Privacy Policy

Last updated: 2 November 2026

At Tenderete Studio we take the privacy of the people who use our platform, levr, very seriously. This policy explains what information we collect, how we use it and what rights you have over it. It is the English version of our Política de privacidad; both have the same content.

1. Who we are

Tenderete Studio is an influencer marketing agency. Our online platform is called levr and lives at app.levr.es (formerly app.tenderetestudio.com). In levr, brands and content creators manage campaigns, invoicing and work calendars, and creators connect their social accounts to see their statistics and to prepare, schedule and publish their videos on their own account. More information at tenderetestudio.com/levr.

Data controller: Tenderete Studio · hola@tenderetestudio.com

2. What data we collect

• Account data: name, email address and encrypted password when you sign up.
• Profile data: professional information you enter voluntarily (social accounts, followers, portfolio).
• Campaign data: dates, deliverables, posts and communications related to the projects you take part in.
• Social account data (only if you connect them): profile, followers, posts and their statistics, and the videos, texts and options of what you publish from levr (see sections 3 and 4).
• Billing data: tax information needed to issue or receive invoices (name, tax ID, address).
• Usage data: activity logs on the platform to improve the experience and detect errors.

3. Instagram, Facebook and TikTok — Data access and use

When you connect an account, levr only asks for the permissions it uses:

• Instagram: instagram_business_basic (profile, followers and posts), instagram_business_manage_insights (statistics), instagram_business_content_publish, to publish on your account the videos you approve in levr, and, only if you use automatic replies (AutoDM), instagram_business_manage_comments and instagram_business_manage_messages, to reply to the comments and messages that trigger each automation.
• Facebook: pages_show_list and pages_read_engagement, to see your Pages and their statistics.
• TikTok: user.info.basic, user.info.profile, user.info.stats and video.list, to see your profile and your videos with their numbers, and video.publish, to publish on your account the videos you confirm on the publish screen.

We use this data only to show you your statistics in levr, to build your media kit with up-to-date metrics and to publish on your account what you decide to publish.

What we never do with your social account data:

• We never publish anything you have not approved, nor on any account other than the one you connected.
• We do not use this data for advertising or to train artificial intelligence models.
• We do not sell it or transfer it to third parties.

You can disconnect each network in levr › Redes (Networks) › Desconectar (Disconnect): we delete the tokens immediately. You can also revoke access from the network itself, in the connected apps and services section of its settings. How to delete all your data: data deletion.

Automatic replies on Instagram (AutoDM). If an account that uses levr has an automatic reply turned on and you comment on one of its posts or reply to one of its stories with the given keyword, levr receives from Meta your Instagram username and ID, the text of the comment and the direct messages of that conversation. We use them only to reply to you and send you what you asked for, to check whether you follow the account when the automation requires it, and so the account owner can see how many people have used it. We keep that record while the account has AutoDM active and delete it if you ask us to (write to hola@tenderetestudio.com with your Instagram username).

4. YouTube — Data access and use

When you connect your YouTube channel to levr, we request the following permissions:

• View your YouTube account (https://www.googleapis.com/auth/youtube.readonly): see your channel and your videos.
• View YouTube Analytics reports (https://www.googleapis.com/auth/yt-analytics.readonly): your channel's daily statistics.
• Upload videos to your channel (https://www.googleapis.com/auth/youtube.upload): upload to your channel the videos you publish from levr, with the title, description and privacy setting you choose.

We use this access only to:

• Show you in levr your channel's subscribers, views and growth.
• Build your media kit with up-to-date metrics.
• Upload to your channel the videos you decide to publish from levr.

What we never do with your YouTube data:

• We do not edit or delete your videos, playlists or any other content on your channel, and we never upload anything you have not approved.
• We do not use YouTube data for advertising or to train artificial intelligence models.
• We do not transfer your YouTube data to third parties.

levr uses YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies.

You can revoke access at any time from your Google account security settings or by clicking «Desconectar» (Disconnect) in levr › Redes. When you disconnect we delete your tokens immediately; stored statistics are deleted on request, or at the latest 30 days after access is revoked.

levr's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Google Calendar — Data access and use

When you connect your Google Calendar account, we request the following permissions:

• See and edit calendar events (https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events)

We use this access only to sync key campaign dates as events in your Google Calendar and to show you a unified view of your schedule.

What we never do with your Google Calendar data:

• We do not read, store or share the content of your personal events.
• We do not use your calendar data for advertising or to train AI models.
• We do not transfer your Google Calendar data to third parties.

6. Gmail — Data access and use

When an administrator connects the campaign mailbox, we request a single permission to read, organize and send from that mailbox:

• Read, compose, send and organize your email (https://www.googleapis.com/auth/gmail.modify)

We use this access only so the team can see its own work email inside the platform (the list of conversations is requested from Gmail when the inbox is opened and is not stored), to organize it when the administrator clicks a button (mark as read, archive, move to spam or to Gmail's trash, add or remove labels), so the administrator can write, reply to or forward emails from their own Gmail addresses («Send as»), with their signatures and attachments, and save drafts in their Gmail, and to prepare a campaign draft from the conversations the administrator chooses to analyze and their attachments (brief, contract). An email is only sent when the administrator writes it and clicks «Send»; we never send automatic emails or permanently delete messages, and nothing changes unless the administrator asks for it.

To prepare the campaign draft, or when the administrator asks the AI to help write a reply, the text of that conversation (and, when analyzing, its attachments) is processed with the Anthropic API (Claude) as a sub-processor. Anthropic does not use this data to train its models.

What we never do with Gmail data:

• We do not use it for advertising, profiling or to train general artificial intelligence models.
• We do not sell it or transfer it to third parties, except to the providers needed for this feature (listed in section 9).
• Nobody reads it except the Tenderete Studio team itself, owner of the mailbox, or when needed for security or by legal obligation.

The permission is stored encrypted. When you click «Disconnect» in Settings, we revoke access at Google and delete the token from our servers. Campaign drafts can be discarded at any time.

Tenderete Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Legal basis

• Performance of a contract: we process your data to provide the services you signed up for.
• Explicit consent: for the integration with Instagram, Facebook, TikTok, YouTube, Google Calendar, Gmail or other third-party services, and for each post you approve.
• Legitimate interest: for platform security and service improvement.

8. How we store and protect your data

We use Supabase (infrastructure in the European Union) to store data securely. All communication is encrypted with TLS. Access tokens for third-party services are stored encrypted and revoked immediately when the user disconnects the service.

9. Who we share your data with

We do not sell or rent your data. We only share it with:

• Supabase: database and authentication provider.
• Vercel: infrastructure provider where the application runs.
• Google LLC: only for calendar sync, YouTube metrics and reading the campaign mailbox when the user authorizes it.
• Meta Platforms (Instagram and Facebook), TikTok and Google (YouTube): they receive the video, text and options of each post the creator approves in levr, to publish it on their own account. From then on, that content is governed by each network's terms and privacy policy.
• Anthropic: processes with AI the campaign emails chosen to prepare the draft (see section 6); it does not use them to train models.

All our providers are bound by GDPR-compliant data processing agreements (DPA).

10. Your rights

Under the GDPR, you have the right to:

• Access the data we hold about you.
• Rectify incorrect or incomplete data.
• Erase your data («right to be forgotten»).
• Portability: receive your data in a structured format.
• Object to processing in certain circumstances.
• Withdraw consent at any time.

To exercise any of these rights, write to us at hola@tenderetestudio.com. We will reply within 30 days at the latest. The steps to delete your levr data are on the data deletion page.

11. Cookies

We use strictly necessary cookies to keep your session active on the platform. We do not use tracking or advertising cookies.

12. Minors

Our platform is not intended for anyone under 16. If you are under that age, you must not sign up or use the service.

13. Changes to this policy

We may update this policy from time to time. We will notify you by email if the changes are significant. The date of the last update is always shown at the top.

14. Contact

For any privacy question: hola@tenderetestudio.com