Privacy policy

What we collect

• Account data: your name, email address, organisation name and role.
• Content you create: captions, media, comments, internal notes, plans, schedules and approval decisions.
• Connected account data: when you connect a social network or tool, the access tokens it issues, basic profile or page information (such as the account name and ID), and, for analytics, metrics about your posts and accounts such as reach, engagement and follower counts.
• Billing data: your plan and subscription status. Card and payment details are collected by Dodo Payments, not by us.
• Technical data: server logs such as IP address, browser type and request times, used for security and troubleshooting.

How we use it

• To provide the Service: store your content, show previews, route posts for approval and publish approved posts to the accounts you connect.
• To send the service emails the product relies on: invitations, review requests and review-complete notices.
• To keep the Service secure and working, and to provide support.
• To manage your subscription.

We do not sell your data, we do not use it for advertising and we do not run third-party ad or tracking scripts.

Data from Google, Meta and other connected services

When you connect Google Drive or YouTube, we access only what is needed for the feature you use: files you choose to import from Drive, and your YouTube channel to publish videos and read their statistics.

Tomatillo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and humans do not read it except with your permission, for security, or where the law requires.

Data received from Meta, X, LinkedIn, TikTok, Canva, Adobe and Slack is used in the same limited way: only to provide the features you have turned on.

Access tokens for connected accounts are encrypted before they are stored.

Who processes data for us

We use a small number of service providers, each only for its own part of the Service:

• Supabase — database, file storage and authentication
• Vercel — application hosting
• Resend — sending service emails
• Dodo Payments — payments, as merchant of record
• The social networks and tools you choose to connect

These providers may process data outside your country. Where they do, they are bound by contractual safeguards for that transfer.

Who can see your content

Content in a workspace is visible to your organisation’s team members according to their role. Client approvers see only posts that have been sent to them for review — never drafts, and never internal notes.

Cookies

We use only essential cookies: the one that keeps you signed in, and one that remembers your cookie choice. We do not use advertising or analytics cookies.

When you first visit, we ask for your choice. If we ever add optional analytics, it will stay off unless you say yes, and you can change your answer at any time from “Cookie settings” in the footer.

How long we keep data

We keep your data while your account is active. If you delete your account, we delete your content and connected-account tokens within 30 days, except for records we must keep by law (for example, billing records). Server logs are kept for a limited period for security.

Disconnecting a social account deletes its stored tokens immediately.

Your rights

You can access, correct, export or delete your personal data, and object to or restrict how we process it. Email hello@trytomatillo.com and we will respond within 30 days. You can also complain to your local data-protection authority.

See the data deletion page for how to remove connected-account data specifically.

Children

The Service is not directed at children under 18, and we do not knowingly collect their data.

Changes

If we change this policy materially, we will tell you by email or in the app before the change takes effect.

Contact

Privacy questions or requests: hello@trytomatillo.com.