Privacy Policy

Laetium is a social media management platform ("Service") operated by Ridoco (registered with the Netherlands Chamber of Commerce, KvK 95439609), trading as Laetium. For questions about this policy, email privacylaetium@doombringerz.com.

Two different roles

Which GDPR role Ridoco holds depends on which data is involved:

• Ridoco is the controller for the data you provide to run your account: your name, email, password, billing details, support tickets, and how you use the Service. This policy governs that data.
• Ridoco is a processor for the data you bring into the Service from your connected social accounts: posts and captions you schedule, uploaded media, audience and engagement analytics, competitor records, and direct messages received through the social inbox. For that data you are the controller, Ridoco acts on your instructions, and the terms are set out in the Data Processing Agreement rather than in this policy.

If the people in that second category (your followers, customers or contacts) want to exercise their rights, they should contact you as the controller. Ridoco will support you in responding and will forward any request that arrives directly.

Account data

• Name, email address, password (hashed, plaintext passwords are never stored)
• Billing information (handled by Stripe, full card details are never stored)
• Profile picture and display name (if provided)

Social account data

• OAuth access tokens and refresh tokens (encrypted at rest)
• Platform usernames, avatar URLs, follower counts
• Analytics data retrieved from connected platforms

Content data

• Post content, captions, and hashtags you create or schedule
• Media files uploaded for scheduling (deleted from Ridoco servers after publishing)
• Scheduling metadata (target time, platform, status)

Usage data

• Log data: IP address, browser type, pages visited, timestamps
• Device information (operating system, screen resolution)
• Feature usage patterns (aggregate, not linked to individual posts)

Communications

• Email address for transactional messages (failed post alerts, billing receipts)
• Support ticket contents if you open a ticket

For users in the EEA and UK, Ridoco processes your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you subscribed to (account management, scheduling, analytics).
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, abuse detection, service improvement.
• Legal obligation (Art. 6(1)(c)): Compliance with financial regulations, tax obligations, and court orders.
• Consent (Art. 6(1)(a)): Non-essential cookies and marketing communications. You may withdraw consent at any time.

• Providing and maintaining the Service (scheduling, publishing, analytics)
• Processing payments and managing subscriptions via Stripe or PayPal, or by deducting Essence of Hell credits from a linked Doombringerz account
• Sending transactional emails (post failure notifications, billing alerts)
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal obligations
• Improving and debugging the Service (using aggregated, de-identified data)

Your personal data is never sold. Your content is never used to train AI models.

Media files (images, videos) you upload for scheduling are stored temporarily in encrypted cloud storage. When your post publishes, the source media is automatically and permanently deleted from Ridoco servers. If a post fails permanently, its media is kept so you can fix and reschedule it, and is removed when you delete the post or your workspace. You may request immediate deletion at any time via the dashboard or by emailing privacylaetium@doombringerz.com.

Media you upload but never post. A file that is not attached to any post is deleted automatically once it passes the period below, counted from the day you uploaded it. The two periods differ because the files are kept for different reasons.

• Video: 30 days. A video is normally recorded for one specific post, you hold the original, and it is the largest thing Laetium stores. Once it belongs to no post, there is nothing further it is needed for.
• Images: 12 months. An image is often a reusable asset such as a logo, a headshot or a template that you come back to months later. A short period here would delete a working library rather than clear up abandoned files.

A file attached to any post, whether scheduled, awaiting approval, draft or failed, is never removed by this clean-up, no matter how old it is. Deleting media does not delete posts that already published, because the copy on the social platform belongs to your account there and is outside Laetium's control.

Ridoco shares data only as necessary:

• Social media platforms: Your content and tokens are sent to connected platforms (Meta, Google, LinkedIn, TikTok, X Corp, etc.) to publish posts on your behalf.
• Stripe: card payments and subscription billing. Subject to Stripe's Privacy Policy.
• PayPal: the alternative to card checkout. If you pay with PayPal, the order amount and a Laetium reference for your workspace and plan go to PayPal, and PayPal handles the payment itself. Subject to PayPal's privacy statement.
• netcup GmbH, and the Anexia group companies it relies on: server hosting, databases and backups. Processed in Germany and Austria.
• Cloudflare (R2): storage of media you upload for scheduling, until it is published or reaches the period in Section 5. The bucket is created under Cloudflare's European Union jurisdiction, so the objects are held in the EU.
• Google (Workspace SMTP): delivery of transactional email such as failed post alerts and billing receipts.
• Sentry: application error and crash reporting, which can include your IP address and account identifier.
• Legal authorities: Where required by law or valid legal process.

Job queue data is held in a Redis instance running on Ridoco servers, not with a third party.

Essence of Hell credits. A third way to pay is to spend the credit balance on your Doombringerz account. Doombringerz is run by Ridoco, the same company behind Laetium, so this is not a transfer to a third party and no payment processor is involved. Linking the two accounts sends a one-time code to doombringerz.com and returns your Doombringerz user id and credit balance, which Ridoco stores against your Laetium user so the balance can be spent and deducted.

AI caption suggestions. The text you type (your topic, keywords and brand voice) is sent to a language model to produce them. It is not used to train the model and is not kept after the response is returned. By default it goes to a model running on Ridoco's own hardware and reaches no external AI provider. If you supply your own OpenAI API key in workspace settings, it goes to OpenAI instead, under your own agreement with them. There is no third path: nothing sends your text to an outside provider on Ridoco's account.

All processors are bound by data processing agreements in compliance with GDPR. Where Ridoco acts as your processor, this list is also the sub-processor list. Ridoco will give you at least 14 days notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

Laetium uses YouTube API Services. Laetium is a YouTube API Client. It uses YouTube API Services to upload videos to the YouTube channel you connect, to set the title, description, tags, category, privacy and audience of those uploads, and to read back statistics for videos published through Laetium.

The YouTube Terms of Service apply. By using Laetium you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms).

Google's privacy policy applies to Google's own processing. See the Google Privacy Policy at http://www.google.com/policies/privacy.

7.1 What YouTube information Laetium accesses, collects and stores

Connecting a channel sends you to Google's own consent screen. Ridoco never sees your Google password. Laetium accesses, collects and stores only:

• An OAuth access token and refresh token for the channel you connected, encrypted at rest with AES-256-GCM.
• The channel id, channel title and thumbnail, used to label the account in the interface so you can tell two channels apart.
• The subscriber count, shown on your dashboard.
• For videos published through Laetium: the video id and the statistics YouTube returns for it, which are views, likes, comments and estimated watch time, by day.
• The video file and metadata you yourself supply for an upload, held only until the upload completes and then for the retention period in Section 9.

Laetium does not read your subscriptions, your watch history, your private playlists, your comments on other channels, or any video that was not published through Laetium.

7.2 How that information is used, processed and shared

Used only to carry out what you asked for: to publish the video you scheduled, and to show you its performance in your own dashboard.

Processed on servers in Germany, with uploaded media held in Cloudflare's European Union jurisdiction. Ridoco itself is established in the Netherlands. Statistics are stored in the Laetium database and served back only to you and to the members of the workspace that owns the connected channel. The full list of infrastructure providers and where each operates is in Section 6.

Shared internally with nobody beyond that workspace. Ridoco is a one-person company; no other person sees your API Data.

Shared externally only with the infrastructure processors listed in Section 6, which host the servers, the database and the object storage, and which act on Ridoco's instructions under a data processing agreement. Ridoco does not sell YouTube API Data, does not transfer it to advertisers or data brokers, does not use it to build advertising or behavioural profiles, and does not use it to train any machine learning or AI model.

7.3 How long it is kept, how it is deleted, and how to revoke access

Refreshed and deleted on this schedule. Statistics for videos published through Laetium are refreshed from the YouTube Data API once a day, at 03:00 UTC. Each run re-reads the last seven days and overwrites the stored figures for those days, because YouTube revises recent numbers for two to three days after the event. Stored YouTube statistics are deleted automatically once they are 30 days old, in a job that runs daily at 04:50 UTC. Video files you upload are deleted 30 days after upload. Tokens are refreshed as they expire and are deleted immediately when you disconnect the channel or delete your account.

Deleting stored data. Disconnecting the channel under Settings then Accounts deletes the stored tokens and the stored statistics for that channel. Deleting your account under Settings then Privacy erases everything held for you, with no recovery window.

Revoking Laetium's access at Google. You can revoke Laetium's access to your Google account at any time through Google's security settings page at https://myaccount.google.com/connections?filters=3,4&hl=en. Revoking there stops Laetium reaching your channel immediately, and any scheduled upload to it will fail rather than publish. Step-by-step instructions, for Google and for every other platform Laetium connects to, are on the revoking access page.

Some third-party processors may transfer data outside the EEA. Where this occurs, Ridoco ensures adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on processors' adequacy decisions or certifications.

• Account data: Retained for the duration of your account. When you confirm deletion it is applied immediately and cannot be undone: your email, name and avatar are erased and your credentials destroyed. There is no recovery window, so export your data first if you want to keep it.
• Published post records: Retained for 24 months from publication date for analytics continuity.
• Analytics data: Aggregated metrics retained for 36 months.
• Billing records: Retained for 7 years as required by financial regulations.
• Uploaded media: Deleted immediately after a successful publish. Media that is never attached to a post is deleted after 30 days for video and 12 months for images. Media attached to a post is kept for as long as that post exists (see Section 5).
• OAuth tokens: Deleted when you disconnect a social account or delete your account.

If you are in the EEA or UK, you have the following rights:

• Access: Request a copy of the personal data held about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention obligations).
• Restriction: Ask Ridoco to limit processing of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacylaetium@doombringerz.com. Ridoco will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority (in the Netherlands: the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

Security measures in place:

• TLS encryption for all data in transit
• AES-256 encryption for OAuth tokens at rest
• Bcrypt password hashing (never stored in plaintext)
• Redis-backed rate limiting to prevent brute-force attacks
• Ongoing dependency and vulnerability monitoring, with security patches applied as they are released
• Strict access control: access to production data is limited to the operator of the Service

Despite these measures, no system is 100% secure. Ridoco will notify affected users and relevant authorities of any data breach as required by applicable law.

Laetium uses cookies and similar technologies as described in the Cookie Policy.

The Service is not directed to children under 16. Ridoco does not knowingly collect personal data from children under 16. If you believe a child has provided personal data, email privacylaetium@doombringerz.com and it will be deleted promptly.

Ridoco will notify you by email or in-app notice before changes to this Privacy Policy take effect. The notice period depends on the change:

• At least 30 days for a material change. That means a new purpose for processing, a new category of recipient, a new transfer outside the EEA, a change to how long data is kept, a change to who the controller is, or a change to how you exercise your rights.
• At least 14 days for anything else, including adding or replacing a sub-processor.

Where a change introduces a new purpose for processing your data, you will be told before that processing begins, not after.

Every notice lists each change it covers and states the single date they all take effect. If several changes are prepared together, one notice covers them and the period runs from that notice. Anything decided after a notice has been sent gets its own notice and its own full period. Changes pending but not yet in force are listed at upcoming changes.

The "Last updated" date at the top of this page reflects the current version.

Ridoco, trading as Laetium
De Nieuwe Erven 3-12572, 5431 NV Cuijk, Netherlands
KvK 95439609 · BTW NL005153257B49
Email: privacylaetium@doombringerz.com

Ridoco is not required to appoint a Data Protection Officer under Art. 37 GDPR and has not appointed one. The supervisory authority is the Dutch Autoriteit Persoonsgegevens.