LEGAL DRAFT

Privacy Policy

Draft for professional legal review before commercial launch. This document is not a lawyer-approved agreement and does not create an activation or acceptance workflow.

Scope and responsible parties

This preparation describes actual product behavior. WorkToSocial is a proprietary software product owned by VISION PRINT EOOD, UIC 202512955, VAT No. BG202512955, Bulgaria. Software ownership alone does not determine GDPR controller/processor roles. Customer and provider roles, legal bases, contacts, rights procedures, subprocessors and international transfers must be finalized in a professional GDPR/privacy review.

Account and worker data

The system stores account identity such as name, email, role, active status and salted password hashes, plus sessions, CSRF tokens and optional passkey credentials. Jobs contain service, location/area, worker attribution, timestamps, reference and worker notes. Consent choices and worker bonus/payment-status records are stored for the workflow.

Photos, videos and editing

Uploaded photos, normalized videos, thumbnails, derivatives and final social exports are private media. Photos can contain people and private information. Camera originals remain on the capture device under the present video workflow; server processing stores normalized video rather than promising permanent original-camera retention. Editing settings, subtitles, brand configuration and publication URL records are associated with media.

Device storage

The PWA uses local browser storage for drafts and waiting uploads and a service-worker cache for app assets. Sessions use secure HttpOnly cookies. Clearing browser data can remove unsent device files. This draft does not claim analytics, advertising cookies or behavioral tracking.

Processing, technical logs and social workflows

The current staging architecture uses Cloudflare storage/database/media services and AI processing where selected. The prepared BYOC runtime can use customer Google storage and speech/text-to-speech services; real Google deployment is not certified here. Selected media/audio can be processed for requested subtitles or narration. Technical errors, security/session data, processing records, retention audit and licence-command audit support operations. No new telemetry collector is added by this legal work. Social accounts are preparation/manual export workflows; real OAuth/publishing is not activated.

Storage and retention

Media is stored privately and scoped to the company. Retention settings and dry-run tools exist; destructive cleanup remains disabled in staging preparation. No fixed retention period is asserted as active. Device drafts and server media have different lifecycles. Backup retention, deletion/return procedures and commercial periods must be confirmed before launch.

Customer-controlled data and infrastructure

SaaS customers own or control their uploaded business content under applicable terms. Enterprise/BYOC customers control their data and customer-owned infrastructure subject to agreements. The software owner retains the software IP. Data access, subprocessors, roles, transfers, security commitments and rights requests must be documented for the actual deployment before commercial use.