GDPR

Herman Foundry Oy (Business ID 3636930-1), 99140 Kittilä, Finland, is the controller of the personal data of FeedSquad's users. For the people in our customers' own data, such as newsletter subscribers or the leads Scout finds, the customer is the controller and we process that data for them under our Data Processing Agreement.

• Access and a copy. Ask us at privacy@feedsquad.com. Settings → Account → Privacy also has a download of your profile, brand context and preferences as JSON.
• Correction. Change most of your data yourself in Settings, or ask us.
• Erasure. Ask in Settings → Account or by email. We complete it without undue delay, and within 30 days.
• Restriction of our processing while a question about it is being resolved.
• Portability: the data you gave us, in a machine-readable format (JSON).
• Objection to processing based on our legitimate interest. For product analytics this is a switch: Settings → Account → Privacy → Product analytics. Turn it off and we record nothing linked to your account.
• Withdrawing consent, for example to analytics cookies, at any time through "Cookie settings" in the website footer or the app sidebar.

We answer requests within one month. If a request is complex we may take up to two more months and will tell you why. We may ask you to confirm your identity first.

• Contract: your account, your work in FeedSquad, publishing to the accounts you connect, billing.
• Legitimate interest: security and abuse prevention, error monitoring, our customer relationship, and product events recorded on our servers (identifiers, counts and categories, never your content). You can object to any of these.
• Consent: analytics cookies (PostHog and Google Analytics load only after you accept) and any marketing email.
• Legal obligation: accounting records under the Finnish Accounting Act.

The privacy policy has the full table of purposes, data, legal bases and retention.

Our database and file storage are in the EU (Ireland) and our servers run in the EU (Frankfurt); product analytics and error monitoring are EU-hosted. Providers outside the EU, in the United States, receive data under the EU Standard Contractual Clauses, and under the EU–US Data Privacy Framework for the providers certified under it. Each is named, with its safeguard, on the sub-processor list.

• TLS on every connection, and HTTPS enforced by the browser.
• Tokens and keys for the accounts you connect encrypted with AES-256-GCM; passwords stored only as a hash; the database encrypted at rest by our provider.
• Database rules that restrict each user to their own data, and production access limited to the people who run FeedSquad.
• Disconnecting an account deletes the tokens we hold for it.

The security page has the details, including what is not in place yet.

Your account data stays while your account is active and goes when we process your deletion request. Some data expires sooner on its own: for example, the excerpts of public posts Scout observed after 90 days, and unsubscribed newsletter subscribers 30 days after they leave. Section 9 of the privacy policy lists every period.

If a personal data breach happens, we tell the people and customers affected without undue delay, and where the law requires it we notify the Data Protection Ombudsman within 72 hours of becoming aware of it.