Privacy Policy

UseNadia (usenadia.com and app.usenadia.com) is a publishing and automation tool for Instagram and TikTok, published by Consulting Web3 & Data VV Limited, a company registered in Malta under number C106230 (VAT MT30419036), with its registered office at Level 3 (Suite No. 3325), Tower Business Centre, Tower Street, Swatar, Birkirkara BKR 4013, Malta.

This company is the controller of your personal data. For any question: hello@usenadia.com.

• Account — name, e-mail address, password (stored hashed, never in plain text), chosen language; if you sign in with Google, the name, e-mail address and picture Google sends us. Purpose: create and secure your account. Retention: as long as the account exists, then deleted within 30 days of its closure.
• Content — scheduled posts, captions, uploaded media, account groups, automation rules. Purpose: provide the service. Retention: as long as the account exists, then deleted within 30 days of its closure.
• Payment — To date, we collect no payment card data.
• Access request — e-mail address and, if you give them, your Instagram and TikTok usernames, your profile and the site language. Purpose: open your access to UseNadia and write to you about it. Retention: until your access is opened, or deleted on request (unsubscribe link or e-mail).

When you connect an Instagram professional account through Instagram Login, UseNadia accesses the following data, within the permissions you grant. For each: what it is, why we use it, and how long we keep it.

• Profile — Instagram user ID, username, name, profile picture. Purpose: identify the connected account and display it in the app. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• Media and publishing — the media you upload, their captions, and the IDs of published media (as well as the thumbnail and caption of your recent posts). Purpose: schedule and publish your content, then link it to its analytics. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• Comments on your posts — comment ID, text, commenter ID and username. Purpose: display comments, reply to them, moderate them (hide, delete), and trigger the keyword automations you set up. Comments are read from Instagram on demand; only those that trigger an automation are stored, in the history of its runs. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• Direct messages and conversations — message text, sender ID and username. Purpose: display your inbox, let you reply, and send the automatic replies of your keyword rules. Conversations are retrieved from Instagram when you view them and are not copied on our side, except for the messages the automation itself sends and the records of its runs. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• Analytics (insights) — account metrics (followers, reach, views…) and metrics for each post (views, likes, comments, shares, saves, watch time), collected at regular intervals and stored as a history. Purpose: show you how your analytics evolve over time. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• E-mails sent by direct message — when an automation offers it, people who wish to can type their e-mail address in reply. Collected e-mail addresses stay in UseNadia; the account owner can export them (CSV). They are passed to a third party only if the account owner has connected their own e-mail service (see section 6); without that connection, they stay in UseNadia. Retention: as long as the account is connected; deleted within 30 days of disconnection.
• Access tokens — the tokens issued by Instagram. Purpose: call the Instagram API on your behalf. Retention: as long as the account is connected; erased as soon as it is disconnected.

Instagram data is used only to provide the user with the features described above. We do not sell or rent it, we do not use it for advertising, and we do not use it to train artificial intelligence models. No Instagram comment or direct message is sent to an artificial intelligence provider.

All the data above is deleted within 30 days of any of these events: disconnecting the Instagram account in UseNadia, deleting your UseNadia account, or a data deletion request forwarded by Meta (see section 9).

When you connect a TikTok account, UseNadia receives, with your permission: your ID, display name, username and avatar; your account statistics (followers, following, likes, number of videos); the list of your videos with their statistics (views, likes, comments, shares). This data is used only to publish the content you prepare in UseNadia and to show your statistics. It is never sold or shared. The access token is erased when the account is disconnected, and the rest of the data within 30 days. You can revoke access at any time from TikTok (Settings, then Manage app permissions) or from UseNadia; see also the Data Deletion page.

We process your data to perform the contract between us (providing the service you use), on the basis of our legitimate interest in the security of the service, and, where the law requires it, on the basis of a legal obligation. People who send their e-mail address by direct message do so voluntarily, in response to an explicit request from the account owner.

We share your data only with the following providers, strictly to operate the service:

• Hetzner Online GmbH (Germany, EU) — hosting of the app and its database.
• Cloudflare, Inc. — content delivery network (CDN) and protection of the website and the app, storage of the media you upload (Cloudflare R2), hosting of the usenadia.com website.
• Meta Platforms (Instagram) — recipient of the content you publish and the replies you send, through the Instagram API.
• TikTok — recipient of the videos you publish, through the TikTok API.
• Google — only if you choose to sign in with Google: Google authenticates your account and sends us your name, e-mail address and picture.
• OpenAI — only if you use the app’s AI assistant (Agent page): your question and the data needed to answer it, which may include your posts’ analytics. No comment or direct message is sent to it, and OpenAI does not use data received through its API to train its models.
• The e-mail service connected by the account owner (currently Brevo) — only if the account owner has connected their own Brevo account to UseNadia (Integrations page) and uses it in an automation: the e-mail address a person sends by direct message is passed to it, with their Instagram username and ID, the keyword and the name of the automation, to add them to a list and, if the owner chose to, send them an e-mail. That account belongs to the owner, who is responsible for this processing. Without a connection, the address stays in UseNadia.
• Brevo (Sendinblue SAS, France, EU) — only if you request access on usenadia.com: storage of your request and sending of the e-mail that opens your access.

No transactional e-mail provider is configured at this time: UseNadia sends no automatic e-mail to your address. If this changes, this list will be updated beforehand.

The app and its database are hosted in the European Union (Germany). Some of the providers listed above (Cloudflare, Meta, TikTok, Google, OpenAI) may process data outside the EU, in particular in the United States; these transfers are governed by the European Commission’s standard contractual clauses or by the EU–U.S. Data Privacy Framework.

The app only uses cookies necessary for it to work (login session, language, selected account or group). The usenadia.com website uses no advertising cookies and no audience measurement tool.

Under the GDPR, you can access your data, rectify it, delete it, request its portability or object to certain processing. To have your data deleted:

• In the app — delete an Instagram account from your list of channels, or delete your UseNadia account in Settings.
• From Instagram — Settings, then Apps and websites: remove UseNadia and request the deletion of your data. Meta forwards the request to us and you receive a confirmation code to follow its status.
• By e-mail — write to hello@usenadia.com from your account’s e-mail address.

Detailed instructions are at https://usenadia.com/en/data-deletion. In every case, deletion takes place within 30 days.

You can also lodge a complaint with the Maltese supervisory authority, the Information and Data Protection Commissioner (https://idpc.org.mt), or with the authority of your country of residence.

All transmissions are encrypted (HTTPS/TLS). Access to the servers and the database is limited to the people who operate the service, and access tokens are never displayed or shared with third parties.

UseNadia is not intended for people under 16 and we do not knowingly collect their data. If we learn that a minor has provided us with personal data, we delete it.

We may update this policy. In case of a significant change, we will inform you through the service. The date of the last update is shown at the top of this page.

For any question about this policy or your data: hello@usenadia.com, or by post to Consulting Web3 & Data VV Limited, Level 3 (Suite No. 3325), Tower Business Centre, Tower Street, Swatar, Birkirkara BKR 4013, Malta.