Privacy policy.

1. Who is responsible for your data

The data controller is Ronnie Cordova, an individual based in Guayaquil, Ecuador, operating under the Webpaint brand. This policy covers the webpaint.dev website and Yuls, our app to create and publish social media content.

For any question about your data, email us at businesswebpaint@gmail.com.

2. What data we collect

On webpaint.dev:

• The data you send us when you get in touch (for example, your name and message via WhatsApp or email).
• Aggregated website usage data, through Google Analytics and Cloudflare Web Analytics.

In Yuls:

• Your account: name, email address and password. Passwords are stored hashed with a key derivation function; we never see them in plain text.
• Your business profile: name, website, industry, audience, colors, logo and the texts you write or approve.
• Your media: the photos and videos you upload.
• Your content: the pieces we generate for you, their captions, and your decisions to approve them or request changes.
• Your connected social accounts, only if you choose to connect them (see section 4).
• Technical logs: timestamps, errors and the IP address you connect from, for security and troubleshooting.

3. How we use it

• To create content proposals for your business: plans, captions, scripts and images.
• To publish to your connected accounts only the content you approve, when you tell us to.
• To show you the status of your pieces and posts.
• To keep your account and the service secure, and to comply with the law.
• To improve Yuls, for example by learning from the reasons you give when you request changes.

We do not sell your data, we do not use it for advertising and we do not build profiles of you for third parties.

4. TikTok, Instagram and LinkedIn data

When you connect a social account, the platform gives us a permission (token) to act on your behalf within the scope you authorize. We only request the minimum needed to publish:

• TikTok: your basic profile information (identifier, display name and avatar) and permission to upload or publish videos and photos to your account.
• Instagram: your professional account identifier and username, and permission to publish content to it.
• LinkedIn: your member identifier, your name and permission to post on your behalf.

We use this data only to show you which account is connected and to publish what you approve. We do not read your messages, we never publish anything you have not approved, we do not share this data with third parties and we do not use it for advertising. Tokens are stored securely on our servers and are never exposed to the browser.

You can disconnect an account at any time from Yuls (Mi marca → Redes → Desconectar, the app is in Spanish) or from the connected apps settings of the platform itself. When you disconnect it, we delete its token.

Your use of these platforms is also governed by their own policies: TikTok, Instagram and LinkedIn.

5. Who we share it with

To provide the service we rely on providers that process data on our behalf:

• Google (Gemini API): generates and researches content from your business profile. While we use the free tier of this API, Google may use the information sent to improve its products, under its terms. That is why we ask you not to include sensitive personal data in your business profile.
• Cloudflare: network, security and delivery of the website and the app.
• Microsoft: speech synthesis, when a video includes a generated voice-over.
• TikTok, Meta (Instagram) and LinkedIn: they receive the content you approve for publishing.
• Google Analytics: visit statistics for webpaint.dev.

We only disclose data to authorities when a law or a legitimate order requires it.

6. Where it is stored and for how long

Your data is stored on equipment under our control in Guayaquil, Ecuador, and transmitted encrypted (HTTPS) through Cloudflare. Some providers in section 5 may process it in other countries.

We keep it while your account is active. If you close your account or ask us to delete it, we erase it within 30 days, except for anything the law requires us to keep.

7. How we protect it

• Hashed passwords and signed sessions that expire.
• Access to the app only after signing in.
• Social account tokens kept on the server, never in your browser.
• Signed, expiring links to your files, so the platforms can download them when publishing.

8. Your rights

Under Ecuador's Organic Law on Personal Data Protection, you can request access, rectification and updating, deletion, objection, portability and suspension of the processing of your data.

Email us at businesswebpaint@gmail.com from your account email. We reply within 15 days at most. If you are not satisfied, you can contact Ecuador's Superintendency of Personal Data Protection.

To delete your data, follow the data deletion steps.

9. Children

Webpaint and Yuls are intended for businesses and for people over 18. We do not knowingly collect data from minors.

10. Changes to this policy

If we change this policy, we update the date above. If the change is significant, we will email you before it takes effect.