Privacy Policy
Effective date : October 7, 2026
1. Data controller
Onde (https://onde.baptcompany.fr) is a service published by BAPTCOMPANY, a Sole proprietorship (French micro-enterprise) operated by Baptiste Coulon, 45 rue du 8 mai, 72220 Teloché, France (SIRET: 832 892 657 00020). BAPTCOMPANY is the controller of the data processing described in this policy. Contact: contact@baptcompany.fr.
Onde is a tool for managing and publishing social media content with the help of artificial intelligence, intended for its publisher and the projects whose communication it manages. Access is by invitation.
2. Data we collect
2.1 Account data
- Email address, name, profile picture (optional)
- Authentication data (hashed password, Google sign-in identifier where applicable, sessions)
- Organizations you belong to and your role (member, admin, owner)
2.2 Connected social account data
When you connect an account (Facebook, Instagram, LinkedIn, X, YouTube, TikTok), we collect:
- Technical identifiers of the page, channel or account, display name and profile picture
- OAuth access and refresh tokens, encrypted at rest (AES-256-GCM) in our database and never exposed to the browser
- The permissions (scopes) granted
- Metrics of your posts (likes, comments, impressions, reach, followers)
2.3 Content
- Text, images, videos and audio files you upload or generate
- Published or scheduled content and its publication status
- Brand profiles and editorial strategies you enter
2.4 Technical data
- IP address, browser type, operating system, technical logs
- Strictly necessary cookies (see section 10)
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Account creation and management, authentication, organization management | Performance of a contract (Art. 6(1)(b)) |
| Connecting your social accounts, publishing and scheduling content on your behalf | Performance of a contract and the OAuth consent you grant to the platform (Art. 6(1)(a) and 6(1)(b)) |
| AI generation of content and videos from your brand profiles and instructions | Performance of a contract (Art. 6(1)(b)) |
| Displaying performance metrics of your posts | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails (sign-in code, invitations, service notifications) | Performance of a contract (Art. 6(1)(b)) |
| Security, abuse prevention, technical logs | Legitimate interest (Art. 6(1)(f)) |
| Accounting and legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your data, we do not run targeted advertising and we do not perform profiling that produces legal effects.
4. Data obtained from Meta (Facebook and Instagram)
- Facebook and Instagram data is obtained only with your explicit authorization through Meta's OAuth flow.
- It is used solely to publish content on the Pages and professional accounts you connected, and to display their statistics in Onde.
- It is not sold, rented, shared with data brokers, or used for advertising, profiling or any other purpose.
- It is not disclosed to any third party, other than the technical processors listed in section 6 that are strictly necessary to operate the service.
- You can revoke access at any time (section 9); the associated data is then deleted as described on the Data deletion page.
5. YouTube and Google API Services
Onde uses YouTube API Services. By connecting your YouTube channel, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.
- Data obtained through YouTube / Google APIs is used only to publish videos to your channel and display its statistics, at your request.
- Onde's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- This data is not used for advertising, is not sold, is not read by humans except with your consent, for security purposes, to comply with law, or in aggregated anonymized form, and is not used to train general-purpose AI models.
- You can revoke Onde's access to your Google account at any time at https://security.google.com/settings/security/permissions. Stored YouTube tokens are deleted when you disconnect the channel in Onde.
6. Recipients, processors and transfers outside the EU
Data is accessible only to authorized members of your organization and to the publisher for operating the service. We use the following processors:
| Processor | Role | Location |
|---|---|---|
| OVH SAS | Hosting (virtual private server, database, file storage) | France (EU) |
| Inngest | Orchestration of asynchronous jobs (publishing, generation) | United States |
| Resend | Sending of transactional emails | United States |
| OpenAI, Anthropic, Google (Gemini), Mistral AI | AI text generation, analysis and transcription | United States / EU |
| Kling AI (Kuaishou) | AI video generation | China |
Data sent to AI providers includes the content to generate or analyze and the context of your brand profile; it does not include your access tokens or password.
The platforms you connect (Meta, Google / YouTube, TikTok, LinkedIn, X) process your data as independent controllers under their own privacy policies.
For transfers outside the European Union, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
7. Retention
- User account: while the account is active; deleted on request or when the account is deleted.
- Social account tokens and data: deleted immediately when you disconnect the social account, or delete the organization or your account.
- Content, media and metrics: kept while the organization exists; deleted with it.
- Technical logs: kept for a limited period for security and debugging.
- Backups: deleted data disappears from backups as they rotate, within 30 days at most.
- Publisher's accounting records: kept for the applicable legal periods.
8. Security
- Encrypted communications (HTTPS / TLS)
- OAuth tokens encrypted at rest (AES-256-GCM), hashed passwords
- Per-organization data isolation and role-based access control
- Administrative access restricted to the publisher
9. Your rights and revoking access
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, and the right to give instructions about your data after your death. To exercise them: contact@baptcompany.fr (reply within one month).
You can also:
- Disconnect a social account in Onde (organization Social Accounts page, Disconnect button): tokens are deleted immediately.
- Delete your account or your organization from the app.
- Revoke access on the platform side:
- Facebook / Instagram: Settings > Apps and Websites (or https://www.facebook.com/settings?tab=applications);
- Google / YouTube: https://security.google.com/settings/security/permissions;
- TikTok: Settings and privacy > Security and permissions > App permissions;
- LinkedIn: Settings > Data privacy > Permitted services;
- X: Settings > Security and account access > Apps and sessions.
Detailed instructions: Data deletion.
If, after contacting us, you believe your rights are not respected, you may lodge a complaint with the CNIL (French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with your local supervisory authority.
10. Cookies
We only use strictly necessary cookies: authentication session, language preference, and temporary OAuth cookies (10 minutes) while connecting a social network. No advertising or third-party tracking cookies are used, so no consent banner is required.
11. Minors
The service is intended for professionals and is not aimed at people under 16.
12. Changes
We may update this policy; the effective date at the top of the page is updated and users are notified by email of significant changes.
13. Contact
BAPTCOMPANY — Baptiste Coulon 45 rue du 8 mai, 72220 Teloché, France Email: contact@baptcompany.fr