deletion page).
2. Applicable Legal Framework
The Company is established in Canada and the Service is offered internationally. This Policy is drafted with reference to:
- the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada and, for Users in Québec, the Act respecting the protection of personal information in the private sector (as amended by Law 25);
- the General Data Protection Regulation (GDPR, EU 2016/679) for Users in the European Economic Area, and the UK GDPR for Users in the United Kingdom;
- other data-protection laws that apply to Users where they live, including United States state privacy laws where applicable.
Where these frameworks differ, the standard offering the highest level of protection to the User prevails.
3. Controller and Processor Roles
- The Company is the data controller for the data needed to run the User’s account: identity and login data, the access granted to connected social accounts, subscription data, and technical and security data.
- For the content the User creates or uploads (posts, captions, media, comments in the approval workflow), the statistics collected from the User’s connected accounts, and the click data of the User’s short links, the User (or the Organization they act for) is the data controller and the Company acts as a processor, processing that data only to provide the Service.
- Social networks (LinkedIn, Google/YouTube, Meta for Facebook and Instagram, TikTok) are independent controllers of the data they hold. When the User publishes through Heraldly, the content is sent to them at the User’s instruction and is then governed by their own terms and privacy policies.
- Paddle, our reseller and Merchant of Record (see Section 7), is an independent controller of the data it collects at checkout, under its own privacy notice (https://www.paddle.com/legal/privacy).
4. Data Collected
4.1 Account and Identity Data
| Category | Data | Time of Collection |
|---|---|---|
| Identification | First name, last name, email address | Registration |
| Authentication | Password (hashed with bcrypt), 2FA secret and recovery codes, or the identifier of the sign-in provider used | Registration / security settings |
| Profile | Avatar (image), language, time zone | Profile settings |
| Membership | Organizations the User belongs to, role in each one | Invitation / organization settings |
4.2 Data From Connected Social Accounts
When the User connects a social account, the network asks the User to grant Heraldly specific permissions. We use only the permissions listed below, and only for the purposes stated.
| Network | What we access | Why |
|---|---|---|
| Name, profile photo and member identifier; the Pages the User administers (name, logo, identifier); statistics of published posts and Pages (impressions, clicks, reactions, comments and shares counts, followers) | Publish to the profile or Page; show statistics in reports | |
| YouTube (via YouTube API Services) | Channel identifier, title and thumbnail; the ability to upload videos and set their title, description, thumbnail, playlist and visibility; YouTube Analytics statistics of the channel’s videos (views, watch time, average view duration, likes, comments, subscribers gained) | Upload and schedule videos; show statistics in reports |
| The Pages the User manages (name, picture, identifier) and an access token for each; insights of the Pages and their posts | Publish to the Page; show statistics in reports | |
| Instagram (professional accounts) | Account identifier, username and profile picture; insights of the account and its media (reach, views, likes, comments, saves, shares) | Publish images, carousels and reels; show statistics in reports |
| TikTok | Open identifier, display name and avatar; the account’s posting options (available privacy levels, maximum video length); statistics of published videos (views, likes, comments and shares counts) | Publish videos and photos; show statistics in reports |
Where a network provides them, we may also receive aggregated audience breakdowns (for example, views by country). These figures are statistics and do not identify individual viewers.
We do not read private messages, we do not collect the identity or content of people who comment on or react to the User’s posts, and we never publish anything that the User or a member of their Organization did not create and schedule.
Access tokens for connected accounts are encrypted at rest (AES-256-GCM).
4.3 Content and Workspace Data
Posts, captions, hashtags, links, media files (images and videos), thumbnails, schedules, campaigns, tags, approval history (comments, requested changes, approvals and their authors), and the history of posts imported from connected accounts. Where the User imports a LinkedIn data export (a spreadsheet downloaded from LinkedIn), the file is read to extract post statistics and is then deleted.
4.4 Short-Link Click Data
Links shortened by Heraldly (go.heraldlyapp.com) record each click to measure campaigns. For each click we keep: the date and time, the short link, the country, the device type and browser family, and the referring website.
The visitor’s IP address is used only at the time of the click, to determine the country and filter automated traffic, and is not stored. The redirect sets no cookie and does not identify the visitor.
4.5 Data Collected Automatically
| Category | Data | Purpose |
|---|---|---|
| Connection | IP address, user agent | Security, fraud detection |
| Audit | Actions performed, entity involved, HTTP method, path, timestamps | Traceability, security |
| Technical | Browser type, operating system, errors | Compatibility, diagnostics |
Note: no payment-card data is stored on our servers. Payments are collected entirely by Paddle (see Section 7).
5. Purposes and Legal Bases
| Purpose | Legal Basis |
|---|---|
| Providing the Service (publishing, scheduling, calendar, campaigns, reports, approval) | Performance of contract |
| Connecting social accounts and reading their statistics | Performance of contract; the User’s authorization on each network |
| Short-link click measurement | Legitimate interest of the User in measuring their campaigns (no cookie, no stored IP address) |
| Subscription and payment management | Performance of contract |
| Security, fraud prevention, audit logs | Legitimate interest / legal obligation |
| Transactional emails | Performance of contract |
| Product updates and newsletters | Consent (opt-in, withdrawable at any time) |
| Service improvement | Legitimate interest, using aggregated usage data |
6. YouTube API Services and Google Data
Heraldly uses YouTube API Services to upload videos and read channel statistics. By connecting a YouTube channel, the User agrees to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy.
Heraldly’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use that information to serve advertising, do not sell it, and do not let humans read it except with the User’s consent, for security reasons, or where the law requires it.
The User can revoke Heraldly’s access to their Google account at any time from the Google security settings page. Data obtained through YouTube API Services is deleted:
- within 7 days after the User disconnects the channel in Heraldly;
- within 30 days after the User revokes access from Google’s settings.
YouTube statistics are kept only while Heraldly remains authorized to access the channel; we check that authorization at least every 30 days.
7. Sharing and Sub-processors
We do not sell or rent personal data. We share data only with the following sub-processors, as necessary to operate the Service:
| Sub-processor | Location | Function | Data Involved |
|---|---|---|---|
| Hetzner (Hetzner Online GmbH) | Germany / Finland (EU) | Hosting of the application servers and databases | All data processed by the Service |
| Cloudflare | United States (global network) | DNS, TLS termination, network protection, short-link delivery | IP address and request metadata; requests transit through its network |
| Backblaze (B2 / S3 object storage) | Netherlands (EU) | Media file storage and backups | Uploaded images and videos, thumbnails, avatars, backups |
| Paddle (Paddle.com Market Limited) | United Kingdom | Reseller and Merchant of Record for paid plans (independent controller) | Name, email, billing country, subscription and transaction identifiers, amounts |
| Brevo | France / EU | Transactional email delivery | Recipient email, name |
| Bugsink | Self-hosted / EU | Error tracking | Error events, technical metadata |
Social networks. When the User publishes, the content and media are sent to the network the User selected (LinkedIn, YouTube, Facebook, Instagram, TikTok). For Instagram, the network fetches each media file from a temporary, time-limited link that we create for that purpose. Once published, the content is public or private according to the settings the User chose on that network.
Paddle sells paid plans to the User as Merchant of Record. For the data it collects at checkout (including payment-card details, which never reach our servers), it acts as an independent controller. We receive from Paddle only what is needed to manage the subscription: customer and subscription identifiers, plan, amounts and payment status.
No third party serves advertising in the Service.
International transfers (to the European Union, the United Kingdom and the United States) are governed by appropriate safeguards, including Standard Contractual Clauses where applicable.
8. Cookies and Similar Technologies
The Service uses only cookies that are strictly necessary: authentication cookies (httpOnly access and refresh tokens) and preference cookies (language, theme). It does not use advertising cookies or third-party tracking cookies. Short-link redirects set no cookie.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account and profile data | Lifetime of the account |
| Access tokens of connected accounts | Until the account is disconnected or access is revoked; deleted immediately on disconnection |
| Drafts, scheduled posts, campaigns | Until deleted by the User or until the Organization is deleted |
| Original media files | 90 days after the last post using them is published (published posts and their statistics remain); unpublished media until deleted, within the plan’s storage quota |
| Statistics from YouTube | While Heraldly remains authorized (see Section 6) |
| Statistics from other networks | Lifetime of the Organization, unless the User deletes them when disconnecting the account |
| LinkedIn data export files | Deleted once imported, within 24 hours |
| Short-link click events | 13 months, then kept only as aggregated counts |
| Audit logs | 365 days |
| Backups | Rolling, up to 30 days |
| Payment references (Paddle) | As required by accounting and tax law |
Upon account deletion:
- the User’s personal identity data is anonymized (first name, last name and email replaced with generic values);
- access tokens are deleted and, where the network allows it, revoked;
- the content, media, statistics and click data of an Organization are deleted when the Organization is deleted, within 30 days (backups included);
- content already published on a social network stays there: deleting it is done on the network itself.
10. Data Security
- Encryption in transit: all communications use HTTPS/TLS.
- Password hashing: bcrypt with salting.
- Encryption at rest of social-account access tokens: AES-256-GCM.
- Two-factor authentication (TOTP) with recovery codes.
- Isolation: strict separation between Accounts and Organizations; roles within each Organization.
- Pre-signed URLs: temporary, secure access to stored files.
- Rate limiting and audit logging of access and actions.
Breach Notification
In the event of a breach of security safeguards involving personal data, we will notify the competent authorities and affected Users as required by applicable law: the Office of the Privacy Commissioner of Canada where there is a real risk of significant harm, and, where the GDPR applies, the competent supervisory authority within 72 hours.
11. User Rights
Depending on where you live, you have the following rights:
| Right | How to Exercise |
|---|---|
| Access | Data export in account settings |
| Rectification | Edit profile and organization settings |
| Erasure | Disconnect accounts, delete an Organization or delete the account (see Data deletion) |
| Portability | JSON export via account settings |
| Objection / Restriction | Contact privacy@heraldlyapp.com |
| Withdrawal of consent | Account settings, the unsubscribe link in emails, or privacy@heraldlyapp.com |
We respond to requests within the timeframe required by applicable law (generally thirty (30) days).
12. Personal Data in the User’s Content
The content the User publishes may contain personal data about other people (for example, a person shown in a video or named in a post). The User is the controller of that data and is responsible for having the rights and consents needed to publish it. Short-link visitors who wish to exercise their rights may contact the User who published the link, or us at privacy@heraldlyapp.com, and we will forward the request.
13. Children’s Data
The Service is intended for professional use and is not directed at persons under 18 years of age. We do not knowingly collect personal data from minors as account holders.
14. Communications
We send transactional emails needed to operate the Service (account activation, password reset, invitations, approval requests, publication failures, payment notices and security alerts). We send product updates and newsletters only with the User’s consent.
15. Changes to This Policy
We may modify this Policy. In the event of a material change, Users will be notified by email or within the Service at least thirty (30) days in advance, and the “Effective date” above will be updated.
16. Supervisory Authorities
If you believe that the processing of your personal data does not comply with applicable law, you may file a complaint with:
- Canada: Office of the Privacy Commissioner of Canada — priv.gc.ca
- Québec: Commission d’accès à l’information — cai.gouv.qc.ca
- European Union: the data protection authority of your country of residence (for example, the CNIL in France)
- United Kingdom: Information Commissioner’s Office — ico.org.uk
We encourage you to contact us first so that we can resolve any concern.
17. Contact
For any question about this Privacy Policy, or to exercise your rights:
- Data protection contact: privacy@heraldlyapp.com
- Email: legal@heraldlyapp.com
- Phone: +230 54 81 00 52
- BIN: 1001668734
- Mailing address: AZWAUL LP, 1025 King Street East, Unit 107 #1697, Cambridge, ON N3H 3P5, Ontario, Canada
AZWAUL LP — BIN 1001668734 — 1025 King Street East, Unit 107 #1697, Cambridge, ON N3H 3P5 — Ontario, Canada — Tel: +230 54 81 00 52 — Heraldly (heraldlyapp.com)