Privacy Policy

Our commitment

At Muffino, protecting your personal data is a priority. This privacy policy explains how we collect, use, share and protect your information in accordance with the General Data Protection Regulation (GDPR) and applicable French law.

1. Data Controller

2. Data Collected

2.1 Data you provide to us

• Account information: last name, first name, email address, name of the workspace or business
• Billing information (paid plans): billing address, payment information
• Information about your business: address of the website analyzed, offering, opening hours, tone, information you add or correct
• Uploaded items: logo, photos, screenshots of posts
• Content created: posts, carousels, stories, captions, campaigns, edit instructions, publishing calendar

2.2 Data collected automatically

• Connection data: IP address, browser type, operating system
• Usage data: tasks run, credits used, features used
• Essential cookies: login session and active workspace (see section 9)

2.3 Linked Instagram account

If you link an Instagram professional account, we receive the following from Meta: the account’s ID and name, its type, its profile picture and an access token. The token is stored on our servers and is never sent to your browser. We also record the posts published through Muffino (ID and link). Muffino does not read your private messages or your list of followers.

2.4 Public content of analyzed websites

When you enter a website address, Muffino retrieves its public elements (text, images, logos, colors, fonts, documents such as a menu or a price list) to create your content.

3. Purposes of Processing

We use your personal data for:

• Provision of the service: creating and managing your account, analyzing your website, generating, scheduling and publishing your content
• Administrative management: managing your credits and your plan, processing your payments, issuing invoices
• Customer support: answering your questions, resolving technical issues, assisting you
• Service improvement: analyzing the use of the platform, developing new features
• Marketing communications: informing you of our news, tips and offers (with your consent)
• Security: preventing fraud, protecting the platform, ensuring legal compliance

4. Legal Basis for Processing

In accordance with the GDPR, we process your data on the following legal bases:

• Performance of a contract: to provide the services you have subscribed to
• Consent: for marketing communications and for linking an Instagram account
• Legitimate interest: to improve our services and ensure the security of the platform
• Legal obligation: for invoicing and regulatory compliance

5. Data Sharing

We never sell your personal data. We may share your information with:

5.1 Service providers

Each service receives only the information it needs. To generate your content, the elements of your website, the information about your business and your instructions are sent to the artificial intelligence service.

5.2 Third-party platforms

To publish your content and display your account, we interact with the Instagram API (Meta) in accordance with its terms of use. Media to be published are stored temporarily at a non-guessable address, for as long as it takes Instagram to retrieve them, and are then deleted.

5.3 Legal obligations

We may disclose your data if required by law or to protect our rights, property or safety.

6. Retention Periods

• Active account data: for as long as you use your account
• After termination: 30 days to allow you to export your data, then deletion
• Instagram connection: until you unlink the account or delete your workspace
• Media sent to Instagram: deleted as soon as publishing is complete
• Billing data: 10 years (legal accounting obligation)
• Prospecting data: 3 years after the last contact
• Cookies: 13 months maximum
• Connection logs: 1 year maximum

7. Your Rights

In accordance with the GDPR, you have the following rights:

• Right of access: to obtain a copy of your personal data
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request the deletion of your data
• Right to restriction of processing: to restrict the processing of your data
• Right to data portability: to receive your data in a structured format
• Right to object: to object to the processing of your data

How can you exercise your rights?

You may exercise your rights at any time through your account settings on the platform, by contacting us by email at contact@muffino.ai, or by writing to us by post at the address given above. We undertake to respond within one month at most.

8. Data Security

We implement technical and organizational measures to protect your data:

• Encryption of data in transit (HTTPS / TLS)
• Access tokens and keys stored on the server side only, never exposed to the browser
• Workspace isolation: each workspace can access only its own brands and content
• Secure authentication and role-based access management (owner, administrator, member)
• Hosting on secure infrastructure

9. Cookies

Muffino uses only essential cookies, which are necessary for the service to work (login, active workspace, login security). These cookies cannot be disabled. We use neither analytics cookies nor advertising cookies.

The site’s pages load fonts from Google Fonts; your browser therefore sends its IP address to Google.

10. Data Transfers

Your data is mainly hosted within the European Union. Some providers, in particular the artificial intelligence service, process data outside the European Union. In such cases, we ensure that:

• The recipient country offers an adequate level of protection recognized by the European Commission
• Or that appropriate safeguards are in place (standard contractual clauses, etc.)
• Or that you have given your explicit consent

11. Minors

Our services are intended for professionals. We do not knowingly collect personal data about persons under the age of 18. If you believe that we have collected information about a minor, please contact us immediately.

12. Deletion of Your Data

At any time, you may:

• Unlink your Instagram account from the Muffino “Calendar” (« Calendrier »), or remove Muffino from Instagram (Settings › Security › Apps and Websites): Meta then forwards the request to us, and all data received from Instagram for that account is deleted automatically, with a confirmation code (details and status)
• Delete a brand, its content and its scheduled posts from your workspace
• Request the deletion of your account and all of your data by writing to contact@muffino.ai; deletion is carried out within 30 days, except for data that the law requires us to keep (billing)

13. Changes

We may update this privacy policy. You will be notified of any significant change by email or through a notification on the platform. The date of the last update is shown at the top of this document.

14. Complaints

If you believe that your rights are not being respected, you may lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés, the French data protection authority):

15. Contact

For any question about this privacy policy or your personal data: