Last updated: April 13, 2026
Addicional Marketing, S.L. ("Plain", "we", "us"), with registered address in Sabadell, Barcelona, Spain, and privacy contact privacy@plainsocial.app, is the data controller for personal data collected through plainsocial.app and the Plain Social platform ("the Service").
This Policy explains what data we collect, how we use it, with whom we share it, how long we retain it, and what rights you have. If you have any questions, write to privacy@plainsocial.app.
When you register we collect your name, email address, agency name, and optionally a logo and brand colour. If you sign up via an OAuth provider (Google, etc.) we receive the basic profile data you share with that provider.
We log how you interact with the Service: actions performed, content created and scheduled, access dates and times, and technical performance data. We also store the OAuth access tokens for social media accounts you connect to the Service (Meta, LinkedIn, TikTok, X/Twitter, etc.) in order to publish content and retrieve metrics on your behalf.
If, as an agency, you input your clients' data into the Service (name, brand colour, associated accounts, social media data, etc.), you are the data controller for that data and Plain acts as data processor. We commit to processing that data solely on your instructions and in accordance with the Data Processing Agreement (available at privacy@plainsocial.app).
Payments are processed by Stripe. Plain does not store full card numbers or banking details; we only retain the Stripe customer and subscription identifier, invoice history, and billing email.
We automatically collect IP address, browser type and version, operating system, pages visited, session duration, and error diagnostic data. We use strictly necessary cookies for the operation of the Service; see our Cookie Policy for details.
We share data only with the providers necessary to deliver the Service ("sub-processors"). All are subject to confidentiality and data protection agreements:
| Provider | Purpose | Country |
|---|---|---|
| Vercel | Service hosting and execution | USA (SCCs) |
| Cloudflare R2 | File storage (images, logos) | USA (SCCs) |
| Anthropic | Artificial intelligence features | USA (SCCs) |
| Stripe | Payment processing | USA (SCCs) |
| Meta, LinkedIn, TikTok, X/Twitter… | Social media APIs (publishing, metrics) | Various (own policies) |
We do not sell personal data to third parties. We do not share data with advertisers.
Some of our sub-processors are located outside the European Economic Area (primarily in the United States). Transfers to these providers are covered by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), which ensure a level of protection equivalent to that required by the GDPR.
We retain your data for as long as you maintain an active account with the Service. After account cancellation, we delete or anonymise data within a maximum of 90 days, except where we are required to retain it to comply with legal obligations (e.g. tax records for the period required under Spanish law). Encrypted backups may be retained for up to 30 additional days before permanent deletion.
Under the GDPR and Organic Law 3/2018 (LOPDGDD), you have the following rights over your personal data:
To exercise any of these rights, write to privacy@plainsocial.app. We will respond within a maximum of 30 days (extendable to 90 days in complex cases). You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
If you reside in California (USA), you have the right to: (i) know the categories of personal information we collect and share; (ii) request deletion of your personal information; (iii) correct inaccurate information; (iv) opt out of the sale or sharing of your information (Plain does not sell or share personal data). We will not discriminate against you for exercising these rights. To do so, contact privacy@plainsocial.app.
If you reside in Brazil, the General Data Protection Law (Lei nº 13.709/2018) grants you rights similar to those under the GDPR: access, correction, deletion, portability, information about data sharing, and revocation of consent. You may exercise them at privacy@plainsocial.app.
Plain Social is a professional service intended for businesses and agencies. We do not knowingly collect data from individuals under 18 years of age. If you become aware that a minor has provided data without consent, please contact us so we can delete it.
We apply appropriate technical and organisational measures to protect your data: encryption in transit (TLS), encryption at rest for sensitive data, role-based access control, periodic security audits, and incident response plans. In the event of a security breach that poses a risk to your rights, we will notify you in accordance with the applicable legal time frames.
We use strictly necessary cookies for the operation of the Service. See our Cookie Policy for detailed information on the types of cookies used and how to manage them.
We may update this Policy periodically. We will notify you of relevant changes by email. The "last updated" date at the top of this page always reflects the current version.
For any privacy queries or to exercise your rights:
privacy@plainsocial.app
Addicional Marketing, S.L. · Sabadell, Barcelona, Spain