Diffusion privacy policy
Last updated: 27 October 2026
1. Who we are
Diffusion (diffusion.belrive.co) is an internal tool operated by Bel Rive that lets a small number of authorised people schedule and publish their own content to their own Instagram, Facebook, Threads, LinkedIn, TikTok and YouTube accounts. Diffusion is not open to the public: user accounts are created by the administrator.
Data controller: Bel Rive. Contact: [contact address to be completed].
2. Data we process
- Diffusion account: username, name, e-mail address, password (hashed), two-factor secret (encrypted), time zone.
- Connected social accounts: account ID, public name and handle, profile picture, OAuth access and refresh tokens (encrypted at rest), token expiry dates, granted permissions.
- Content: texts, titles, images, videos and documents you upload for publication, scheduling dates, publishing settings (privacy, comments, etc.).
- Publishing results: IDs and links of the created posts, status, error messages.
- Audit log: who published what, where and when, IP address of sensitive actions (sign-in, publishing, account management).
Diffusion does not read your private messages, followers or account analytics. It only uses the access you grant to publish the content you scheduled and to check the status of those posts.
3. Why we use it
- To publish, at the chosen time, the content you scheduled to the accounts you connected;
- to show the status of each post (scheduled, in progress, published, failed) and links to the live posts;
- to secure access (authentication, two-factor authentication, audit log).
Legal basis: performance of the service requested by the user, and Bel Rive's legitimate interest in securing its tool.
4. Sharing
Content is sent only to the social network you selected, through its official API: Meta (Instagram, Facebook, Threads), LinkedIn, TikTok, Google (YouTube). So that these networks can fetch media files, the files are reachable at long, unguessable URLs under diffusion.belrive.co/media/. No data is sold or used for advertising.
5. Google / YouTube data
Diffusion uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Data received from Google is handled in accordance with the Google Privacy Policy. Diffusion's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Diffusion's access at any time from your Google account permissions page.
6. Retention
- Access tokens: until the account is removed from Diffusion or access is revoked on the network;
- media and publishing history: as long as the user account exists, then deleted on request;
- audit log: 3 years maximum.
7. Security
HTTPS only, hashed passwords, mandatory two-factor authentication, OAuth tokens encrypted at rest, strict separation of accounts between users, audit log.
8. Your rights and data deletion
You have the rights of access, rectification, erasure, restriction, objection and portability (GDPR). To delete your data:
- in Diffusion, "Comptes" page, "Retirer" button: the access token is deleted immediately;
- you can also revoke access from the network itself (Facebook / Instagram "Apps and websites", LinkedIn "Permitted services", TikTok "Manage app permissions", Google "Permissions");
- for full deletion of your Diffusion account, media and history, write to the contact address above: deletion is completed within 30 days.
You may lodge a complaint with the competent data protection authority (Portugal: CNPD; France: CNIL).
9. Changes
This policy may be updated; the last update date is shown at the top of this page.