Costa Iberica Social Insights Privacy Policy
Controller: Costa Iberica Real Estate SL · CIF B56813819 · C/ Ramón Gallud 78B, 03181 Torrevieja, Alicante, Spain · office@costaiberica.com
1 Controller
Costa Iberica Real Estate SL, CIF B56813819, C/ Ramón Gallud 78B, 03181 Torrevieja, Alicante, Spain, operates Costa Iberica Social Insights and is the controller of the personal data described in this policy. Contact: office@costaiberica.com.
The Service is a private analytics dashboard used within the company. It has no public registration or consumer accounts. Only people authorised by the company may access it.
2 Data we receive from TikTok
When an account holder connects a TikTok account, TikTok asks them to approve specific permissions. We receive only data covered by those permissions and relating to the connected account:
- Account information: open_id, union_id, display name, avatar image, follower count, following count, total likes and video count. We do not request the username, biography or profile link.
- Published video performance: identifier, title, description, publication date and time, cover image, share link, duration, views, likes, comments and shares for the connected account’s own published videos.
- Access credentials: only the long-lived refresh token is stored, encrypted. The short-lived access token is obtained when needed and is not stored.
The application requests exactly three permissions: user.info.basic, user.info.stats and video.list. It does not request user.info.profile or any permission to publish or upload content. We do not access direct messages, contacts, follower lists, advertising data or activity from other accounts. The dashboard calculates total_interactions by summing available counters; this is not an additional data field received from TikTok. We do not archive TikTok media files.
3 Data we receive from YouTube
The YouTube integration is read-only and covers the company’s own channel only. Through the YouTube Data API and the YouTube Analytics API we receive the channel’s identifier, title, handle, subscriber count and video count, and for the channel’s own videos: identifier, title, description, publication date and time, thumbnail, duration, views, likes, comments, watch time and average view duration. Only a refresh token is stored, encrypted; the short-lived access token is not stored. We do not request permission to upload, edit or delete videos, and we do not read comments, messages or data belonging to any other channel.
The YouTube integration uses the YouTube API Services. By connecting a channel you are also bound by the YouTube Terms of Service (https://www.youtube.com/t/terms), and Google’s Privacy Policy (https://policies.google.com/privacy) describes how Google handles data. Stored YouTube data can be removed on request as described in section 10; access can also be revoked at any time through the Google security settings page (https://myaccount.google.com/permissions).
4 Data from other connected platforms
The same principle applies to Meta — Instagram and Facebook: identifiers and profile details of accounts managed by the company, their posts and videos, performance metrics supplied by each platform and the credentials required to maintain the connection. Media files downloaded from Meta are held in private storage.
5 Data about dashboard users
- Sign-in and session data: authorised user email, authentication-provider identifier and the signed cis_session cookie, lasting no more than 12 hours and marked HTTP-only, SameSite and Secure when HTTPS is used.
- Access record: sign-in attempts, sign-outs and platform connection or disconnection events, with date, time and originating IP address.
- Technical logs: requests and errors generated by the application and hosting provider. Credential values are removed before logs are stored.
6 Purposes and legal basis
We process data to give authorised staff access, collect and display statistics for social accounts managed by the company, record who connects or disconnects an account, and keep the Service secure and operational. The legal basis is Costa Iberica Real Estate SL’s legitimate interest in measuring and managing its own published content and protecting its systems. Where consent or platform authorisation is required, it is requested through the relevant flow. We do not use the data for targeted advertising, automated decisions or profiling people who view the company’s posts.
7 Recipients
Data may be viewed only by authorised staff with an administrative role. Render hosts the application and Supabase provides managed PostgreSQL, authentication and storage in a configured European Union region; each acts as processor or subprocessor as applicable. We do not sell TikTok user data or any other data processed by the Service, and we do not disclose it to third parties for their own purposes.
8 Location and security
Traffic is served over HTTPS. Platform credentials are encrypted before storage using AES-256-GCM; the key is held in the hosting environment rather than the database. Credentials are stored in a schema not exposed through the public database API. The application removes credential-shaped values from logs and stored error summaries. Meta media files are kept in a private bucket that is not publicly readable; the Service does not archive TikTok media files.
9 Retention
Statistics are retained as a historical record for internal reporting while needed for that purpose. The Service does not currently apply an automatic deletion schedule. Credentials are retained until the account is disconnected, access is revoked or the credential ceases to be valid. Session cookies expire within 12 hours. Deletion requests are carried out manually. Final retention periods and periodic reviews will follow the company’s applicable legal and operational instructions.
10 Revocation and deletion
An account holder may revoke the connection in TikTok, normally under Settings and privacy → Security and permissions → Apps and services, or ask Costa Iberica Real Estate SL to disconnect it. A YouTube connection can be revoked at https://myaccount.google.com/permissions, and a Meta connection in the settings of the relevant Facebook or Instagram account. After revocation or disconnection, the Service stops collecting new data and removes the connection credential. Previously collected historical data is deleted manually when required or following a valid request.
To request access, correction, deletion, restriction, objection or portability, email office@costaiberica.com. The dashboard has no self-service data deletion feature.
11 Rights
Under the GDPR, you may exercise rights of access, correction, deletion, restriction, objection and portability, and withdraw consent where processing relies on it. You may also complain to the Spanish Data Protection Agency at www.aepd.es. We will respond within the legally applicable period.
12 International transfers
Some technology providers or their subprocessors may process data outside the European Economic Area. Where applicable, Costa Iberica Real Estate SL will use the mechanisms required by the GDPR, such as adequacy decisions, Standard Contractual Clauses and supplementary measures, according to the current configuration and contracts with each provider.
13 Changes and contact
We may update this policy when the Service, law or providers change. The date above identifies the current version. Questions and requests: office@costaiberica.com.