Privacy policy
Last updated: 11 October 2026
Draft document. Working text drafted for the prototype: it must be reviewed and approved by a lawyer before any commercial launch.
This policy explains what data Tchopa processes, why, who it is shared with (including Meta, TikTok and Google) and how to exercise your rights, in line with the GDPR.
1. Data controller
{{COMPANY_NAME}}, a company incorporated in Ireland (no. {{COMPANY_REGISTRATION}}), {{COMPANY_ADDRESS}}, publisher of the Tchopa service. Data protection contact: {{COMPANY_DPO_EMAIL}}.
2. Data processed
Account data: name, email address, password (encrypted), language.
Business data: name, activity, address, logo, colours, booking links, WhatsApp number.
Content: photos, videos, voice notes and WhatsApp messages sent to the service, reels produced.
Data received from the social networks you connect: see the “Connected social networks” and “WhatsApp” sections.
Technical data: connection logs, posting statistics.
3. Purposes and legal bases
Providing the service and producing your reels, posting to your accounts at your request (performance of the contract); billing (legal obligation); improving the service and preventing abuse (legitimate interest); responding to your contact requests (pre-contractual measures); receiving your WhatsApp messages (performance of the contract). Where a purpose relies on your consent (for example connecting an Instagram or TikTok account, or the consent of a person in a photo), you can withdraw it at any time.
4. Automated processing
Your messages and voice notes are automatically transcribed and analysed to fill in reel templates. No decision producing legal effects is taken automatically: every reel is submitted for your approval. Your content is not used to train third-party AI models.
5. Recipients and processors
Your data is accessible to authorised Tchopa staff and to our technical processors, who are bound by contract: hosting and file storage ({{COMPANY_HOSTING}}); Meta Platforms (WhatsApp Business Platform, Instagram, Facebook); TikTok; Google (YouTube); Runware (generation of text, images and visuals from your content); Groq (voice note transcription); Stripe (payment of credit packs and automatic top-up); a transactional email service.
Tchopa never sells your data, nor the data received from Meta, TikTok or Google, and does not use it for advertising.
6. Transfers outside the European Economic Area
Some of our processors (notably in the United States) may process data outside the European Economic Area. These transfers are covered by an adequacy decision (for example the EU–US Data Privacy Framework) or by the European Commission’s standard contractual clauses.
7. Retention periods
Account data: while the account is open, then 3 years. Content, reels and WhatsApp messages: while the account is open, then deletion within 90 days. Social network access tokens: until you disconnect the network or delete the account. Invoices: 10 years. Proof of image consent: for as long as the reel is published, then 5 years.
8. Your customers’ data
When you send a photo of a customer, you are responsible for that processing and Tchopa acts as a processor. Tchopa helps you collect and prove the person’s consent (time-stamped consent box).
9. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability (export from Settings). You can delete your account from your settings, follow the “Data deletion” page, or write to {{COMPANY_DPO_EMAIL}}. You can lodge a complaint with the supervisory authority of your country (in Ireland: the Data Protection Commission, www.dataprotection.ie; in France: CNIL, www.cnil.fr; in Brazil: the ANPD, under the LGPD).
12. WhatsApp
You talk to the assistant through Meta’s WhatsApp Business Platform. We receive your phone number, your WhatsApp profile name, the messages you send to our number (text, voice notes, photos, videos) and the delivery status of our replies.
This data is used only to understand your request, produce your reels and reply to you. Voice notes are transcribed automatically; they are not used to train third-party AI models. We only write to you when you have written to us or, outside that window, with template messages you have accepted; you can ask us to stop at any time by writing “STOP” or by removing your number in the settings.
Meta processes these messages as the provider of the WhatsApp Business Platform, under its own privacy policy (https://www.whatsapp.com/legal/privacy-policy).
13. Deleting your data
To delete your data, including data received from social networks and WhatsApp: (1) sign in, open Settings, then “Delete my account” or “Delete the business”; tokens, content, reels, messages and related data are deleted (invoices are kept to meet a legal obligation); or (2) write to {{COMPANY_DPO_EMAIL}} from your account’s email address: we reply within 30 days. Step-by-step details are on the “Data deletion” page. Deleting content already published on a network is done directly on that network.
11. Connected social networks (Instagram, Facebook, TikTok, YouTube)
If you connect a network, Tchopa receives, with your permission, an access token (stored encrypted) together with the ID and name of the account, Page or channel.
Instagram and Facebook (Meta): you sign in with Facebook; we list the Pages you manage and the professional Instagram account linked to them, then keep only the token of the Page you choose, the Instagram account ID and its username. This access is used only to publish, at your request and after your approval, the reels and images you have approved, and to track their publishing status. We do not use your personal Facebook profile.
TikTok: we receive the ID and display name of your account. The approved video is sent to your TikTok inbox as a draft; you finish it and publish it yourself in the TikTok app.
Tchopa does not read your private messages, your followers or your other content, and does not sell or share this data for advertising. Data received from Meta and TikTok is used only to provide this publishing feature.
The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. By connecting YouTube you also accept the YouTube Terms of Service (https://www.youtube.com/t/terms) and Google’s privacy policy (https://policies.google.com/privacy).
You can disconnect a network at any time in Settings > Connected accounts: the tokens are then deleted from our servers and, for YouTube and TikTok, the authorisation is revoked with the network. You can also remove access from the network’s own settings (Facebook/Instagram: “Business Integrations”; Google: https://myaccount.google.com/permissions; TikTok: the app’s security and permissions settings).