Last updated: 22 September 2026.
Une version française de cette page est disponible ici :
/privacy-policy/.
This policy describes the processing of personal data in TheDiffuseur, a scheduled publishing application available at app.thediffuseur.com, and on the
thediffuseur.com website.
It is written to be read. Where a legal term was unavoidable, it is explained.
1. Who is responsible
LMVI Conseil, a SARL registered under SIREN 949 417 620. Registered office: 41-43 quai de Malakoff, 44000 Nantes, France.
Contact for any question relating to data:
[email protected].
LMVI Conseil is the data controller within the meaning of the GDPR for the data described below.
2. What the application collects
2.1 Your account
Email address, display name, and the date of your logins. This is what makes it possible to know who owns a project and to let you in.
2.2 The accounts you connect
When you link a social network account, the application keeps:
- the access token and, where applicable, the refresh token;
- the identifier and the display name of the connected account or channel, so that you know where you are publishing;
- the capabilities declared by the platform (accepted sizes and formats, maximum text length), in order to refuse before sending anything that would be rejected.
Tokens are never displayed again. They are kept in an encrypted vault (HashiCorp Vault), separate from the database, and come out only for the duration of a send. They appear neither on screen, nor in the technical logs, nor to an administrator.
2.3 What you upload
Videos, images, sounds, texts, file names, titles, descriptions, and the organisation you give them (series, episodes, ranks, roles).
2.4 Your calendars and their execution
Scheduled dates and times, target destinations, the status of each send, and for each attempt: the time, the result, the platform’s return code, any error message and the identifier of the published message.
2.5 Technical data
IP address, browser type, request timestamps, error logs. They serve to operate and to defend the service, not to profile you.
2.6 What the application does not collect
- Your social network password — it never asks for it.
- Your private messages, your conversations, your contacts on the connected platforms.
- Your geographic location.
- No data for advertising purposes. There is no advertising in TheDiffuseur.
3. What this data is used for
| Purpose | Legal basis (GDPR) |
|---|---|
| Publishing what you have scheduled, to the accounts you have connected | Performance of a contract |
| Showing you the status of your sends and their history | Performance of a contract |
| Refusing, ahead of time, what a platform would reject | Performance of a contract |
| Producing a draft document from the pieces you select | Consent — the feature is activated only if you trigger it |
| Ensuring the security of the service, detecting abuse | Legitimate interest |
| Responding to a legal obligation or a formal request from authorities | Legal obligation |
Your content is not used to train, improve or evaluate artificial intelligence models, neither ours nor those of third parties. This commitment also applies, and explicitly so, to any data obtained from the Google, YouTube and TikTok APIs.
4. Google API Services — Limited Use
TheDiffuseur’s use of information received from Google APIs, including the YouTube APIs, complies with the Google API Services User Data Policy, and in particular with its Limited Use requirements.
In concrete terms:
- this data is used only for the user-facing features described here — uploading a video to your channel, and displaying the name of that channel;
- it is neither sold nor transferred to third parties, except if you request it, if the law requires it, or as part of a business transfer of which you would be notified;
- it is never used for advertising or targeting;
- no human being reads it, except with your express consent, for security reasons, to comply with the law, or once the data has been anonymised and aggregated.
By using TheDiffuseur’s YouTube features, you also accept the YouTube Terms of Service and the Google Privacy Policy. You can revoke TheDiffuseur’s access to your Google account at any time from the
myaccount.google.com/permissions page.
5. TikTok
When you connect a TikTok account, the application receives, through the official API, the account’s open identifier, its display name, its avatar, and the publishing information that TikTok exposes to the creator (privacy options, maximum duration, permission for comments, Duets and Stitches). This information is used to display the publishing screen correctly and to respect your TikTok settings.
The TikTok Terms of Service, its community guidelines, its branded content policy and its privacy policy apply.
6. Who this data is shared with
It is neither sold, nor rented, nor exchanged. It is disclosed only to:
| Recipient | What it receives | Where |
|---|---|---|
| The platforms you connect | The content you have scheduled for them, and nothing else | Depending on the platform |
| OVH — hosting provider | All of it, as a result of the hosting | France |
| MiniMax — language model | Only the texts and images you select for the document production feature, together with your instruction | Outside the European Union (see §7) |
No other processor has access to your content.
7. Transfers outside the European Union
The service is hosted in France, with OVH. Your files, your database and your token vault do not leave French territory.
One single exception, and it depends on you. The document production feature sends the pieces you have selected to a language model operated by MiniMax, outside the European Union. This send occurs only when you trigger the feature, and covers only what you have ticked. If you prefer that no data leave France, do not use this feature: all the rest of the application works without it.
Where a platform you connect is established outside the European Union, publishing to that platform constitutes a transfer by its very nature — that is the very purpose of the service.
8. How long data is kept
| Data | Retention period |
|---|---|
| Tokens of connected accounts | Until disconnection — deleted immediately |
| Name and identifier of the connected account | 30 days after disconnection |
| Uploaded files (videos, images, sounds) | 30 days after the last publication that uses them, or on your request |
| Texts, series, episodes, publishing plans | As long as the account exists |
| History of publications and attempts | 12 months |
| Technical logs | 12 months at most |
| TheDiffuseur account | 30 days after its closure, then permanent deletion |
| Messages received through the website’s forms | 3 years at most |
9. Deleting your data
The full procedure — disconnecting an account, erasing an episode, closing the TheDiffuseur account, revoking access on the platform’s side — is detailed on the dedicated page:
You can also write to
[email protected]: the request is handled
within one month.
10. Security
Encryption of exchanges (TLS), tokens in an encrypted and separate vault, partitioning of data between accounts, access logging, encrypted backups. The details are on the Security (in French) page.
No system is invulnerable. In the event of a data breach likely to create a risk to your rights, you will be notified and the CNIL will be notified within the time limits laid down by the GDPR.
11. Your rights
You have the rights of access, rectification, erasure, restriction,
objection and portability, as well as the right to withdraw your consent at any time for the processing that depends on it. You may also give directives on what is to become of your data after your death.
To exercise these rights:
[email protected] — reply within one month.
If the reply does not satisfy you, you may refer the matter to the CNIL:
www.cnil.fr/fr/plaintes.
12. The thediffuseur.com website
Audience measurement — the website places no advertising cookie and uses no third-party tracker.
Contact form — the messages you send are kept for the time needed to handle the request, and three years at most.
Embedded content — some pages may embed a video hosted by a third-party platform. These embeds behave as if you were visiting that platform’s website, with its own trackers.
13. Minors
The service is not intended for persons under 16 years of age and no data is knowingly collected concerning them. If you observe otherwise, write to
[email protected]: the account will be deleted.
14. Changes
Any substantial change to this policy will be indicated on this page, with a new update date, and — if it changes what we do with your data — by a message to your account’s address.
15. Contact
[email protected] — personal data and exercise of rights
[email protected] — everything else