Privacy Policy
Last Updated: August 21, 2026
This Privacy Policy explains how Turca LLC ("we", "Praffer", or the "Service") collects, uses, stores, shares, and protects your personal information, social media account data, and third-party cloud integration data (Canva, Google Drive, Dropbox, Unsplash, etc.) when you access praffer.com and related software applications. By using Praffer, you acknowledge and agree to the practices described in this policy.
1. Data Controller Identity
Company Name: Turca LLC
Registered Address: 30 N Gould St, Ste N, Sheridan, Wyoming 82801, United States
Privacy & Data Protection Inquiries: [email protected]
2. Information We Collect
In order to provide our social media management and scheduling features, we collect and process the following categories of data:
- Account and Identity Information: Your full name, email address, profile picture (avatar), and a securely hashed password.
- Social Media OAuth Tokens & Account Identifiers: Encrypted OAuth 2.0 access and refresh tokens, account/channel IDs, profile names, handles, and avatar URLs for connected networks (Instagram, Facebook Pages, YouTube, TikTok, LinkedIn, etc.). All access and refresh tokens are stored using industry-grade AES-256 encryption at rest.
- Cloud Storage & Media Tool Integration Data (Canva, Google Drive, Dropbox, Unsplash):
- Canva (Canva Connect API): User ID, design IDs, and encrypted OAuth tokens necessary to initiate design sessions and import finished PNG/JPG graphics into Praffer.
- Google Drive (Google Picker API): Download metadata, file URLs, and temporary access tokens for media files specifically and explicitly chosen by the user via the Google file picker. Praffer does NOT scan, index, read, or retain any unselected Google Drive content.
- Dropbox (Dropbox Chooser): Direct download links and basic file metadata (name, file size, MIME type) for files chosen by the user via the Dropbox Chooser.
- Unsplash (Unsplash API): Search queries and image download attribution records for selected royalty-free stock photos in compliance with the Unsplash License.
- Inbox & Direct Message Data: Comments and direct messages (DMs) retrieved via official social network APIs solely to enable in-app viewing, moderation, and team replies within the Praffer unified inbox.
- User-Generated Content: Post captions, media files (images, videos, graphics), hashtags, scheduling timestamps, and workspace configurations that you upload or create within Praffer.
- Technical & Device Information: IP address, browser type, operating system, access timestamps, and error logs collected for system security, fraud prevention, and uptime monitoring.
3. How We Use Your Information
We process collected information strictly for legitimate operational purposes:
- To automatically publish and schedule posts to your connected social media channels in accordance with your configured timetable.
- To enable seamless media imports from Canva, Google Drive, Dropbox, and Unsplash into your post drafts.
- To operate the unified inbox for managing and replying to comments and direct messages.
- To calculate and visualize audience engagement, impressions, reach, and post performance analytics.
- To ensure platform security, verify user identities, and prevent malicious activities or API misuse.
- To provide customer support and comply with applicable statutory obligations.
No Sale of Personal Data: Praffer does NOT sell, rent, or trade personal data, social media content, cloud files, or OAuth tokens to any third parties for advertising, cross-context behavioral marketing, or commercial purposes.
4. Third-Party API Policies & Compliance Disclosures
Praffer integrates with third-party developer platforms via official APIs and SDKs. By connecting your accounts or cloud services, you also agree to comply with the respective platform policies:
A. Google Services (YouTube, Google Drive) & Limited Use Disclosure
Praffer uses the YouTube Data API v3, the YouTube Analytics API, and the Google Drive API to publish videos, manage comments on the user's own videos, report YouTube metrics, and allow users to select media from Google Drive.
- By using Google/YouTube features in Praffer, you agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.
- Google API Limited Use Disclosure:
Praffer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. - Prohibition on Artificial Intelligence (AI) and Machine Learning (ML) Training: User data, photos, videos, and metadata obtained through Google APIs (Google Drive, YouTube) are strictly NOT used, processed, or transferred to train, fine-tune, or develop generalized Artificial Intelligence (AI) or Machine Learning (ML / LLM) models.
- Narrow Data Scope (Picker-Only Access): For Google Drive, Praffer only accesses the specific individual files that you explicitly select via the official Google file picker. Praffer has no access to the rest of your Google Drive content.
- Revoking Google Access: You can review or revoke Praffer's access to your Google account at any time via the Google Security Permissions Settings.
B. Canva Integration (Canva Connect API)
Praffer utilizes the official Canva Connect API and Canva Button to allow users to create and edit designs in Canva and attach them directly to social posts.
- Designs are exported as high-resolution PNG/JPG files and transferred to Praffer's secure storage only upon user request.
- Canva OAuth tokens are encrypted at rest with AES-256 and used solely for design session authorization.
- Usage is governed by the Canva Privacy Policy and Canva Terms of Use.
- You may disconnect Canva integration anytime from Praffer or from your Canva account settings.
C. Dropbox Integration (Dropbox Chooser)
Praffer integrates with the official Dropbox Chooser API to let users import media files directly from Dropbox.
- Praffer only receives download links for files explicitly selected by the user inside the Dropbox Chooser dialogue.
- Selected files are transferred to Praffer's secure media server solely for post creation.
- Usage is subject to the Dropbox Privacy Policy.
D. Unsplash Integration (Unsplash API)
Praffer provides royalty-free stock imagery using the Unsplash API.
- All stock images are used under the Unsplash License.
- Download events are reported in compliance with Unsplash API guidelines to maintain proper photographer attribution.
E. Meta (Facebook & Instagram) Integration
Praffer connects with Facebook Pages and Instagram Professional accounts via the Meta Graph API for post/story/Reels publishing and inbox management.
- All operations comply with the Meta Privacy Policy and Meta Platform Terms.
- You can revoke Meta permissions at any time via Facebook App Settings or through Praffer's accounts panel.
F. TikTok Integration (Direct Post API v2)
Praffer enables video publishing and commercial content disclosure labeling via the TikTok Direct Post API v2 in accordance with the TikTok Privacy Policy and Commercial Terms.
G. LinkedIn Integration
Praffer uses official LinkedIn APIs to publish user-approved posts to personal profiles and Company Pages in compliance with the LinkedIn Privacy Policy.
5. Data Retention & Deletion Schedule
We retain your data only for as long as necessary to provide the Service or to fulfill legitimate legal requirements:
| Data Type | Retention Period | Deletion Trigger |
|---|---|---|
| OAuth Tokens (Social Networks & Canva) | Duration of account connection | Immediately and permanently erased from the database upon account disconnection. |
| Cloud Media Imports (Drive, Photos, Dropbox, Unsplash) | Until post draft or asset is deleted | Permanently purged from storage buckets when deleted by the user. |
| Inbox Data (Messages & Comments) | Duration of active account connection | Cleaned immediately when the social channel is removed or user purges the inbox. |
| Published Media Files | 180 - 395 days (by subscription tier) | Physical files purged after retention window; post metadata preserved. |
| User Profile & Account Data | Duration of membership | Permanently and irreversibly erased upon account deletion (subject to workspace ownership rules). |
For step-by-step instructions on removing permissions and deleting data, please see our User Data Deletion Instructions page.
6. Security Standards & Sub-processors
We employ robust technical and organizational measures to safeguard your information:
- All network communications are encrypted in transit via SSL/TLS (HTTPS).
- OAuth tokens and credentials are protected with AES-256 encryption at rest.
- Workspace-level multi-tenancy ensures strict isolation of client data.
Sub-processors & Cloud Infrastructure: We engage reputable infrastructure service providers under data protection agreements:
- Payment Processing: Stripe, Inc. (PCI-DSS Level 1 compliant).
- Cloud Media & File Storage: Cloudflare R2 (AES-256 encrypted storage).
- Database & Caching: PostgreSQL / Upstash Redis (Hosted in secure US/EU data centers).
- Hosting & Edge Delivery: Vercel Inc.
- Transactional Email Communications: Resend, Inc.
- Uptime Monitoring & Status Page: Better Stack, Inc. (System availability probing and incident notifications).
7. European Economic Area (EEA) & UK Rights (GDPR)
If you are located in the EEA or UK, we process your personal data under the following legal bases:
- Performance of a Contract: Providing social media scheduling, drafting, and inbox management services.
- Legitimate Interests: Securing our infrastructure, preventing spam and fraud, and maintaining uptime.
- Legal Compliance: Meeting statutory tax, accounting, and regulatory obligations.
- Consent: When you grant explicit consent for non-essential cookies.
You have the right to access, rectify, port, erase, or restrict the processing of your data. You may lodge a complaint with your local supervisory authority.
8. California Consumer Privacy Rights (CCPA / CPRA)
California residents have specific privacy rights under the California Consumer Privacy Act:
- Right to Know & Access: You may request the categories and specific pieces of personal information collected.
- Right to Delete & Correct: You may request the deletion or correction of inaccurate personal data.
- Right to Opt-Out of Sale / Sharing: Praffer does not sell your personal information or share it for cross-context behavioral advertising.
- Non-Discrimination: We will not discriminate against you for exercising your CCPA privacy rights.
- Global Privacy Control (GPC): We respect browser-based GPC signals indicating opt-out preferences.
9. Artificial Intelligence (AI) & Automated Features Disclosure
Praffer provides optional AI-assisted features (such as post caption drafting, tone adjustment, content brainstorming, and hashtag suggestions). In accordance with international transparency standards (including the EU AI Act and FTC consumer guidelines):
- Nature of AI Output: AI-generated suggestions are generated via automated statistical models and may occasionally contain inaccuracies, outdated information, or unintended phrasing. Users retain full editorial authority and are solely responsible for reviewing, fact-checking, and verifying all content prior to publishing.
- No Model Training on Private Data: Your private drafts, social posts, customer messages, and account data are NOT used to train or refine public artificial intelligence or large language models (LLMs).
10. Contact & Exercising Rights
To exercise any of your privacy rights, request data exports, or submit inquiries, please email our Data Protection team at [email protected].
Contact: [email protected]
Address: 30 N Gould St, Ste N, Sheridan, Wyoming 82801, United States
Terms of Service · Accessibility Statement · Data Deletion Instructions