1. Data controller
wecoprod EURL, represented by Sébastien Grégoire, manager
3 Traverse du Silence, 13015 Marseille, France · RCS Marseille 802 522 441
Email: sebastien@wecoprod.com
2. Data collected
As part of the wecopost service, we collect the following data:
- Account data: email address, display name
- Social network data: LinkedIn / Threads / Epsilon Social page identifier, access token (for publishing)
- Connected Bluesky accounts: identifier (DID), handle, profile picture and AT Protocol OAuth session (access and refresh tokens bound to a DPoP key), for publishing
- Connected LinkedIn company pages: page identifier, name and logo. To show in your calendar the posts published directly on LinkedIn, we read the page's posts and keep only their text and date. We do not collect any information about the people who follow the page, react to it or comment on it.
- Post content: text, images and scheduling metadata
- Published post statistics: impressions, reactions, comments and reshares of your own posts, retrieved through the LinkedIn, Threads and Epsilon Social APIs with your authorization
- Navigation data: technical logs, IP address
Social network access tokens and Bluesky sessions are encrypted in our database.
3. Purposes of processing
Data is used to:
- Provide the social media scheduling and publishing service (LinkedIn, Threads, Epsilon Social, Bluesky)
- Show you the statistics of your published posts, visible to you only
- Manage your account and ensure security
- Improve the service (anonymised aggregate analytics)
- Send you service-related notifications
4. Legal basis
Processing is based on the performance of a contract (Art. 6.1.b GDPR) for service delivery, and on our legitimate interest (Art. 6.1.f GDPR) for service improvement.
5. Retention periods
- Account data: account lifetime + 30 days after deletion
- Social network accounts and pages: as long as they are connected. When you disconnect a LinkedIn account or page, its access tokens are deleted immediately. When you disconnect a Bluesky account, its session is revoked with Bluesky and deleted, unless another wecopost user still has the same Bluesky account connected.
- Published posts and their statistics: retained until deleted by the user
- Technical logs: 90 days
5a. Access to your LinkedIn accounts and pages
When you connect a LinkedIn company page, you explicitly authorize wecopost, through LinkedIn's authorization screen, to list the pages you administer, to publish and delete posts on behalf of the page you choose, and to read that page's posts and their aggregate statistics.
You can revoke this access at any time:
- in wecopost, with the "Disconnect" button: the access tokens are deleted and no further calls are made to LinkedIn for this account or page;
- in your LinkedIn settings (Data privacy → Permitted services).
To have all data related to your LinkedIn account or page deleted, email sebastien@wecoprod.com. We act on requests within 30 days.
6. Data sharing
We do not sell your data and do not use it for advertising or sales purposes. An account's data is never shared with other users. Data may be shared with:
- LinkedIn, Threads, Epsilon Social, Bluesky: for publishing your posts and retrieving their statistics (via their API; for Bluesky, via the data server (PDS) that hosts your account)
- Scaleway: infrastructure hosting (servers in France, EU)
- Stripe: payment processing (paid subscriptions)
Bluesky is operated by Bluesky Social, PBC, based in the United States: data published on Bluesky is therefore transferred outside the European Union. Bluesky states that it safeguards these transfers with the Standard Contractual Clauses approved by the European Commission.
6a. Stripe: payment data
Payments are processed by Stripe, Inc., a PCI-DSS certified payment provider. wecoprod never stores your bank details. Stripe collects and processes the data necessary for the transaction (card number, cardholder name, billing address) in accordance with its own privacy policy. Data transmitted to Stripe is covered by the EU-US Data Privacy Framework and GDPR. To exercise your rights regarding payment data: stripe.com/privacy.
7. Your rights
Under the GDPR, you have the following rights:
- Right of access to your data
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to data portability
- Right to object to processing
To exercise these rights: sebastien@wecoprod.com
8. Cookies
wecopost.com does not use tracking cookies. app.wecopost.com uses only functional cookies required for session management.
9. Complaints
You may lodge a complaint with your local data protection authority. In France: www.cnil.fr