Privacy policy
Last updated: September 29, 2026
On this page
- 1. First: which case is yours?
- 2. Content and data managed by customers (The Interactive Studio as processor)
- 3. Visitors, customers and users (The Interactive Studio as controller)
- 4. Recipients and international transfers
- 5. Your rights with The Interactive Studio (when we are controller)
- 6. Minimum age
- 7. Security
- 8. Changes to this policy
This is a translation. The Spanish version prevails in case of any discrepancy.
Who processes your data: The Interactive Studio, S.L., tax ID (CIF) B85428746, registered office at C/ Teide, 4, oficina 0.3, 28703 San Sebastián de los Reyes (Madrid, Spain), registered in the Madrid Commercial Registry, Volume 25584, Folio 88, Section 8, Sheet M-461080, 1st entry (“The Interactive Studio” or “we”), owner of Fountant. Contact, including privacy: [email protected].
1. First: which case is yours?
The Interactive Studio acts in two different roles depending on who you are. It matters which one applies to you, because it changes who you exercise your rights with:
- If your data appears in content a customer manages with Fountant (for example, you commented on or messaged a brand, you follow one of its accounts, or you appear in a photo or video the brand publishes): the controller of that data is the customer agency or business. The Interactive Studio processes it on the customer’s behalf, as a processor (art. 28 GDPR). Go to section 2.
- If you visit fountant.com, request access, create an account, are a member of an organization in Fountant or subscribe to the service: The Interactive Studio is the controller of that processing. Go to section 3.
2. Content and data managed by customers (The Interactive Studio as processor)
2.1. Agencies and businesses use Fountant to plan, prepare, approve and publish content on the social accounts they connect themselves (today, Instagram, Facebook and YouTube) and, when they turn on the inbox, to handle the comments and messages those accounts receive. They decide which accounts to connect, what content to upload and what to publish.
2.2. Data the platform processes on the customer’s behalf:
- Organizations, brands and their context (brand kit, references, sources the customer provides).
- Connected social accounts: account identifiers and public name, and the access tokens the provider issues on connection, which are stored encrypted.
- Posts, drafts, versions, copy and media (images and videos) the customer uploads or prepares, with their approvals.
- History imported from connected accounts: posts and media already published there.
- When the customer turns on the inbox: comments and messages received on its accounts, with the author’s identifier and public name, the content and the date, and the replies the customer’s team prepares.
2.3. Artificial intelligence. Fountant generates and adapts copy (and, later, images) from the brand context the customer provides. AI suggestions are never applied or published on their own: a person on the customer’s team reviews them and decides. Fountant does not publish or reply with anything substantive without human review. AI memory is isolated per organization and brand: one brand’s context is never used for another. Customer data is not used to train our own or third-party models; model providers process it only to generate the response, under their terms (see the subprocessor list).
2.4. You exercise your rights (access, rectification, erasure, restriction, objection and portability) with the agency or business that manages the account, which decides on the processing. If you write to us directly, we will pass your request on to the customer without delay (within 5 business days at the latest) and assist them as needed.
2.5. Retention: decided by the customer while the contract lasts. When a social account is disconnected or the contract ends, data is deleted as set out in the DPA.
2.6. Posts, comments and messages sent to Instagram, Facebook or YouTube remain on those platforms, which process them as controllers under their own terms and policies. If you connected a Facebook or Instagram account and ask from Facebook for the data obtained through Fountant to be deleted, you can check the status of that request on the page Meta gives you, at app.fountant.com/borrado-de-datos.
3. Visitors, customers and users (The Interactive Studio as controller)
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Browsing fountant.com | Technical request data (IP, browser) processed by Cloudflare to serve the website | Serve and protect the website | Legitimate interest (art. 6.1.f) | We keep no browsing logs of our own; Cloudflare applies its own periods |
| Bot protection on forms (Cloudflare Turnstile) | Technical browser and device signals, IP | Prevent automated submissions and abuse | Legitimate interest (art. 6.1.f) | Processed by Cloudflare for the check; we do not keep them |
| Access request on fountant.com | Email and, if you give them: name, company, team type, number of brands and message | Handle your request and contact you | Pre-contractual steps (art. 6.1.b) / legitimate interest | Up to 12 months from the last interaction |
| User account, organizations and members | Email, name, sign-in method (email code, or Google, Microsoft or Apple), organizations, brands, members, roles and invitations | Create and manage the account, authenticate you, provide the service and support | Performance of the contract (art. 6.1.b) | Term of the contract + statutory limitation periods |
| Service emails | Email address, content of the notice | Send you sign-in codes, invitations and service notices | Performance of the contract (art. 6.1.b) | As long as needed to send and trace them |
| Subscription, credits and billing | Organization and tax details, plan, trial, payment status and AI credit usage (payments are processed by Stripe; Fountant never sees or stores card details) | Manage the trial, subscription and credits, and invoice | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) | Mandatory tax and commercial periods |
| Technical and security logs | IP, browser, sign-in and session events, audit log of account actions | Service security, abuse prevention and traceability | Legitimate interest (art. 6.1.f) | A limited period proportionate to its security purpose |
| Product analytics in the app (PostHog, EU servers) | Usage and sign-up events with an anonymous identifier, only after you accept | Improve the product | Consent (art. 6.1.a) | As configured; can be withdrawn in the app |
| Campaign measurement with Meta (pixel and Conversions API) | Hashed email, browser, Meta identifiers (_fbp, _fbc), source URL and, where relevant, conversion value | Measure campaign conversions and avoid duplicates with the pixel | Marketing consent in the app (art. 6.1.a) | Pending items are deleted once sent or when consent is withdrawn; Meta applies its terms once received |
Withdrawing marketing consent cancels pending sends to Meta and no new conversions will be sent. Withdrawal does not affect earlier sends. You can change your preferences at any time from Account → Cookies in the app, or from “Cookie preferences” on the sign-in screen.
If you sign in with Google, Microsoft or Apple, that provider shares your name, email and an account identifier with us, and processes the sign-in as a controller under its own terms.
4. Recipients and international transfers
We do not sell your data. Data is shared with Meta for campaign measurement only with the consent described in section 3. The providers we need to run the service (hosting and storage, AI models, email delivery, bot protection, payments, analytics with consent and third-party sign-in) also access data; they are listed with their identity, location and safeguards in the subprocessor and provider list, which we keep up to date.
When a customer publishes or replies from Fountant, the content is sent to the relevant platform (Meta for Instagram and Facebook; Google for YouTube), which processes it as an independent controller under its own terms.
Some of these providers involve transfers outside the European Economic Area (mainly to the United States). These transfers rely on the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses, as stated provider by provider in that list.
5. Your rights with The Interactive Studio (when we are controller)
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time, and withdraw any consent you gave, by writing to [email protected] or by post to C/ Teide, 4, oficina 0.3, 28703 San Sebastián de los Reyes (Madrid, Spain), with no requirement other than being able to identify yourself. We reply within one month at most (art. 12 GDPR). You can also complain to the Spanish Data Protection Agency (aepd.es).
6. Minimum age
Fountant is a service for professionals. The website and account sign-up are aimed at adults acting on behalf of an organization.
7. Security
We apply technical and organizational measures appropriate to the risk (art. 32 GDPR): encryption in transit, encrypted tokens for connected accounts, isolation by organization and brand enforced in the database and in the application and checked by automated tests, role-based access control, private files with authorized, time-limited downloads, and an audit log. The contractual detail for customers is in Annex II of the DPA.
8. Changes to this policy
Each version of this policy is published with its update date. If a change is significant, we will announce it on the website and, to customers, through the contract’s channels.