APIWings Privacy Policy

Last updated: 9 November 2026

1. Who we are

APIWings is a product of LV Tech Labs S.L. (“APIWings”, “we”, “us”), a Spanish limited company in the process of incorporation, with registered office at Carrer de Modolell 36, 2, 08021 Barcelona, Spain. You can reach us at hello@apiwings.com (general enquiries), support@apiwings.com (technical support), privacy@apiwings.com (data protection requests) or +34 629 04 87 36.

APIWings provides an application programming interface (API), a developer dashboard and related tools that let software companies, developers and AI agents connect social media accounts and publish content to them through a single interface (the “Service”).

APIWings is currently in early access: only some networks and features are available, and the dashboard and paid plans are not open yet. This policy covers each part of the Service as it becomes available; the networks available at any given time are listed on apiwings.com.

2. Scope and our role

This policy explains how we handle personal data in connection with the Service and the website apiwings.com. It applies to three groups of people:

• Customers: the developers and companies who create an APIWings account, obtain API keys and pay for the Service.
• End users: the people who, through a Customer's application, connect their own social media accounts to APIWings so that content can be published on their behalf.
• Visitors: anyone browsing apiwings.com.

Under the EU General Data Protection Regulation (GDPR), we act as data controller for Customer and Visitor data, and as data processor on behalf of each Customer for End user data. When you are an End user, the Customer whose application you used is the controller of your data, and their privacy policy governs how they use it; our Data Processing Agreement with that Customer governs what we do with it. If you are an End user and have questions, contact the Customer first; you may also contact us at privacy@apiwings.com.

3. Data we collect

From Customers (controller):

• Account data: name, company name, email address, password hash, billing address and tax ID.
• Billing data: payment method and transaction history, handled by our payment processor Stripe; we never store full card numbers.
• Usage data: API requests, number of posts published, error rates, API key identifiers, IP addresses and timestamps, used for billing, security and support.
• Support communications you send us.

From End users (processor, on the Customer's instructions):

• Social account credentials: when an End user connects a social media account, the platform issues us an access token (and, where applicable, a refresh token). We store these tokens encrypted and use them solely to publish content and read the quota information the End user has authorised. We never receive or store the End user's platform password, except for Bluesky where the End user may provide an app-specific password that is stored encrypted in the same way.
• Account identifiers returned by the platform: account ID, handle or page name, profile type.
• Post data: the text, media files and scheduling options submitted through the API for publication, plus the result returned by the platform (post ID, URL, visibility, error messages).
• Platform quota information (for example, remaining daily posts) when the platform exposes it.

From Visitors: our hosting provider processes your IP address and browser information to deliver the website; we do not keep visitor logs or use tracking. If you join the waitlist: your email address and, optionally, your company name, the networks you need and your use case.

We do not collect or store the contents of End users' social media inboxes, direct messages, comments, followers, or historical posts, and the Service does not request permissions for them.

4. How we use data and legal bases

We do not sell personal data, do not use End user data for advertising, and do not use data obtained from social platforms to train machine learning models.

5. Platform-specific disclosures

When an End user connects an account, they authorise APIWings, through the platform's official API and consent screen, to act on their behalf within the permissions shown on that screen. They can revoke this at any time from the platform's own settings or by asking the Customer to disconnect the account. Each integration becomes available once the platform has approved it, and the descriptions below apply from that moment. Each platform's terms also apply:

APIWings is an independent service and is not affiliated with, endorsed by or sponsored by Meta, TikTok, Google, LinkedIn, X or Bluesky.

6. Retention

7. Security

APIWings holds credentials that give access to third parties' social accounts, and we treat their protection as our first obligation. Our main controls:

• Social account tokens are encrypted at rest with envelope encryption: a unique data key per Customer profile, itself encrypted by AWS Key Management Service. The database never contains tokens in clear text, and tokens are decrypted only in memory at the moment of publication.
• All traffic is encrypted in transit (TLS 1.2 or higher). Servers run in a private network on Amazon Web Services; databases are not reachable from the internet.
• Customer API keys are stored only as cryptographic hashes. Webhooks are signed so Customers can verify their origin.
• Every data access is scoped to the Customer that owns it; cross-tenant access is tested automatically before each release.
• Platform application secrets are kept in a secrets manager, never in source code, and can be rotated at any time without code changes.

No system is perfectly secure. If we become aware of a personal data breach, we will notify affected Customers without undue delay and the Spanish Data Protection Authority (AEPD) within 72 hours where required.

8. Sharing and sub-processors

We share personal data only with providers who process it on our behalf under written agreements, and with social platforms as necessary to publish the content the End user has authorised:

We may also disclose data when required by law, to enforce our Terms, or in connection with a merger or acquisition, in which case this policy continues to apply. We will update this list and notify Customers of new sub-processors in advance, as provided in the Data Processing Agreement.

9. International transfers

We are established in the European Union. Where data is transferred to providers outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses together with appropriate supplementary measures.

10. Your rights

If you are in the EEA, the United Kingdom or Switzerland, you have the right to access, rectify and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority; in Spain, the Agencia Española de Protección de Datos (www.aepd.es). Residents of California and other US states may have similar rights under their state laws; we do not sell or share personal data for cross-context behavioural advertising.

To exercise these rights, email privacy@apiwings.com. If you are an End user, we will forward your request to the relevant Customer where they are the controller and assist them in responding; where we can act directly (for example, disconnecting an account), we will. We respond within one month.

11. Data deletion

12. Cookies

apiwings.com does not set cookies and does not use analytics or tracking tools. When the dashboard opens, it will use only strictly necessary cookies (session and security), which do not require consent. If we ever add non-essential cookies, we will ask for consent through a banner before setting them.

13. Children

The Service is intended for businesses and developers and is not directed to anyone under 18. We do not knowingly collect personal data from minors; if you believe a minor has provided us data, contact privacy@apiwings.com and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. We will post the new version at apiwings.com/privacy with its effective date and, for material changes, notify Customers by email at least 15 days in advance.

15. Contact