SUBAGEN Privacy Policy

Last updated: October 31, 2026

1. Who we are

The SUBAGEN app (https://subagen.com) is operated by Enzo Berrafato, sole proprietor (entrepreneur individuel, EI), trading as SUBAGEN, SIREN 934 930 454, 5 avenue de Denton, 78180 Montigny-le-Bretonneux, France (see the legal notice: https://subagen.com/en/legal-notice).

Contact for any question about your data: contact@subagen.com.

We have not appointed a Data Protection Officer, which is not required for our activity. For any question about your data, write to contact@subagen.com.

2. Who this policy is for

• hotel owners and their staff who use SUBAGEN ("customers");
• properties that request a study or that we contact to present SUBAGEN ("prospects");
• people who comment on a customer's Instagram or Facebook Page posts or send it a private message ("guests").

For customers' and prospects' data, SUBAGEN is the data controller. For guests' data, SUBAGEN acts as the property's processor (see 3.3).

3. Data we process and why

3.1 Your SUBAGEN account (customers)

• Data: name, email, password (stored hashed by our authentication provider), property, website, time zone, content you upload (photos, films), settings.
• Purpose: create and run your account and provide the service.
• Legal basis: performance of a contract.

3.2 Your connected Instagram, Facebook, YouTube and TikTok accounts (customers)

When you connect your Instagram professional account, your Facebook Page, your YouTube channel or your TikTok account, you approve on the network's official page. Your password never goes through SUBAGEN. We receive and use:

• your Instagram professional account ID and username, your Page name and ID, your channel name, your TikTok account name;
• an access token, encrypted (AES-256-GCM) in our database and never displayed;
• the permissions you granted.

We use them to:

• publish the content you approved at the time slots you approved (Reels, carousels, photos, Page Reels and posts, Shorts, TikTok videos);
• read back your own posts to confirm they are live, show their link and never publish twice;
• read the insights of your own posts (views, reach, likes, comments, saves, shares) 1, 3 and 7 days after publication, and show them to you;
• read, once a day, the insights of your own Instagram account and your own Facebook Page (accounts reached, followers and non-followers, interactions, new followers), and show them in your dashboard;
• receive comments and messages sent to your Instagram account and to your Facebook Page (Messenger), and answer them according to the rules you created, with prepared replies you approve (or that are sent automatically if you switch on "Réponse automatique", Automatic reply), or with your own replies; hide a comment when you ask us to.

Legal basis: performance of a contract.

We do not read any account other than yours. We do not use this data for advertising, do not sell it and only share it with the service providers listed in section 5.

3.2 bis YouTube and Google data

SUBAGEN uses YouTube API Services to publish your films to your channel and read their statistics. By connecting your channel, you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Data obtained from Google is also subject to the Google Privacy Policy (https://policies.google.com/privacy).

What we receive from Google, only after you approve on Google's official page:

• youtube.upload: permission to upload to your channel the films you approved, with the title, description and visibility shown to you before upload;
• youtube.readonly: your channel name and ID, to show you which channel SUBAGEN is connected to; the statistics of your own films published through SUBAGEN (views, likes, comments) and their audience data (average view duration, average percentage viewed, total watch time), to display them to you;
• youtube.force-ssl: the comments left under your channel's videos, to show them to you in Messages; posting, under the video and on behalf of your channel, the replies you write and approve; hiding (holding for review) a comment, only when you ask.

We never read any channel other than yours, never edit or delete your existing videos, and never change a video's visibility without your instruction.

Google Drive: if you choose "Import from Google Drive", SUBAGEN uses the drive.file permission through the Google Picker. We only access the files you select in the Google window, to copy them into your SUBAGEN media library. We cannot see any other file in your Drive. The Google token stays in your browser and is never stored on our servers. You can revoke access at https://security.google.com/settings/security/permissions

SUBAGEN's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This data is used only to provide the service: it is not sold, not used for advertising, not read by humans except for support you request, security or legal obligations, and not used to train artificial intelligence models.

Data we keep and for how long:

• your YouTube token: encrypted (AES-256-GCM), erased as soon as you disconnect the channel or delete your account;
• your channel name and ID: while the channel is connected;
• the ID and link of each film published through SUBAGEN: for the duration of the contract, so we never publish twice and can show you your posts;
• your films' statistics and audience data: read 1, 3 and 7 days after publication, and deleted automatically no later than 30 days after they were read.

Revoking access: at any time from SUBAGEN (Settings, Networks, YouTube, Disconnect) or from your Google Account security page: https://security.google.com/settings/security/permissions

Deletion: a request to delete your YouTube data, including by email to contact@subagen.com, is completed within 7 days.

Questions about your Google or YouTube data: contact@subagen.com.

3.2 ter Reddit data

If you connect a Reddit account, SUBAGEN uses the Reddit Data API, in line with Reddit's Developer Terms and Data API Terms, for one purpose only: posting the videos and images you approved to the subreddit you chose, from your own account, and removing them when you ask. You approve the connection on Reddit's official page; your password never goes through SUBAGEN.

What we receive from Reddit, and only after your approval:

• your Reddit account ID and username, to show you which account is connected;
• an access token and a refresh token, encrypted (AES-256-GCM) in our database, never displayed;
• the permissions you granted: identity (your account), submit (posting), read (checking that the subreddit accepts your videos and finding your post), edit (removing your post);
• for each post published through SUBAGEN: its ID and its link.

We also store the name of the subreddit you chose. To find your post after upload, we read the subreddit's latest posts: other people's posts are read in memory and never stored.

What we do not do: we do not read comments, votes, messages or profiles; we never post anywhere other than the chosen subreddit; we do not sell, rent or share any data received from Reddit, do not use it for advertising, and do not use it to train artificial intelligence models.

Data kept and retention:

• your Reddit tokens: until you disconnect the account or delete your SUBAGEN account; they are then revoked with Reddit and erased immediately;
• your account ID and username, and the chosen subreddit: while the account is connected;
• each post's ID and link: for the duration of the contract. If the post is deleted on Reddit (by you, by moderators or by Reddit) or if you remove it from SUBAGEN, we erase its ID and link, no later than 48 hours after the deletion.

Legal basis: performance of the contract.

Revoking access: at any time from SUBAGEN (Settings, Networks, Reddit, Disconnect), or on Reddit's authorized apps page: https://www.reddit.com/prefs/apps

Data Reddit processes on its side is governed by the Reddit Privacy Policy: https://www.reddit.com/policies/privacy-policy

Deletion or questions about your Reddit data: contact@subagen.com, or https://subagen.com/en/data-deletion.

3.2 quater LinkedIn data (your property's Page)

If you connect your property's LinkedIn Page, SUBAGEN uses LinkedIn's official APIs (Community Management API), in line with the LinkedIn Marketing API Terms (https://www.linkedin.com/legal/l/marketing-api-terms). SUBAGEN posts only to your property's Page, never to a personal profile. You approve the connection on LinkedIn's official page; your password never goes through SUBAGEN.

What we receive from LinkedIn, and only after your approval:

• the ID and name of the LinkedIn member who connects the Page (you, as a Page administrator), to show you which account is connected;
• the list of Pages this member administers, read when you choose; we store only the chosen Page's ID, never its name;
• an access token, encrypted (AES-256-GCM) in our database, never displayed;
• for each post SUBAGEN publishes on your Page: its ID and link, and its aggregate statistics (impressions, unique reach, reactions, comments, shares, clicks, video views), read at day 1, day 3 and day 7 to show them to you;
• the comments left under your Page's posts (text, time, author's name), to show them to you in Messages and let you reply as the Page.

Comments and their authors' names are read live from LinkedIn each time you open Messages and are never stored by SUBAGEN. Only the people on your SUBAGEN account can see them. A reply is sent only when you write it, review it and confirm it; we keep its text for 7 days, with a SHA-256 hash of the comment ID, so that it is never sent twice, then we erase it.

What we do not do: we do not read private messages, follower lists, or the profiles of people who react; we never post to a personal profile; we do not use any LinkedIn data for prospecting, advertising or contact lists; we do not sell, rent or share it, do not combine it with any other data, and do not use it to train artificial intelligence models.

Data kept and retention:

• your LinkedIn token: until you disconnect LinkedIn or delete your SUBAGEN account; it is then erased immediately;
• the member's ID and name, and the Page ID: while LinkedIn is connected;
• the ID, link and aggregate statistics of each post SUBAGEN publishes: for the duration of the contract;
• comments and their authors' names: never stored;
• the text of your replies: 7 days.

Legal basis: performance of the contract.

Revoking access: at any time from SUBAGEN (Settings, Networks, LinkedIn, Disconnect), or on LinkedIn's permitted services page: https://www.linkedin.com/psettings/permitted-services

Data LinkedIn processes on its side is governed by the LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Deletion or questions about your LinkedIn data: contact@subagen.com, or https://subagen.com/en/data-deletion.

3.2 quinquies Threads, Pinterest and Bluesky data

These three networks are only used to post the videos and images you approved, from your own account. We do not read your followers, your messages or other people's accounts, and we do not use this data for advertising or to train artificial intelligence models. Legal basis: performance of a contract.

Threads (Meta). You approve the connection on Threads' official page; your password never goes through SUBAGEN. Permissions requested: threads_basic and threads_content_publish. We receive and keep:

• your Threads profile ID, username and name, to show you which account is connected;
• an access token, encrypted (AES-256-GCM) in our database, never displayed, renewed while the account stays connected;
• for each post published by SUBAGEN: its ID and link. To find a post whose confirmation was lost, we read the latest posts of your profile (ID, text, link, date) without storing them.

SUBAGEN does not request permission to delete your Threads posts: to remove a post, use the Threads app.

Pinterest. You approve the connection on Pinterest's official page; your password never goes through SUBAGEN. Permissions requested: boards:read, pins:read, pins:write and user_accounts:read. We receive and keep:

• your Pinterest account ID, username and account type;
• the list of your boards, read so you can choose a public board; we only store the ID of the chosen board;
• an access token and a refresh token, encrypted (AES-256-GCM) in our database, never displayed;
• for each Pin published by SUBAGEN: its ID and link. So that we never post twice, we read the latest Pins of the chosen board without storing them.

Bluesky. Bluesky does not use an authorisation page: you create an app password at Bluesky (Settings, Privacy and security, App passwords) and paste it into SUBAGEN. Your main password is never requested. We keep:

• your Bluesky account identifier (DID) and handle;
• the app password and the session tokens, encrypted (AES-256-GCM) in our database, never displayed or logged;
• for each post published by SUBAGEN: its ID and link.

Retention: tokens and the app password are erased as soon as you disconnect the network or delete your SUBAGEN account; the account ID and name are kept while the network is connected; each post's ID and link, for the duration of the contract.

Revoking access: from SUBAGEN (Settings, Networks, then the network, Disconnect), or at the network, as explained at https://subagen.com/en/data-deletion.

3.3 Guests who write to a customer on Instagram or Facebook

When you comment on a post of a hotel that uses SUBAGEN, on Instagram or on its Facebook Page, or send it a private message (Instagram or Messenger), we process on behalf of that hotel:

• your Instagram or Facebook ID scoped to that account or Page, and your username or display name;
• the text of your comment or messages, the related post, the date;
• the replies sent by the hotel;
• if you click the link you received: the click, the referring site (domain name only) and whether it is a bot. We do not record your IP address for this count.

What can happen:

• if your comment contains a keyword chosen by the hotel (for example "TARIFS"), the hotel replies publicly under your comment and sends you one private message with the information you asked for (rates, a promo code, a link to its booking page), at most 7 days after your comment. This message may include a "Chambres et prix" (Rooms and prices) button;
• if you tap that button or answer, the hotel may reply within 24 hours of your last message. The reply is prepared from the rooms, prices and practical answers the hotel itself entered and confirmed. By default the hotel approves it before it is sent; if the hotel switched on "Réponse automatique" (Automatic reply), it is sent automatically. Every automatic message ends with the line "Message automatique, l'équipe de (hotel name) vous répond si besoin." ("Automatic message, the hotel team will answer if needed.");
• you never receive a message unless you wrote first.

Your email address, only if you agree: the hotel may offer to send you the link by email. The message first tells you what the address will be used for. It is saved only after a clear "yes" from you, with the time and the text you were shown. It is used only by the hotel team to contact you about this stay: at most one email per day, written or reviewed by the team, sent to you alone. Every email lets you unsubscribe in one click, and the hotel can erase your address on request. You can withdraw your consent at any time. Legal basis: your consent.

When a request arrives, the hotel is alerted by WhatsApp or email, with your Instagram username.

For this data the hotel is the data controller and SUBAGEN acts as its processor, on its instructions (Article 28 GDPR). Answering your request relies on the hotel's legitimate interest in replying to people who write to it; the email relies on your consent.

You can exercise your rights with the hotel, or write to contact@subagen.com: we will forward your request and help the hotel answer it.

3.4 Payment

Subscriptions are processed by Stripe. We never see or store your card number. Legal basis: performance of a contract; keeping invoices: legal obligation.

3.5 Reports and support

If enabled, we send you a weekly report by email (and by WhatsApp if you link a number), and answer support questions from the in-app Help, or by email at contact@subagen.com. These may include your posts' insights. Some support answers are rephrased by an automated writing tool (Gemini, by Google), from your own data. Legal basis: performance of a contract.

3.6 Prospects and study requests

• Data: the property's name and business contact details (address, phone, website, public Instagram account), public information from its website and Instagram account, and, if you give them, your name, email and phone; our exchanges.
• Source: you, when you request a study, or public sources (the property's website, directories, social networks).
• Purposes: run the study you request, send it to you, call you on the number you give us to present your results, present SUBAGEN and offer you a meeting.
• Legal basis: our legitimate interest in presenting our service to hospitality businesses. Follow-ups by WhatsApp or SMS rely on your consent.

You can object to this at any time: unsubscribe link in every email, reply "STOP" to a message, tell us during the call, or email contact@subagen.com. We then keep your contact detail on an opt-out list, only so we never contact you again.

The Instagram account preview shown in the study form is provided by Instagram, under its own rules.

3.7 Security and operations

We keep technical logs (sign-ins, errors, deliveries) to secure the service and fix incidents. Legal basis: our legitimate interest.

4. Cookies

SUBAGEN only uses cookies required to keep you signed in. No advertising or analytics cookies.

On public link pages (https://subagen.com/l/<name>), a random identifier is stored in your browser (local storage, not a cookie) so that a visit is counted only once a day. It is not linked to any person and contains no name, no IP address and no browser fingerprint. It is renewed after 13 months at most. This audience measurement, limited to counting visits, is exempt from consent under the CNIL (French data protection authority) guidelines.

5. Service providers

Your data is only accessible to the members of your property and to our service providers, who process it only to provide the service:

Transfers outside the European Union: when a provider processes data outside the European Union, the transfer is covered by the European Commission's standard contractual clauses or by the provider's certification under the EU-US Data Privacy Framework.

We do not sell any data. We may disclose data to authorities when the law requires it.

6. Retention

• Customer account: for the whole contract, then limited archiving for the legal limitation periods;
• Instagram, Facebook, YouTube, TikTok, Reddit, LinkedIn, X, Threads, Pinterest and Bluesky tokens (including the Bluesky app password): until the network is disconnected or your SUBAGEN account is deleted; they are then erased immediately;
• guests' comments, messages, conversations and Instagram, Facebook and TikTok post insights: for the duration of the contract with the property, then deleted with its account, or earlier on its request;
• YouTube films' statistics and audience data: deleted automatically no later than 30 days after they were read (see 3.2 bis);
• a Reddit post's ID and link: erased no later than 48 hours after the post is deleted on Reddit or removed from SUBAGEN (see 3.2 ter);
• a guest's email address: until consent is withdrawn or the guest unsubscribes, and at most 3 years after the last contact;
• prospects: 3 years after the last contact, unless they object earlier; the opt-out list is kept to respect it;
• invoices and accounting records: 10 years;
• technical logs: a limited period, as needed for the service's security.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent at any time. Write to contact@subagen.com; we answer within one month.

Access and portability without writing to us: in SUBAGEN, Settings, Supprimer mon compte (Delete my account), link Télécharger mes données (JSON) (Download my data; nothing is deleted), or directly https://subagen.com/app/reglages/compte/export once signed in. The file gathers your property's data readable from your account (property, brand sheet, settings, posts, content and the addresses of your files, connected networks, messages and contacts). It never contains an access token or a password.

You may lodge a complaint with the French data protection authority, CNIL (https://www.cnil.fr).

8. Data deletion

See https://subagen.com/en/data-deletion for how to remove SUBAGEN's access to Instagram, Facebook, YouTube, Reddit, TikTok, LinkedIn, X, Threads, Pinterest or Bluesky (from SUBAGEN or from the network) and how to have all your data deleted. Any user can request deletion. YouTube data is deleted within 7 days of the request.

9. Automated decisions

SUBAGEN makes no decision with legal effects based solely on automated processing. An automatic message is only sent after you wrote (a comment or a message), under a rule written and activated by the hotel or when the hotel switched on "Réponse automatique"; it always says so.

10. Security

Encrypted access tokens, data access restricted to the property's members, encrypted connections (HTTPS).

11. Changes

We will notify you of any significant change by email or in the app.

A question about these documents: contact@subagen.com