Vai al contenuto
Social
Accedi Crea il workspace

SPUN SocialPrivacy notice

Privacy notice

Last updated: 10 October 2026

This notice explains which personal data SPUN Social processes, why, for how long and what your rights are, under articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003). It applies to the spun.social website and to the SPUN Social service, the platform to plan, write and publish social media content. The Italian version is the reference text.

1. Data controller

SPUN S.r.l., Corso E. Padovano 33, Pagani (SA), Italy · VAT IT06011400659 · REA SA-490544.
For any question about your data write to hello@spun.ai.

2. Which data we process

  • Browsing data. IP address, date and time of requests, pages visited, browser and device type, recorded in server logs to run and protect the website.
  • Account data. Name, email address, username, password (stored only in encrypted form), time zone and language.
  • Workspace data. Members invited to your workspace, groups, campaigns and labels.
  • Connected social accounts. When you connect an account (for example Instagram, Facebook, TikTok, LinkedIn, X, YouTube, Telegram, Pinterest, Google Business Profile, Threads or Reddit) the platform sends us the account identifier, public name, profile picture, the permissions you granted and the access tokens needed to publish on your behalf.
  • Content. Texts, images, videos, links, RSS feeds and CSV files you upload, write or schedule. They may contain data about other people: in that case you need a legal basis to use them.
  • AI Studio. The prompts you write, the generated texts and media and your credit usage.
  • Payments. Chosen plan, amount, currency, status and transaction identifier. Full card or account details are handled directly by the payment provider: SPUN neither sees nor stores them.
  • Communications. The content of the messages you send us for support or information.

3. Why we process them and on what legal basis

  • Providing the service: creating and managing your account, connecting social accounts, scheduling and publishing content, letting your team work. Basis: performance of the contract (art. 6.1.b GDPR).
  • Handling payments, invoices and tax and accounting obligations. Basis: contract and legal obligation (art. 6.1.b and 6.1.c).
  • Sending service messages: email confirmation, password reset, payment and security notices. Basis: contract (art. 6.1.b).
  • Answering your support requests. Basis: contract or pre-contractual measures (art. 6.1.b).
  • Protecting the service and preventing abuse and fraud, including through logs. Basis: SPUN's legitimate interest in the security of the service (art. 6.1.f).
  • Complying with the law and defending our rights. Basis: legal obligation and legitimate interest (art. 6.1.c and 6.1.f).

We do not use your data for profiled advertising and we do not sell it. If in the future we want to send you promotional messages, we will ask first and you will be free to refuse.

Account data is required to use the service: without it we cannot activate it.

4. Your clients' content: SPUN as processor

If you use SPUN Social to manage other people's social accounts (for example as an agency), for the personal data contained in their content you or your client are the controller, and SPUN processes it as a processor (art. 28 GDPR), only to provide the service and according to your instructions. A data processing agreement is available on request.

5. Who may receive the data

  • Infrastructure provider: Amazon Web Services, with servers in Paris, in the European Union, as processor.
  • Payment providers: Stripe and PayPal, which process payment data as independent controllers under their own privacy notices.
  • Artificial intelligence model providers (for example OpenAI, Google, Anthropic), depending on the models active in AI Studio, to generate the content you ask for. They receive only what the request needs.
  • Social platforms you connect: when you publish, the content and account data go to the chosen platform, which processes them as an independent controller under its own privacy notice.
  • Email service providers for service messages.
  • Members of your workspace, who see the workspace's content and accounts according to the permissions you give.
  • Advisers (for example tax and legal) and authorities, when the law requires it.

The up-to-date list of processors is available by writing to hello@spun.ai.

6. Transfers outside the European Union

Some providers (for example artificial intelligence and payment providers) and the social platforms may process data outside the European Union, in particular in the United States. In those cases the transfer relies on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for participating providers, or on the standard contractual clauses approved by the Commission (art. 45 and 46 GDPR).

7. How long we keep the data

  • Account, workspace and content: as long as the account is active. When you close it, we delete them within 30 days, except backup copies, which are overwritten on a rolling basis within the following 30 days.
  • Social account tokens: until you disconnect the account or close yours.
  • Payment and billing data: 10 years, as required by law (art. 2220 of the Italian Civil Code).
  • Server logs: up to 12 months, unless they are needed longer to establish an abuse or an offence.
  • Support requests: up to 24 months after the last reply.

8. How we protect the data

Encrypted connections (HTTPS), passwords stored only in encrypted form, system access limited to the people who need it, backups and periodic checks. SPUN S.r.l. operates an information security management system certified under the standards shown in the website footer.

9. Your rights

At any time you can ask to access your data, correct it, delete it, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on legitimate interest (art. 15–22 GDPR). Where processing is based on consent, you can withdraw it whenever you want, without affecting processing already carried out.

To exercise your rights write to hello@spun.ai: we reply within 30 days. You can also lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).

You can already change or delete much of your data yourself from the account area, and you can disconnect social accounts at any time, also from each platform's settings.

10. Cookies and browser storage

The website uses only technical tools needed to make it work. These do not require consent (art. 122 of the Italian Privacy Code).

  • spun_social_session: technical cookie that keeps you signed in and remembers your language. It lasts 2 hours and is renewed at every visit.
  • XSRF-TOKEN: security cookie that prevents third-party sites from submitting forms on your behalf. It lasts 2 hours and is renewed at every visit.
  • Browser storage (localStorage and sessionStorage): remembers the light or dark theme and the language you choose. It stays in your browser and is not sent to anyone; you can clear it from your browser settings.

We do not use profiling cookies or third-party analytics tools. The website's fonts, images and videos are served from our own servers. If in the future we add analytics or marketing tools, we will update this notice and, where required, ask for your consent before activating them.

11. Minors

SPUN Social is designed for professionals and businesses and is reserved for adults.

12. Changes

We may update this notice when the service or the law changes. The date at the top shows the latest version; we also announce important changes by email or in the service.