Privacy policy

This policy describes how Suzzly collects, uses and protects your personal data when you use our service.

Data controller

The controller of your personal data is BUDEASE, a French simplified joint-stock company (SAS) with a share capital of €1,000, registered with the Lyon Trade and Companies Register under number 978 886 588, whose registered office is at 20 rue Jules Verne, 69003 Lyon, France, and which publishes the Suzzly service.

For any question about the processing of your data, you can write to us at contact@suzzly.com.

Data we collect

• Account data: name, email address and login credentials. If you sign in with Google, Facebook or LinkedIn, we receive the name and email address that service shares with us.
• Payment data: handled by Stripe; Suzzly never sees or stores your card numbers.
• Face photos and voice recording you add to the Brand DNA, to personalise your brand's visuals and voice. You can remove them at any time.
• Usage data: generated content, brands and connected social accounts.
• Technical data: IP address, browser type and browsing data (via cookies or audience measurement tools).

Data from Facebook, Instagram and Threads

When you connect a Facebook Page, an Instagram professional account or a Threads account to a brand, Suzzly accesses, with the explicit permission you give on Meta's consent screen, only the following data:

• the ID, name, username and profile picture of the account or Page, to display it in Suzzly and choose where to publish;
• the list of Facebook Pages you manage, so you can choose the Page to publish to;
• the access tokens issued by Meta, stored encrypted, to publish the content you have approved or scheduled;
• aggregated account statistics (followers, reach, views, interactions), to power the Analytics page and the brand's Suzzly IQ score.

This data is used solely to provide these features to the user who connected the account and to the members of their workspace. It is never sold, never used for advertising and never used to train AI models. Suzzly does not read your private messages and never publishes without action on your part (immediate or scheduled publication).

You can withdraw this access at any time from Suzzly (Connections › Disconnect), which immediately deletes the stored tokens, or from the settings of your Facebook, Instagram or Threads account. To delete all data, follow the deletion instructions.

Waitlist

If you join the waitlist, we collect your email address, the date you signed up and the date you confirmed. This address is used solely to let you know when Suzzly opens. Legal basis: your consent, confirmed through the link sent to your address (double opt-in).

Emails are sent by our processor Resend (Plus Five Five, Inc.), under the European Commission's standard contractual clauses. You can unsubscribe at any time through the link in every email or by writing to us. Your address is removed from the list at the latest 12 months after the service opens, or as soon as you unsubscribe.

Purposes and legal bases

• Creating and managing your account, generating, scheduling and publishing your content, connecting your social accounts: performance of the contract (terms of sale);
• Account e-mails (verification, password, notifications you can turn off in Settings): performance of the contract;
• Billing and accounting: legal obligation;
• Service security (abuse prevention, rate limiting, technical logs): legitimate interest;
• Waitlist: consent;
• Audience measurement and advertising: consent, collected by the cookie banner, purpose by purpose.

Our AI providers are used through their business offerings (API), which do not use your data to train their models.

Recipients and processors

We do not sell your data. Only the following processors access it, strictly to run the service:

• Google Cloud (hosting, Belgium) and MongoDB Atlas (database, France);
• Cloudflare (domain name, image storage);
• Upstash (technical session cache);
• Stripe (payment and billing);
• Resend (e-mail delivery);
• OpenAI, Google (Gemini) and Anthropic (text and image generation, website analysis, Suzzly IQ score);
• Google Analytics and PostHog (audience measurement, if you accept it);
• Meta Platforms Ireland, through the Meta Pixel (measuring our ads on Facebook and Instagram, if you accept it). Meta is a joint controller of this collection with Suzzly.

The social networks you connect (Meta, LinkedIn, X) receive the content you choose to publish there, under their own terms.

Some of these providers are based in the United States or may process data there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses.

Retention periods

• Account, brands and content: as long as your account exists. Deleting it (Settings › Account) erases them immediately;
• Inactive account: deleted with all its data after 3 years without signing in, unless a subscription is running. An email warns you 30 days before; signing in again is enough to keep it;
• Social network access tokens: until you disconnect the network or delete your account;
• Database backups: 30 days;
• Technical logs: 30 days;
• Invoices: 10 years (accounting obligation);
• Waitlist: see the section above;
• Audience measurement: cookies 13 months, Google Analytics data 14 months at most;
• Advertising: Meta cookies 90 days.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw your consent at any time. You can delete your account yourself from Settings. To exercise your other rights, write to contact@suzzly.com: we reply within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Cookies

Suzzly only sets the cookies listed below, on suzzly.com and its subdomains.

Strictly necessary (exempt from consent):

• __Host-authjs.csrf-token: protection against cross-site request forgery (browser session);
• __Secure-authjs.callback-url: page to return to after signing in (browser session);
• __Secure-authjs.pkce.code_verifier and __Secure-authjs.state: secure signing in with Google, Facebook or LinkedIn (15 minutes);
• __Secure-authjs.session-token: keeps you signed in, sometimes split into several numbered cookies (30 days);
• __Host-oauth_state: secures connecting a social account to a brand (15 minutes);
• sz_waitlist_bypass: early access reserved for the team while the waitlist is open (90 days).

Preferences (exempt from consent):

• NEXT_LOCALE: interface language (1 year);
• sz_country: country inferred from your connection, to show the right currency (1 year);
• sz_currency: currency chosen on the pricing page (1 year);
• sidebar_state: side menu open or closed (7 days).

Advertising (only if you accept it on the banner): _fbp and _fbc, set by the Meta Pixel to measure our ads on Facebook and Instagram (90 days).

Audience measurement (only if you accept on the banner): _ga and _ga_*, set by Google Analytics, and ph_*_posthog, set by PostHog (13 months). Your choice is stored in your browser's local storage (suzzly_consent) for 13 months, or 6 months if you refuse, after which the banner asks again. You can change your mind at any time: Cookie settings.

When you sign in with Google, Facebook or LinkedIn, you are redirected to their website, which sets its own cookies under its privacy policy. Suzzly does not load any sign-in script from these services on its pages.

You can delete or refuse these cookies in your browser settings; without the strictly necessary cookies, you cannot sign in to the service.

Contact

For any question about your personal data, contact us at contact@suzzly.com.