Privacy policy

Who we are

Folio is operated by Company name not set, Address not set, Country not set. We are the controller of the personal data described on this page.

Write to Contact email not set with any question or request about your data. We have not appointed a data protection officer, so privacy requests come straight to us.

What we process and why

• Your account. Your email address, your name if you give it, your password in hashed form if you set one, and your Google name and picture if you sign in with Google. We use it to create your account, sign you in, and send sign-in links. Legal basis: our contract with you.
• Sign-in sessions. A session record with the IP address and browser details of each signed-in device. It keeps you signed in and helps us spot misuse. Legal basis: our contract with you and our legitimate interest in security.
• Onboarding answers. Your role, company size, how often you post, how you rate your social media skills, how you heard about Folio, and your posting preferences. We use them to shape your first posts and posting plan, and to learn which channels bring new customers. Legal basis: our contract with you and our legitimate interest in improving Folio.
• Your website. When you enter a website, Folio reads its public pages the way any visitor could. It keeps short excerpts, the addresses it read, your logo, and your colors. It never signs in and never reads pages that are not public. Legal basis: our contract with you.
• Your workspace. Your brand profile, uploaded photos, generated images and captions, edits and their history, approvals, schedules, campaigns, what Folio learns from your choices, and your messages to the assistant. Legal basis: our contract with you.
• Connected social accounts. When you connect Instagram, Facebook, LinkedIn, or Bluesky, we store an encrypted access token, the names and identifiers of the accounts and pages, your recent posts on them so Folio can learn your voice, and the results of posts Folio publishes (views, reach, likes, comments, shares, saves, and clicks) for 28 days after publishing. For Bluesky, Folio uses your app password once to start a session and does not store the password. Legal basis: our contract with you.
• Team members and clients. The email addresses and roles of the people you invite. For client approval links, your client's email address, your message, and their decisions and notes. Legal basis: our contract with you, and for invited people, our legitimate interest in running the workspace they were invited to.
• Billing. Your plan, trial dates, and the references to your Stripe customer and subscription. Stripe collects your payment details, billing address, and VAT number directly. We never see or store your card number. Legal basis: our contract with you and our legal duties for tax and accounting.
• Emails. We send service emails: sign-in links, confirmations, invitations, approval requests and decisions, publishing failures, reminders about connections and your trial, and a weekly summary. We do not send marketing emails. Legal basis: our contract with you.
• Activity records. Records of actions in the app, such as generating, keeping, skipping, and scheduling posts, and a log of changes to your workspace. We use them to count your monthly allowance, show your activity, and fix problems. Legal basis: our contract with you and our legitimate interest in a reliable service.
• Visits to this site. Vercel Web Analytics counts page views without cookies and without storing IP addresses. Our hosting provider also keeps short-lived server logs with IP addresses to protect the service. Legal basis: our legitimate interest in understanding and protecting the site.

How Folio uses AI

To write captions, create and edit images, describe images, suggest hashtags, answer your questions in the assistant, and check content for safety, Folio sends the relevant brand profile, website excerpts, photos, posts, instructions, and messages to OpenAI.

OpenAI processes this data for us as a service provider. Data sent through OpenAI's API is not used to train its models.

AI output can be wrong. Nothing is published until you or someone you invite approves it. Folio makes no decisions about you that have legal or similarly significant effects.

Folio in your AI chat

If you connect Folio to an AI app such as Claude or ChatGPT, that app can read your workspaces, brand profile, calendar, drafts, and results, and it can create drafts, after you sign in and allow it. It cannot approve or publish anything.

We keep a record of the connection and its access tokens so the app stays connected. What you share with the AI app is processed by its provider under its own terms and privacy policy. You can remove the connection in the AI app at any time, or ask us to revoke it.

Who helps us

We use these providers to run Folio. Each one processes personal data only on our instructions and under data processing terms.

When you connect a social account, Folio publishes your approved posts to that network and reads your posts and their results from it. Meta (Instagram and Facebook), LinkedIn, and Bluesky act under their own terms and privacy policies. The same will apply to Pinterest and TikTok when they become available.

Some providers are based in the United States or can reach data from there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.

We do not sell personal data, and we do not share it for advertising.

How long we keep data

• Account data: as long as your account exists.
• Workspace data: until the workspace is deleted. Deleting a workspace removes its records and its stored photos and images.
• Sign-in: sign-in links expire after 15 minutes, and a session ends after seven days without use.
• Invitations and approval links: invitations expire after 7 days, and client approval links after 14 days.
• Post results: collected for 28 days after publishing and kept with the workspace.
• Billing records: as long as tax and accounting law requires.
• Backups: deleted data can remain in database backups for up to 30 days.

When you close your account, we delete your account data within 30 days, except what the law requires us to keep.

How to delete your data

• A social account: disconnect it on the Integrations page. Folio deletes its stored access token at once.
• A workspace: the owner can delete it in the workspace settings. Folio deletes the workspace with its posts, photos, images, and connections. You can download the workspace data as a file in settings first.
• Your whole account: write to Contact email not set from the address you sign in with. We delete your account and confirm within 30 days.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

Write to Contact email not set. We answer within one month.

You can also complain to a data protection authority, for example in the country where you live or work, or in Country not set, where we are registered.

Cookies and local storage

Folio sets sign-in cookies when you sign in. They keep you signed in and are strictly necessary.

Your browser also stores your light or dark theme choice. We use no advertising or tracking cookies, so this site has no cookie banner.

Security

All data travels over encrypted connections. Social account tokens are encrypted before we store them, passwords are stored only as hashes, and each sign-in link works once.

Access to a workspace follows the roles you set: owner, admin, approver, editor, or viewer.

Children

Folio is a service for businesses. It is not meant for anyone under 18.

Changes to this policy

When we change this policy in a way that matters, we tell account owners by email before the change takes effect. The date at the top shows the current version.