Privacy Policy

1. Who is responsible and how to contact us

The data controller for this Website, for prospects and for our own clients is Opperator AI FZCO, trading as PAPS STUDIO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, licensed by the International Free Zone Authority (IFZA), Dubai. For every privacy question, request or complaint write to support@paps-studio.com. Our privacy team, which also acts as our Data Protection Officer contact, Privacy Officer (Canada), Data Protection Officer or Encarregado (Brazil) and Information Officer (South Africa), answers within one working day and resolves requests within the legal deadline, which is one month under the GDPR and forty-five days under the CCPA unless the law allows an extension.

Where Article 27 of the GDPR or of the UK GDPR requires it, we appoint a representative in the European Union and in the United Kingdom. Their details are available on request at support@paps-studio.com and are published on this page once appointed.

2. Two roles: controller and processor

We are the controller of the personal data of: visitors to this Website; people who write to us or book a call; and the staff and users of our clients who hold an account on the Platform.

We are the processor of the personal data of our clients' communities, customers, leads and contacts: the people who comment, follow, message, call, chat, book or buy with a business that uses PAPS STUDIO. That business is the controller, decides why and how the data is used, and is your first point of contact for privacy requests. We help it answer within the legal deadline, and you can also write to us at support@paps-studio.com, where we will forward your request and act on the controller's instructions.

3. The data we collect

On this Website: each page view is counted by our own visit counter, which receives the page you visit, the page you came from, whether you use a phone or a computer and the time of the visit, and never your IP address, name, email or anything you type; your cookie choice and your language preference, stored in two small cookies; and, only after you press Accept in the cookie banner, a random anonymous visitor id that lets us tell returning visits apart, and Microsoft Clarity heat maps and session replays, which mask typed text. This Website contains no advertising scripts and no advertising identifiers.

When you contact us or book a call: your name, email address, company, role, phone number if you give it, the message you write and the time slot you choose. Calls are booked through Google Calendar's booking page under Google's own terms and privacy policy.

When you hold an account on the Platform: your name, business email, role, company, password hash, login history, IP address, the settings you choose and the actions you take in the Platform (audit log).

When you connect a social media, messaging, advertising or business listing account (Platform Data): the authorisation token and its scopes; the profile, page, channel or business listing data of the Connected Account; the posts, videos, stories and reels we publish or you ask us to manage; comments, replies, mentions, direct messages and reviews addressed to the Connected Account and the public profile data of the people who write them; audience and performance statistics (reach, views, followers, engagement, demographics in aggregate); advertising accounts, campaigns, audiences and results; and, for WhatsApp Business, the phone numbers and messages of the people who message the business.

When you write to a business that uses the Platform (a comment, a mention, a review or a direct message on one of its Connected Accounts): the text you wrote, the public name and profile of the account you wrote from, the time, and the answer that the business or its community manager wrote back to you in the Platform. We keep these together so that the business can see what still needs an answer.

When you send us footage or brand material for editing or for a website: the files themselves, which may contain the image and voice of people, and the metadata embedded in them.

Billing data: the company details, billing address, tax number and the transactions with us. Card details are entered directly with the payment processor and never stored by us.

4. Where the data comes from

Directly from you; from the business that uses our services (as its processor); from the Providers through their official APIs and business tools with the permissions you or the business approved; from our own systems (logs, audit trails); and from publicly available sources where the business asks us to research its market.

5. Why we use the data and the legal basis

We use personal data for the following purposes. Where the GDPR, the UK GDPR or a similar law applies, the legal basis is given in brackets.

• To run this Website, keep it secure and understand how it is used (legitimate interest; consent for Microsoft Clarity).
• To answer your messages, book and hold calls and send you the information you asked for (steps prior to a contract and legitimate interest).
• To provide the Services and the Platform to our clients, including publishing, answering, reporting, editing, building and running campaigns (performance of the contract with the client; for the client's community data, the client's instructions as controller).
• To bill, collect payment, keep accounts and comply with tax, accounting, anti-fraud and other legal obligations (legal obligation and legitimate interest).
• To protect the rights, safety and security of our clients, of the people who interact with them, of the Providers and of ourselves, including to investigate abuse (legitimate interest and legal obligation).
• To send our own clients and prospects information about our services, which you can stop at any time with one click or by writing to us (legitimate interest, or consent where the law requires it, for example under the ePrivacy rules, CASL or the Australian Spam Act).

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not use it for automated decisions of any kind: the Platform contains no artificial intelligence and no automated replies, and every post, comment and message is approved or written by a person. We do not process special categories of data (such as health, religion or political opinion) unless a client instructs us to handle a message that happens to contain such data, in which case we handle it only to answer that message.

You are never obliged by law to give us personal data. Contact details are needed to answer you and to hold a call, and account details are needed to provide the Platform under the contract; without them we cannot provide those services. Everything else is optional.

6. Platform Data: how we use data from Meta, TikTok, X, LinkedIn, Pinterest and Google

We access Platform Data only through the official APIs and business tools of each Provider, with the permissions the account holder approves, and only to provide the Services to the client whose Connected Account produced it: to publish and schedule content, to show comments, mentions, reviews and messages in the inbox where a person answers them, to measure performance and produce reports, and to run and refine advertising campaigns in the client's own ad accounts.

We comply with the Meta Platform Terms and Developer Policies, the WhatsApp Business Messaging Policy, the TikTok for Developers terms, the X Developer Agreement and Policy, the LinkedIn API Terms of Use and Marketing API Program terms, the Pinterest Developer Guidelines, the YouTube API Services Terms of Service and Developer Policies, the Google APIs Terms of Service and the Google API Services User Data Policy. In particular we:

• use Platform Data only for the contracted Services and never for our own advertising, for advertising by third parties, for data brokerage, for building or supplementing user profiles, for surveillance, for credit, employment, housing or insurance decisions, or for any purpose the account holder has not authorised;
• do not sell, licence or transfer Platform Data to anyone, except to the sub-processors listed in section 8 strictly to provide the Services, and as required by law;
• keep Platform Data only as long as needed for the Services and delete it on revocation, on termination or on request as described in section 10 and on our Data Deletion page;
• keep content in sync with the Provider: when a post, comment or message is deleted on the Provider we delete our copy within twenty-four hours of learning of it, and we do not display content the Provider has removed;
• publish only what a person has approved in the Platform and answer only what a person has written: the Platform contains no artificial intelligence, no chatbots and no automated replies, and Platform Data is never used to develop, train or improve any artificial intelligence or machine learning model;
• protect access tokens with encryption at rest and in transit, restrict them to the staff and systems that need them and never share them;
• do not attempt to identify anonymous users, to combine Platform Data with data from other sources to identify a person beyond what the Service requires, or to override any user's privacy settings;
• for WhatsApp, send messages only to people who have given the business a valid opt-in, honour opt-outs at once, and follow the WhatsApp Business Messaging Policy and Commerce Policy.

7. YouTube and Google API Services

PAPS STUDIO uses YouTube API Services. By connecting a YouTube channel to the Platform you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's handling of your data is described in the Google Privacy Policy (https://policies.google.com/privacy).

Through the YouTube Data API and, where authorised, the YouTube Analytics API we access, with your permission: your channel and video metadata; the videos you ask us to upload, schedule or edit; comments on your videos and our replies to them; and your channel analytics. We store this data on our servers only for as long as the Service needs it. Authorised data stored for more than thirty days is refreshed from the API at least every thirty days or deleted. We do not use YouTube API data for advertising, do not sell it, do not share it with third parties except our sub-processors strictly to provide the Service, and do not use it to develop, train or improve any artificial intelligence or machine learning model.

You can revoke PAPS STUDIO's access to your Google and YouTube data at any time from the Google security settings page at https://security.google.com/settings/security/permissions (also reachable at https://myaccount.google.com/permissions). Revocation stops our access immediately and triggers the deletion of the stored YouTube data within thirty days.

PAPS STUDIO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This applies to YouTube and to Google Business Profile alike: we use Google user data only to provide or improve user-facing features that are visible to you in the Platform, we do not transfer it to others except to provide those features, to comply with the law or as part of a merger or acquisition with notice, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security purposes, to comply with the law, or for internal operations on data that has been aggregated and anonymised.

Through the Google Business Profile API we access, with your permission, your business listing, posts, reviews and replies, questions and answers, and performance insights, to keep the listing updated, answer reviews on your instructions and report results.

8. Who we share data with

We share personal data only with the following categories of recipients, under written contracts that oblige them to protect it, and only to the extent needed to provide the Services:

• The Providers named in this policy, when we publish, answer or read on your Connected Accounts, each under its own privacy policy.
• Hosting and content delivery: Vercel Inc. (United States, with global edge locations) for this Website; cloud infrastructure providers in the European Union and the United States for the Platform.
• Email, documents and calendar: Google Workspace (Google LLC), including the Google Calendar booking page.
• Website analytics: Microsoft Clarity (Microsoft Corporation), only after you accept it in the cookie banner.
• Form delivery for our landing pages: formsubmit.co, which relays the form to our inbox.
• Payment processors and banks for invoicing and collection; accountants, auditors and legal advisers under professional secrecy.
• Authorities, courts and regulators when the law requires it or to protect rights, safety and security, and a buyer or successor of our business, with notice to you, if we are acquired or merge.

A current list of sub-processors, with their location and role, is available on request at support@paps-studio.com. Clients with a Data Processing Agreement are notified before a new sub-processor is added and may object.

9. International transfers

We operate from the United Arab Emirates and use providers in the European Union, the United Kingdom, the United States and other countries. When personal data protected by the GDPR, the UK GDPR or the Swiss FADP leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss additions, with transfer impact assessments and supplementary measures such as encryption. For data protected by the laws of Brazil, South Africa, Australia, New Zealand, the UAE, Saudi Arabia and other countries we use the transfer mechanisms those laws recognise, including contractual clauses and the consent of the person where the law requires it. A copy of the clauses we use is available on request.

10. How long we keep data

We keep personal data only for as long as the purpose requires, and then delete or anonymise it. Our standard periods are:

• Website page-view counts: aggregated, without personal data, kept indefinitely. The anonymous visitor id cookie: twenty-four months. Microsoft Clarity recordings: up to thirty days, then deleted by Microsoft.
• Messages and call bookings from prospects: eighteen months after our last exchange, unless you become a client.
• Platform accounts and audit logs: for the duration of the client relationship and twelve months after it ends, then deleted.
• Authorisation tokens: until you revoke them, disconnect the account or the relationship ends, and never later than sixty days after their last use.
• Platform Data (posts, comments, messages, insights, reviews, advertising data): while the Connected Account is connected and the Service is active; cached copies are refreshed or deleted at least every thirty days; everything is deleted within thirty days of revocation, disconnection, termination or a verified deletion request.
• Comments, mentions, reviews and messages shown in the Platform inbox, and the answers written to them: while the Connected Account is connected and the contract is active, and thirty days after it ends, during which the client can export them; then deleted.
• Client footage and deliverables: masters kept for twelve months after delivery so that the client can request re-exports, then deleted unless the client asks for earlier deletion.
• Billing and contract records: ten years or the period required by tax and commercial law.
• Encrypted backups: purged within ninety days of the deletion of the live data.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk: encryption in transit (TLS) and at rest for tokens, credentials and stored data; the official authorisation flows of each Provider instead of passwords; least-privilege access with named accounts, multi-factor authentication and audit logging; separation between clients' data; secure development practices, dependency updates and vulnerability management; staff confidentiality undertakings and training; and contracts with every sub-processor. No system is completely secure. If a breach affects your personal data we will notify the competent authority and, where the law requires it, you, without undue delay and within seventy-two hours where the GDPR applies. Report security concerns to support@paps-studio.com.

12. Your rights

Depending on where you live, you have some or all of the following rights, which you can exercise free of charge by writing to support@paps-studio.com. We will verify your identity in a proportionate way and respond within the legal deadline. If we act as processor for a business, we will forward your request to that business and help it respond.

• Access: to know whether we process your data and to receive a copy of it and of the information in this policy.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted, subject to legal retention duties. See also our Data Deletion page for Connected Accounts.
• Restriction: to have processing limited while a request is examined.
• Portability: to receive the data you gave us in a structured, machine-readable format and to have it sent to another provider.
• Objection: to object to processing based on legitimate interest, and to direct marketing at any time, which we will stop.
• Withdrawal of consent: at any time, without affecting processing done before withdrawal.
• Not to be subject to automated decisions with legal or similarly significant effects. We make none.
• Complaint: to lodge a complaint with your data protection authority (see section 14). We would be grateful for the chance to address your concern first.

13. Additional information for residents of the United States

If you are a resident of California or of another US state with a comprehensive privacy law (including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), the following applies in addition to the rest of this policy.

Categories of personal information collected in the last twelve months: identifiers (name, email, phone, account credentials, IP address); commercial information (the services you buy from us, billing records); internet or network activity (page views, actions in the Platform, cookie choices); audio or visual information (footage you send us for editing); professional or employment information (company, role); inferences limited to the audience statistics that the Providers supply in aggregate; and the content of communications you address to a business we serve. We do not collect sensitive personal information except where it is contained in a message we handle on a business's instructions, and we do not use it to infer characteristics.

Sources, purposes and recipients are described in sections 3 to 8. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the last twelve months. We therefore do not offer a Do Not Sell or Share link, and we treat Global Privacy Control signals as an opt-out request in any case. We do not knowingly collect personal information of consumers under sixteen. We keep personal information for the periods in section 10.

Your rights: to know and access, to delete, to correct, to portability, to opt out of sale, sharing and targeted advertising (not applicable, since we do none), to limit the use of sensitive personal information, and not to be discriminated against for exercising your rights. You may exercise them by writing to support@paps-studio.com. You may authorise an agent to act for you; we will ask the agent for proof of your written permission and may ask you to verify your identity directly. If we deny a request you may appeal by replying to our decision, and we will answer within forty-five days. Under California's Shine the Light law you may ask once a year whether we disclosed personal information to third parties for their direct marketing; we do not.

Where we process personal information as a service provider or processor for a business, we do so under a written contract that restricts us to the business's purposes, and requests should be directed to that business.

14. Additional information by region

European Union, European Economic Area and Switzerland: the GDPR and the Swiss FADP apply. You may complain to the supervisory authority of your country of residence, place of work or of the alleged infringement; the list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. Our legal bases are those in section 5. Data is transferred outside the EEA under the safeguards in section 9.

United Kingdom: the UK GDPR and the Data Protection Act 2018 apply. You may complain to the Information Commissioner's Office at https://ico.org.uk. We use the UK International Data Transfer Addendum for transfers.

Canada: PIPEDA and the provincial private-sector laws of Quebec (Law 25), Alberta and British Columbia apply. We collect, use and disclose personal information with your consent or as otherwise permitted, and only for the purposes in this policy. Our Privacy Officer can be reached at support@paps-studio.com. You may complain to the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca or to your provincial commissioner. Personal information may be stored and processed outside Canada, where it is subject to local law. Commercial electronic messages are sent in line with CASL.

Brazil: the LGPD (Lei 13.709/2018) applies. Our Encarregado (data protection officer) can be reached at support@paps-studio.com. You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymisation, blocking, deletion, portability, information on sharing and revocation of consent, and you may petition the Autoridade Nacional de Proteção de Dados (ANPD). International transfers follow Articles 33 to 36 of the LGPD.

Argentina, Chile, Colombia, Mexico, Peru and other Latin American countries: we apply the local data protection laws (including Argentina's Law 25.326, Colombia's Law 1581/2012 and Mexico's LFPDPPP), you have the rights of access, rectification, cancellation and opposition (ARCO rights), and you may complain to the local authority (AAIP, SIC, INAI or their equivalents).

South Africa: POPIA applies. Our Information Officer can be reached at support@paps-studio.com. You may complain to the Information Regulator at https://inforegulator.org.za. We process personal information lawfully, minimally and for the purposes in this policy, and transfer it abroad only under section 72 of POPIA.

Nigeria, Kenya, Ghana, Egypt, Morocco and other African countries: we apply the Nigeria Data Protection Act 2023, the Kenya Data Protection Act 2019 and the other local laws that apply, you have the rights those laws grant, and you may complain to the Nigeria Data Protection Commission, the Office of the Data Protection Commissioner of Kenya or the local authority.

Australia: the Privacy Act 1988 and the Australian Privacy Principles apply. We may disclose personal information to recipients outside Australia, including in the UAE, the EU and the US, as described in section 8. You may complain to us first and then to the Office of the Australian Information Commissioner at https://www.oaic.gov.au. New Zealand: the Privacy Act 2020 applies and you may complain to the Office of the Privacy Commissioner at https://www.privacy.org.nz.

United Arab Emirates and the Gulf: the UAE Federal Decree-Law 45 of 2021 on Personal Data Protection applies to our processing, together with the Saudi Personal Data Protection Law, Qatar's Law 13 of 2016, Bahrain's Law 30 of 2018 and the laws of Oman and Kuwait where they apply to our clients there. You have the rights of access, correction, erasure, restriction, objection and portability under those laws and may complain to the UAE Data Office or the competent authority of your country.

Other countries: we apply the privacy law of your country to the extent it applies to us, and in every case at least the standard set out in this policy.

15. Deleting your data and disconnecting accounts

You can disconnect any Connected Account from the Platform at any time, and you can revoke our access from the Provider's own settings: Facebook and Instagram at https://www.facebook.com/settings?tab=business_tools and https://www.instagram.com/accounts/manage_access/; Threads from the Threads app settings under Account and Website permissions, or from the Meta Accounts Center; WhatsApp from the WhatsApp Business Manager; TikTok at https://www.tiktok.com/setting under Security and Manage app permissions; X at https://x.com/settings/connected_apps; LinkedIn at https://www.linkedin.com/mypreferences/d/permitted-services; Pinterest under Settings, Security and Connected apps; Google and YouTube at https://security.google.com/settings/security/permissions.

Revocation stops our access immediately. To have the data we already hold deleted, follow the steps on our Data Deletion page (published on this Website) or write to support@paps-studio.com. We confirm receipt within one working day, complete verified deletions within thirty days and send you a written confirmation with the date of deletion.

16. Children

Our Website, Platform and Services are meant for businesses and adults. We do not knowingly collect personal data from children under sixteen (under thirteen in the United States and where the local age is lower). If you believe a child has given us personal data, write to support@paps-studio.com and we will delete it.

17. Cookies and similar technologies

This Website sets the following cookies:

• paps_consent (essential): remembers the choice you made in the cookie banner so that it is not shown again. Twelve months.
• paps_locale (essential): remembers the language you chose. Twelve months.
• paps_vid (only after Accept): a random anonymous visitor id used by our own visit counter to tell returning visits apart. It contains no name, email or IP address. Twenty-four months.
• Microsoft Clarity cookies (only after Accept): set by Microsoft to produce heat maps and session replays, under the Microsoft privacy statement.

Page views are counted without cookies unless you have accepted. You can change your choice at any time by clearing the cookies of this Website in your browser, after which the banner is shown again, or by writing to support@paps-studio.com. The Platform uses session cookies that are strictly necessary to keep you logged in and secure. We do not use advertising cookies or tracking pixels on this Website.

18. Changes to this policy

We review this policy at least once a year and whenever our Services, our providers or the law change. The current version is always published here with its date. If a change materially reduces your rights or changes how we use data already collected, we will notify our clients by email and, where the law requires it, ask for your consent before the change applies.

Questions, requests and complaints: support@paps-studio.com, or by post to Opperator AI FZCO, trading as PAPS STUDIO, IFZA Business Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.