1. Introduction

Welcome to Bobbi ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Bobbi uses enterprise-grade, commercially-licensed AI services to help you create and manage social media content. We prioritize your control over your data — nothing is ever published without your explicit approval, and we are committed to transparency about how your information is processed.

1.1 Data Controller

Bobbi (operated by Fotobee) is the data controller responsible for your personal data. Our details:

• Company: Fotobee — bobbisocials.com
• Business ID (Y-tunnus): 3505868-3
• Email: hello@bobbisocials.com

Third-party service providers who process personal data on our behalf act as data processors. We have entered into data processing agreements with these providers to ensure your data is handled in accordance with applicable data protection regulations.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide to us when you:

• Register for an account (name, email address, password)
• Use our services and features
• Connect social media accounts (Instagram, Facebook)
• Connect cloud storage services (Google Drive)
• Connect design tools (Canva) to import your designs
• Upload content, documents, or brand materials
• Contact our support team

2.2 Connected Account Data

When you connect social media or cloud storage accounts, we may access:

• Social media post content, captions, and engagement metrics (likes, comments)
• Photo thumbnails and file metadata from connected cloud storage
• Canva design metadata (design IDs, titles, thumbnails) and exported design files for designs you select to import
• Public business profile information

Important: We store only metadata, thumbnails, and text content — not full-resolution images. Your original files remain in your connected accounts.

2.3 Usage Data

We automatically collect certain information when you use our service, including:

• Log data (IP address, browser type, operating system)
• Device information
• Usage patterns and interactions with our service
• Cookies and similar tracking technologies

3. How We Use Your Information and Legal Bases for Processing

We process your personal data only when we have a valid legal basis under the EU General Data Protection Regulation (GDPR). Below we describe our processing activities and their corresponding legal bases.

Based on your consent (GDPR Article 6(1)(a)):

• Creating and maintaining your user account
• Connecting your social media accounts (Instagram, Facebook) to import content and engagement data
• Connecting cloud storage services (Google Drive) to access photo thumbnails and metadata
• Connecting design tools (Canva) to access design metadata and import designs you explicitly select
• Uploading brand documents, content, and materials for AI analysis
• Receiving marketing communications and promotional offers

You may withdraw your consent at any time by contacting us or using the relevant feature in the service (e.g., disconnecting an account). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Based on contractual necessity (GDPR Article 6(1)(b)):

• Providing, operating, and maintaining the service
• Processing your transactions and managing your subscription
• Generating AI-powered content suggestions, schedules, and recommendations
• Analyzing your brand voice and content style to deliver personalized assistance
• Communicating with you about service-related updates and support

Based on legitimate interest (GDPR Article 6(1)(f)):

• Improving, personalizing, and expanding our service
• Analyzing usage patterns and optimizing performance
• Detecting, preventing, and addressing technical issues and security threats

Based on legal obligation (GDPR Article 6(1)(c)):

• Retaining billing and transaction records as required by the Finnish Accounting Act (kirjanpitolaki)
• Responding to lawful requests from authorities
• Complying with tax reporting obligations

4. Data Storage and Security

We implement industry-standard security measures to protect your personal information. Your data is stored securely using encryption both in transit and at rest. We use secure cloud infrastructure to ensure the reliability and protection of your information.

Authentication credentials for connected services (such as social media accounts) are encrypted using industry-standard encryption methods before storage. While we employ robust security measures, no method of transmission over the Internet or electronic storage is 100% secure.

5. Data Sharing and Disclosure

We may share your information with:

• AI Processing Services: Third-party AI providers who process your content to generate suggestions and analysis. These providers act as data processors on our behalf under data processing agreements and operate under commercial service agreements.
• Cloud Infrastructure: Third-party vendors who provide hosting, storage, and technical infrastructure for our service, acting as data processors.
• Analytics Services: Third-party analytics providers who help us understand service usage and performance.
• Business Transfers: In connection with any merger, sale, or acquisition of all or a portion of our business.
• Legal Requirements: When required by law or to protect our rights and safety.

We do not sell your personal information to third parties. All third-party service providers who process personal data on our behalf do so under data processing agreements that require them to handle your data in accordance with applicable data protection laws.

6. AI and Data Processing

Our service uses artificial intelligence to analyze and generate content. Here's how your data is processed:

6.1 What Data is Processed by AI

• Social media post content, captions, and engagement metrics
• Photo thumbnails (not full-resolution images) for categorization and suggestions
• Website content for business analysis (when you provide your website URL)
• Uploaded brand documents and materials
• Your business profile and preferences

6.2 Third-Party AI Providers

AI processing is performed by industry-leading third-party providers under commercial service agreements. According to their stated policies for commercial API services, data submitted for processing is not used to train their AI models. These third-party services operate under their own privacy policies and terms of service, which govern their handling of data independently from Bobbi.

6.3 Your Control

• AI generates suggestions and drafts — nothing is published without your explicit approval
• You can disconnect connected accounts at any time
• You can request deletion of your analyzed data

6.4 Automated Decision-Making

Bobbi does not engage in automated decision-making that produces legal effects or similarly significant effects concerning you, as defined under GDPR Article 22. All AI-generated content (such as post suggestions, captions, schedules, and content strategies) is presented as recommendations only. No content is published, no account action is taken, and no decision with legal or significant effect is made without your explicit review and approval.

7. Google Drive Data

When you connect your Google Drive account to Bobbi, we access data from your Drive solely to provide the photo management and content creation features of our service. This section describes how Google Drive data is handled in compliance with the Google API Services User Data Policy, including the Limited Use requirements.

7.1 What We Access

• File metadata (file names, dates, MIME types) from folders you explicitly select
• Photo thumbnails and image content from those selected folders

We use read-only access. Bobbi never modifies, deletes, or creates files in your Google Drive.

7.2 How We Use Google Drive Data

• Photo cataloging: We catalog your photos so we can suggest them for your social media posts — a core user-facing feature of the service.
• Resized derivatives: When you approve a post for publishing, we generate resized copies (e.g., 1080px for Instagram publishing, 400px thumbnails for in-app previews) and cache them securely on our infrastructure.
• Instagram publishing: When you explicitly choose to publish a post, your Drive photos may be temporarily staged and published to Instagram via the Instagram API on your behalf. Publishing is always initiated by you — we never publish your Google Drive photos automatically or without your direct action.
• AI-powered categorization: Photo thumbnails may be sent to third-party AI services (operating as data processors under data processing agreements) for automatic categorization, tagging, and content suggestions. This processing is performed solely to provide the content recommendation features you see in the app.

7.3 Prohibited Uses

In accordance with Google's Limited Use requirements, we confirm that:

• We do not transfer Google Drive data to advertising platforms, data brokers, or any information resellers.
• We do not use Google Drive data for serving ads, including retargeting, personalized, or interest-based advertising.
• We do not use Google Drive data to determine credit-worthiness or for lending purposes.
• We do not sell Google Drive data to any third party.

7.4 Human Access to Google Drive Data

Our employees and contractors do not read your Google Drive files unless:

• You have given explicit consent (e.g., when requesting support for a specific photo or file issue);
• It is necessary for security purposes, such as investigating a bug or suspected abuse; or
• It is required to comply with applicable law.

7.5 Retention of Google Drive Data

Cached thumbnails, resized derivatives, and file metadata from Google Drive are deleted within 90 days of account deletion or when you disconnect your Google Drive account from Bobbi, whichever occurs first.

7.6 Limited Use Disclosure

Bobbi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.7 Canva Data

When you connect your Canva account to Bobbi, we access data from Canva solely to enable the design import features of our service. Canva data is processed in accordance with the Canva API and App Developer Terms.

7.7.1 What We Access

• Account profile: your Canva user ID, name, and email address (to identify the connected account).
• Design metadata: design IDs, titles, page counts, thumbnails, and folder location for designs in your Canva account, so you can browse and select them inside Bobbi.
• Design content: exported copies (e.g., JPG/PNG) of designs you explicitly select for import, generated through Canva's official export endpoint.
• Folders: folder structure so you can navigate your Canva library inside Bobbi.
• Assets: read-only access to assets (such as images and elements) referenced by designs you import, used solely to render previews and exports.

We use read-only access. Bobbi never modifies, deletes, or creates designs, folders, or assets in your Canva account.

7.7.2 How We Use Canva Data

• Design browsing and selection: we display your design metadata and thumbnails inside Bobbi so you can choose which designs to import.
• Importing designs as media: when you select one or more designs, we request an export from Canva and store the resulting image files in your Bobbi media library so they can be used in scheduled posts.
• Publishing to connected platforms: imported designs may be published to your connected social media accounts (e.g., Instagram) only when you explicitly schedule or publish a post containing them.
• AI-powered tagging: imported designs may be analyzed by our AI providers (acting as data processors) for categorization and content suggestions inside the app.

7.7.3 Prohibited Uses

• We do not sell, rent, or share Canva data with advertisers, data brokers, or information resellers.
• We do not use Canva data for advertising, retargeting, or interest-based profiling.
• We do not use Canva data to train AI models.
• We do not access designs or folders outside the scope you authorize.

7.7.4 Retention and Revocation

Imported design files are stored in your Bobbi workspace media library and follow the same lifecycle as other uploaded media — they are deleted when you remove them from the library, or within 90 days of account deletion or Canva disconnection (whichever occurs first). You can disconnect Canva at any time from Settings, and you can also revoke Bobbi's access directly in your Canva account.

8. Your Privacy Rights

Under the EU General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access (Article 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.
• Right to rectification (Article 16): You have the right to request that we correct any inaccurate personal data or complete any incomplete data we hold about you.
• Right to erasure (Article 17): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, or when you withdraw consent.
• Right to restriction of processing (Article 18): You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to object (Article 21): You have the right to object to the processing of your personal data when processing is based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Article 7): Where processing is based on your consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (see Section 16).
• Disconnect Accounts: You can disconnect linked social media or cloud storage accounts at any time through the service settings.

To exercise any of these rights, please contact us at hello@bobbisocials.com. We will respond to your request within 30 days.

How to delete your data

You can delete your Bobbi account and the data attached to it in either of two ways.

1. Delete it yourself. Sign in to Bobbi, open Settings, scroll to Account, and choose Delete account. You will be asked to confirm. This removes your account, your workspace content, and any connected social media tokens.
2. Ask us to do it. Email hello@bobbisocials.com from the address on your account, saying you want your account and data deleted. We respond within 30 days.

Disconnecting Instagram alone, without deleting your account, is also possible from Settings. That removes the stored access token and stops Bobbi from reading or publishing to the account. You can also revoke Bobbi's access from Instagram itself, under Settings, Website permissions, Apps and websites.

Retention periods for each category of data after deletion are listed in the table in Section 9.

9. Data Retention

We retain your personal data for specific periods depending on the type of data and the purpose of processing:

Third-party service providers may retain data according to their own retention policies, which are independent of our practices.

10. Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

11. Third-Party Services

Our service integrates with third-party platforms including social media networks, cloud storage providers, and AI processing services. Each of these services operates under their own privacy policies and terms of service. We encourage you to review the privacy policies of any third-party services you connect to Bobbi, as their data handling practices are governed by their respective policies.

12. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us.

13. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. This includes transfers to third-party service providers who may process data in various jurisdictions. We ensure appropriate safeguards are in place for such transfers where required by applicable law.

14. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

15. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

16. Supervisory Authority

If you believe that we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto):