Privacy Policy

Effective date: 30 September 2026.

This notice applies to Touchbud Studio at https://studio.touchbud.com/. The marketing website has a separate privacy notice.

1. Who is responsible

Feedex Ltd., 9023 Győr, Iparstr. 79, Hungary operates Touchbud Studio. Privacy contact: info@touchbud.com.

We act as controller for administering Studio accounts, security, service communications and our business relationship. When a company instructs us to process personal data in its media, campaigns or other workspace content, that company may be the controller and we its processor under a data-processing agreement. Connected platforms independently determine many aspects of processing on their own services. Contact your company administrator for requests concerning company-controlled content; we assist as required.

2. Data Studio handles

Depending on your use and enabled integrations, Studio handles:

Account identifiers, name, email, password hash, language/theme preferences, company membership, role and publishing permissions.
Uploaded images and videos, filenames and metadata; drafts, captions, links, revisions, approvals, schedules and selected destinations.
Connected account IDs, Page or organization IDs, handles, display names and avatars; granted scopes, connection status and provider access or refresh credentials.
Publishing, import and removal jobs, provider post IDs, result/error information and audit records identifying actions and their actor.
Canva design/folder metadata and the designs or exported media you choose to import.
AI prompts and the brand information, reference images or other context included in generation requests; generated responses and media.
OAuth client/grant records and requests made by an authorized ChatGPT or other API client.
Operational and security data such as request time, IP address and browser information where recorded by the application, proxy or hosting systems; support communications you send us.

We do not need social-network passwords for OAuth connections. Provider permissions and returned data vary; the authorization screen describes the access requested. Setup-only integrations do not imply that data has already been collected from that provider.

3. Purposes and legal bases

We process account and service data to provide the agreed service and respond to requests. Article 6(1)(b) GDPR applies where necessary for a contract with the individual. For employees or representatives using a company contract, our legitimate interests under Article 6(1)(f) are administering that business relationship and enabling authorized collaboration.

Security, abuse prevention, troubleshooting and proportionate audit logging rely on our legitimate interests in a secure and reliable service, balanced against individuals' rights. Compliance with legal obligations relies on Article 6(1)(c). Where processing requires consent, such as optional non-essential tracking, we request it separately under Article 6(1)(a), and it can be withdrawn without affecting prior lawful processing.

An OAuth authorization permits technical access to a provider; it does not automatically establish consent as the legal basis for every subsequent use. Companies must establish their own lawful basis for the content they process. Processing we undertake as a processor follows documented customer instructions and the applicable agreement.

4. Recipients and integrations

Authorized company users can access workspace information according to their role. Platform administrators have broader technical and administrative access. Hosting and other service suppliers may process data as necessary to operate Studio under appropriate contractual safeguards.

Contact info@touchbud.com for information about the suppliers involved in processing your data.

When you use an enabled integration:

Social platforms receive the content and metadata needed for the accounts and operations you select. Published content can become public according to the destination's settings.
Touchbud Play receives selected media and playlist/display instructions. Content shown on public displays may be visible to anyone at that location.
Canva provides authorized design information and requested exports to Studio. Imported copies remain in the Studio library unless separately deleted.
The selected AI provider receives the prompt and attached context necessary for the request. Its processing, retention and account settings apply. Do not include confidential or unnecessary personal information in a prompt.
A ChatGPT or API client authorized by you can retrieve information or perform operations within its granted scopes and your role. Information returned to that client is also subject to the client's provider policies.

TikTok, YouTube and Google Business Profile are currently setup-only in Studio. Their publishing connections are not yet enabled.

We may disclose information where required by law or reasonably necessary to protect legal rights. We do not transfer ownership of your content merely by hosting or publishing it. AI providers apply their own data-use policies and account settings.

5. Security

Studio uses role-based company access controls. The reviewed application stores provider credentials using application-level encryption and user passwords as hashes. These protections do not mean that administrators can never access operational data or that all stored media is encrypted. We apply appropriate technical and organizational measures, but no system can guarantee absolute security. Restrict workspace membership and protect your own sign-in credentials.

6. Storage periods and deletion

We retain information only for the purposes described, subject to legal obligations and legitimate security or dispute needs. Retention depends on the category and purpose:

Account and membership information is retained for administering the service relationship and resolving related support, security or legal matters.
Workspace media, drafts and campaign records are retained to provide the workspace and carry out customer instructions. Contact us to arrange export or deletion when they are no longer needed.
Provider credentials and OAuth grants are retained for authorized connections. Revocation stops authorized access, while removal of associated stored records may require a separate deletion request.
Job, security and audit records are retained as needed to troubleshoot operations, investigate misuse and resolve disputes or meet legal obligations.
Backup copies may remain until their normal replacement or expiry. Contact us for the applicable backup schedule and how a deletion request affects those copies.
Support and contractual records are retained for managing the relationship and any applicable legal recordkeeping requirements.

We assess deletion requests individually and explain applicable retention requirements or limitations.

Disconnecting a provider does not automatically erase Studio media, audit history or posts already published on that provider. You can revoke authorization in the provider's account settings. Ask us at info@touchbud.com about Studio data deletion; company-controlled data requests may need to be addressed to your company administrator. External posts and copies are subject to the destination's own deletion processes. We will explain any lawful reason for retaining specific records.

7. International transfers

Connected providers may process information outside the European Economic Area. The relevant destination depends on the integration you use and the provider's arrangements. Contact info@touchbud.com for information about processing locations and the safeguards applicable to your data, including any relevant adequacy decision or standard contractual clauses. Use of this policy does not constitute blanket consent to international transfers.

8. Cookies and local preferences

Studio uses session and security mechanisms for sign-in and protection against forged requests, and stores interface preferences such as language and theme. The Studio sign-in session is configured for up to eight hours; the language preference cookie for up to one year. Browser-local theme preferences can remain until you clear them. This notice does not describe the marketing website's analytics, reCAPTCHA or visitor-identification tools as Studio features. Any optional non-essential tracking requires separate information and consent where applicable.

9. Your rights

Where GDPR applies, you may request access, correction, erasure, restriction and portability where the relevant conditions are met. You may object to processing based on legitimate interests and withdraw consent for processing based on consent. Rights are subject to applicable legal conditions; we may need proportionate information to verify your identity or authority.

Contact info@touchbud.com. We normally respond within one month; where a lawful extension is needed, we explain it within that initial period. You may complain to a competent supervisory authority, including one in your habitual residence, workplace or where an alleged infringement occurred. For Hungary, the supervisory authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), https://www.naih.hu/.

10. Children, automated decisions and updates

Studio is intended for adult business/professional users. If you believe a child has provided personal data inappropriately, contact us. Customers remain responsible for a lawful basis and appropriate safeguards for any images or information about children in their content.

Content-generation assistance does not itself make a decision about an individual's legal rights.

We will update the effective date and explain material changes appropriately. Publication of this notice does not itself constitute consent. Contact info@touchbud.com with privacy questions.