Codiro Marketing

Privacy policy

Codiro Marketing · version 2.0, October 2026

Codiro Marketing is a marketing platform. Businesses add their websites, connect their own social media, advertising, analytics, e-mail and shop accounts, and AI agents help them research, write, publish and measure marketing. This policy explains which data we process, why, and what you can do about it.

Who is responsible

Codiro BV, Balgweg 6, 1764 KB Breezand, the Netherlands (Chamber of Commerce 71320180), aron@codiro.io. For your own account we are the controller. For the data in your workspace (your content, the accounts you connect, your website visitors and leads) you are the controller and we are your processor under article 28 GDPR; this policy and our terms form the data processing agreement.

What we process

  • Your account: name, e-mail address, password (hashed), two-factor settings, and the Google or Apple ID if you sign in with them.
  • Your websites: the public pages of the websites you add (text, images, prices, sitemaps), to understand your brand, check SEO and create content.
  • Content you create with us: briefs, drafts, images, videos, your approvals and edits, and your feedback to the agents.
  • Connected accounts: see the next section. Access tokens are stored encrypted and are only used for the actions described there.
  • Website visitors (only if you install our measurement tag): page views, the campaign that brought the visitor (UTM tags and ad click IDs) and conversions such as orders or sign-ups. Without consent we only keep an anonymous count. With consent, an e-mail address or phone number from a form or order is stored only as a SHA-256 hash, to report the conversion to your own ad accounts.
  • Leads from lead-form ads you run: the name, e-mail address and phone number someone enters in your form, stored encrypted and shown only to the owners and admins of your workspace.
  • Billing: company name, address, VAT number and payment status. Card or bank details are handled by Mollie or Stripe and never reach us.

Data from accounts you connect

You choose which accounts to connect, and can disconnect each one at any time under Channels. We request only the permissions listed below and use the data only to provide these features to you.

  • Facebook, Instagram and Threads (Meta): the name and picture of your Pages and accounts, publishing the posts, stories and videos you approve, the first comment you wrote, the reach, likes, comments, saves and clicks of those posts. With Meta Ads: creating the campaigns you approve within your budget limits, their results, your product catalogue and lead forms, and the leads from your forms.
  • Google: YouTube (uploading the videos you approve, their views, likes, comments and watch time), Search Console (search queries, clicks and positions of your site), Google Analytics 4 (visits, sources and conversions of your site), Business Profile (publishing your updates, reading reviews and posting the replies you approve), Google Ads (creating the campaigns you approve, their cost and conversions, and sending your measured conversions) and Merchant Center (your product feed).
  • TikTok, LinkedIn, Pinterest, X and Reddit: your account name and picture, publishing the posts you approve with the settings you choose, and their results. With their ad platforms (and Microsoft Advertising): creating the campaigns you approve and reading their results.
  • Mailchimp, Klaviyo, Brevo and MailerLite: your lists or audiences (names and sizes, not the subscribers themselves), creating and sending the newsletters you approve, and their open and click statistics.
  • Shopify and other shops: your public products, prices and stock, and paid orders (order value, products, the campaign that brought the buyer, and a hashed e-mail address) to measure which marketing brings sales.

We do not sell this data, do not use it for advertising of our own, and do not share it with anyone other than the sub-processors below, which need it to provide the service.

Google user data

Codiro Marketing's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs is not used to develop, improve or train general AI or machine learning models, is not used for advertising, and is not read by people except with your permission, for security, or when the law requires it.

The YouTube features use the YouTube API Services. By connecting YouTube you also agree to the YouTube Terms of Service, and Google processes data under the Google Privacy Policy. You can revoke our access at any time on Google security settings or by disconnecting under Channels; we then delete the stored access token immediately and the related statistics within 30 days.

Facebook and Instagram data deletion

Removing our app in your Facebook settings (Settings › Apps and websites) disconnects your Pages and Instagram accounts and deletes the stored access tokens. To have all data we received from Meta deleted, use "Send request" for our app on that same Facebook screen, or e-mail aron@codiro.io. You receive a confirmation code and a link where you can follow the deletion.

AI processing

Website text, your brand profile, research data and drafts are sent to AI models to write, check and analyse content. The data from your connected accounts is used only for your own workspace and is never used to train AI models.

Sub-processors

  • Anthropic (Claude) and Google (Gemini): AI for writing, checking and analysing. Their API terms forbid training on this data.
  • Perplexity, OpenAI, xAI, when enabled: public buyer questions and research queries, to measure visibility in AI search. No personal data.
  • DataForSEO, when enabled: keywords and public domains, for search volumes and rankings. No personal data.
  • ElevenLabs, when you choose AI voice-overs: the script of that video.
  • Mollie and Stripe: payments for your subscription.
  • The platforms you connect, for the actions you approve, as described above.

Where it is stored

On our servers in the Netherlands (EU). Access tokens, passwords, API keys and lead contact details are encrypted. AI providers outside the EU are used under the EU standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

  • Workspace data: as long as the workspace exists. Deleting a workspace removes its data within 30 days, backups within 90 days.
  • Access tokens: until you disconnect the account; then they are deleted immediately.
  • Leads from lead forms: 90 days, then the contact details are erased. Export them to your own system before then.
  • Website visit data from the measurement tag: 13 months.

Cookies

The app itself uses only the cookies needed to keep you signed in and secure. Our measurement tag on your own website follows the consent your visitors give in your cookie banner.

Your rights

You can view, correct, export (Settings › Autonomy & workspace › Export) or delete your data, and object to or restrict its use. E-mail aron@codiro.io; we answer within 30 days. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). The service is meant for businesses and not for children under 16.

Security

HTTPS everywhere, encrypted secrets, two-factor sign-in, access only for the members of your workspace, an audit log of every agent action, and daily backups.

Changes

When this policy changes in a way that matters, we tell workspace owners by e-mail at least 30 days in advance.