Privacy policy

1Data controller

2What we use your data for

We process your data only for the purposes listed below. We do not use it for anything else without telling you first.

• Deliver the services you contracted (SEO, advertising, social media, website and invoicing) and give you access to your panel.
• Manage the contractual relationship: quotes, contracts, invoices, payments and support.
• Answer enquiries you send us by form, email or WhatsApp.
• Send you information about your services and, with your consent, commercial information. You can unsubscribe at any time.

3Legal basis

Each processing activity relies on one of these bases:

• Performance of a contract: delivering and managing the contracted services.
• Consent: commercial communications, non-essential cookies and connecting your third-party accounts.
• Legitimate interest: security of our systems and improvement of the services.
• Legal obligation: retention of invoices and of tax and accounting records.

4Your rights

You may exercise the following rights at any time, free of charge and without giving reasons:

To exercise them, write to info@karma.studio stating which right you wish to exercise. We will reply within one month at most. If you believe your request was not handled properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). info@karma.studio

5How long we keep it

We keep your data for as long as the contractual relationship lasts and, afterwards, blocked for the statutory retention periods: six years for commercial and accounting records and four years for tax records under Spanish law. Data processed on the basis of your consent is deleted as soon as you withdraw it.

6Security

We apply technical and organisational measures to protect your data: encryption in transit (HTTPS), role-based access control, hashed passwords, regular backups and activity logging. Access tokens for your third-party accounts are stored encrypted and are never displayed in the panel.

7Connexions aux services tiers

Karma Studio works on your behalf inside platforms that belong to you. To do that we ask for specific permissions, always with your explicit authorisation and only the minimum each contracted service needs. Below is every permission, exactly what we do with it, and how to revoke it whenever you want.

Google / YouTube

• youtube.upload — upload the vertical videos we produce for you to your channel. We do not read, modify or delete any other video on your channel.
• youtube.readonly — read your channel name and ID, only to show you which channel we are publishing to.
• webmasters — read in Search Console which searches people find you with and where you rank, to guide the SEO work.
• analytics.readonly, analytics.edit — read your website traffic and, if you do not have one yet, create your Google Analytics 4 property and data stream.
• business.manage — manage your Google Business Profile: post updates, reply to reviews and read its insights.
• adwords — read and manage your Google Ads campaigns if you have that service contracted.
• indexing, siteverification — notify Google about new pages on your site and verify that the domain is yours.
• calendar.app.created, calendar.freebusy — create and read only the events Karma Studio generates. We do not access the rest of your calendar.
• openid, userinfo.email, userinfo.profile — identify you when linking the account (your name and email). Not used for anything else.

Karma Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting your YouTube account you also agree to the YouTube Terms of Service.

• Google Privacy Policy
• YouTube Terms of Service

You can revoke Karma Studio's access to your Google account at any time, without giving reasons and without losing your data, from these Google pages:

• https://myaccount.google.com/permissions
• https://security.google.com/settings/security/permissions

Meta (Facebook, Instagram y Threads)

• pages_show_list, pages_read_engagement — see the list of pages you manage and read their insights.
• pages_manage_posts — publish the posts we prepare on the page you choose.
• instagram_basic, instagram_manage_insights — see your Instagram professional account and read the insights of what has been published.
• instagram_content_publish — publish the content we prepare on your Instagram.
• threads_basic, threads_content_publish — see your Threads profile and publish the content we prepare on it.

LinkedIn

• w_member_social — publish the content we prepare on your LinkedIn.
• openid, profile, email — identify you when connecting the account.