Foliocast
Privacy
This site sets no cookies and uses no advertising tracking. It only measures its traffic anonymously, with a tool hosted on our own server (see “Audience measurement”). Fonts are served from this site, with no request to Google. Only the sign-up form and the access code form may call Cloudflare Turnstile to block bots (see below).
Data controller
SB STUDIO, SAS, 41 avenue du Maréchal Leclerc, 13710 Fuveau, France. Contact: contact@foliocast.fr.
For the automatic Reels rendering service, we act instead as a processor on behalf of our customers (see below).
Early access and waiting list sign-up
We store what you enter in the form: your email address (required) and, if you provide them, your first name, your profession, your website address and your professional Instagram account.
We add the form language, your sign-up position (it decides how the 50 early access places are allocated) and the date of your consents. To prevent abuse, a non-reversible fingerprint of your IP address is kept with your sign-up; the IP address itself is not stored. The counters that limit the number of attempts also keep only a fingerprint, erased within 48 hours at most.
The sign-up and access code forms also record, optionally, how you heard about Foliocast, as well as the campaign label of the link you followed (utm parameters) and the domain name of the site you came from, with no cookie and no tracker, so that we know which channels work. This information is kept with your sign-up and deleted with it.
Referral: once your address is confirmed, we give you a personal code (AMI-…) to invite a fellow professional. When someone uses it, we know who invited them; this is never shown to the person invited. The code is deleted with your sign-up.
Your sign-up only counts once you click the confirmation link sent by email. An unconfirmed request is deleted after 7 days; until then only a fingerprint of the link is kept.
To block bots, the sign-up form and the access code form may use Cloudflare Turnstile (Cloudflare, Inc., United States, certified under the Data Privacy Framework): the service analyses technical browser information, without advertising cookies, based on our legitimate interest in preventing abuse. Cloudflare Turnstile privacy policy.
Your Instagram account is used only to invite you as a tester of the Foliocast app at Meta, for the duration of early access, so it is passed on to Meta. The same applies if you use an access code.
If you sign up through a form in one of our Facebook or Instagram ads, Meta passes us what you entered there (email, first name, profession). We handle it exactly like a sign-up on this site.
Purposes: giving you early access, then announcing the launch. A separate, optional box also lets you receive our newsletter.
Legal bases: your consent, given by ticking the box in the form, which you can withdraw at any time; our legitimate interest in preventing abuse, for the IP fingerprint.
Retention: if you do not take a licence, your data is deleted 12 months after Foliocast's launch, or as soon as you unsubscribe; in that case, your email address and the date are kept in a suppression list, used solely to make sure we never write to you again. If you received an early access licence and did not subscribe afterwards, your sign-up data is deleted together with that licence, 12 months after it ends (for early access: after 15 December 2027).
Exception: if you ticked the newsletter box, your contact stays in Brevo until you unsubscribe. It is then marked as unsubscribed there, which stops us from writing to you again; you can ask for it to be deleted completely at any time.
Idea box
The idea form on our roadmap page (in French) stores the text of your idea, the profile you chose and, only if you provide it, your email address. It is kept outside the public part of the site.
Your address is used only to reply about your idea, never to add you to a mailing list. You can ask for it to be deleted at any time.
Retention: 24 months, then automatic deletion.
Subscriptions, licences and billing
Payment is processed by Stripe, which collects your billing details (name, company, address, VAT number, payment method) and issues the invoices. Foliocast never sees your card number.
On our side, we keep your email address, plan, licence key (encrypted) and the addresses of the sites where it is activated. The same applies to the free early access licences.
Legal bases: performance of the contract; our legal obligation to keep invoices.
Retention: invoices are kept for 10 years (accounting records). Licence data (email, plan, dates, Stripe references, encrypted key) is kept during the subscription, then in restricted-access archives for 5 years after it ends, as proof of the contract, and deleted afterwards. The addresses of the sites where the licence was activated and the Reels rendering data (site address, encrypted rendering key) are deleted 90 days after the licence ends. A free early access licence not followed by a subscription is deleted 12 months after it ends.
Support
When you contact support from the plugin's Help screen, we receive your name, email, site address, message, a screenshot if you attach one and a technical diagnostic (versions, settings), stripped of passwords and tokens.
Legal bases: performance of the contract for customers; our legitimate interest in helping users of the free edition.
Retention: 24 months.
Instagram connection (Foliocast Connect)
When you link Instagram to the plugin with the "Connect with Instagram" button, our service foliocast.fr/connect receives an authorisation code from Instagram, exchanges it for your account's access token and hands that token over once to your WordPress site.
Until the handover, the token is kept encrypted for 5 minutes at most, then deleted. Foliocast keeps no token, identifier or content from your account. The token is then stored encrypted on your own site.
From then on, the plugin talks to Instagram (Meta's API) directly from your site.
Tester invitation. Until Meta has approved the Foliocast app, only accounts invited as testers can connect. If you request an invitation from the plugin, we receive the e-mail address and Instagram account name you type, your site's name and the interface language. They are used only to add your account as a tester in the Meta app and to e-mail you about it. They are kept for the duration of the test phase, 12 months at most, then deleted.
Free Reel
On the free Reel page, you enter the address of a page of your site and your e-mail address. Our server reads that page to find the project's title and images and passes them to you: the Reel is made in your browser and downloaded to your device. No image or video is kept on our servers.
We keep your e-mail address, the page address and the project title to send you one e-mail with the next steps and, only if you ticked the box, to write to you about Foliocast news (one e-mail a month at most, unsubscribe at any time). This data is kept for 12 months at most, then deleted. Legal basis: your request, and your consent for news.
Automatic Reels rendering
With a plan that includes Reels, our rendering service downloads the relevant project images from your site, makes the video and sends it back to your site. Rendering runs on temporary GitHub Actions machines (United States). Images stay there only for the time of rendering: the machine and its files are destroyed at the end of each run. Run logs (site addresses and technical post identifiers, no images, project names or keys) are kept by GitHub for 7 days at most. This rendering runs in SB STUDIO's GitHub organisation (GitHub Team plan), covered by GitHub's Data Protection Agreement.
For this processing, you are the controller and we are your processor. Our commitments are set out in the data processing agreement appended to our terms of sale (in French).
In the plugin, on your site
To count visits coming from Instagram, since version 2.6.3 the plugin stores neither the visitor's IP address nor any fingerprint: it only sets a technical cookie with no identifier ("foliocast_seen", value 1), deleted automatically by the browser after one hour, so the same visit is not counted twice; only the number of visits per day is kept, for 180 days at most. Hourly fingerprints from earlier versions are deleted at update. Nothing is counted if the browser sends the "Global Privacy Control" or "Do Not Track" signal, and every visitor can opt out with a link offered by the site. This data is not sent to us: the site owner is responsible for it.
Suggested text for your own privacy policy is provided in WordPress, under Settings → Privacy. See also our terms of use (in French).
Our posts on LinkedIn
To publish its own news on its profile and on the Foliocast LinkedIn Page, SB STUDIO uses an internal tool connected to the LinkedIn API. It stores only, encrypted on our server, the access token, the publisher's account ID and name, and the Pages they administer.
It does not read or store any LinkedIn member data (comments, followers, mentions). It does not concern users of the plugin.
Partner program
If you apply to the partner program, we record your name, email address, website, profile and message, then, if your application is accepted, the subscriptions that came through your link and the related commissions. This data is used only to run the program and your payouts; accounting records are kept for 10 years, other data until the end of the partnership plus 3 years.
When a visitor reaches foliocast.fr through a partner link (an address ending in ?via=CODE), that code is kept for 90 days in their browser (local storage, no cookie or identifier) and sent with their order, to credit the right partner. It is used for nothing else and deletes itself after 90 days.
Audience measurement
To know how many people visit the site and which pages interest them, we use Matomo, free software installed on our own server (in France). No data is passed to third parties or used for advertising.
Measurement works without cookies: nothing is stored on or read from your browser. Matomo records the page viewed, the referring page, the campaign of the link followed, the type of device and browser, and a shortened IP address (the last two bytes are erased) that cannot identify you. These statistics are kept for 13 months at most.
If your browser sends the “Do Not Track” or “Global Privacy Control” signal, your visits are not measured. You can also opt out here; this choice is kept in this browser.
Emails
Emails about your sign-up, your early access, the launch announcement, your licence or support requests are sent through our host's mail server, Hostinger.
Your email address, first name, profession, language and sign-up position are also stored in our contact management tool, Brevo, which is used to send the newsletter to those who accepted it. Every email includes an unsubscribe link.
Backups
Every day, the service's data folder (sign-ups, licences, support requests, settings) is saved in an encrypted archive. A copy is sent to a private repository at GitHub, which cannot read it without our passphrase.
The server keeps the 14 most recent archives and the GitHub repository the 30 most recent: older ones are removed every day, repository history included.
Legal basis: our legitimate interest in protecting the service against data loss. Data deleted from the database may remain in these archives until they are erased, that is for about thirty days.
Who can access your data
Authorised staff of SB STUDIO and our service providers, each limited to its task and bound by a GDPR-compliant contract. Stripe and Meta also act on their own behalf, under their own privacy policies. We do not sell or rent your data, and do not use it for advertising.
- Hostinger International Ltd. (Cyprus): hosting of the site and data, sending of emails (sign-up, invitations, announcements, licence, support). Server in France, backups in Lithuania.
- Brevo (SAS, 106 boulevard Haussmann, 75008 Paris, France): contact management and newsletter sending.
- Cloudflare, Inc. (United States): anti-bot protection (Turnstile) of the sign-up and access code forms.
- Stripe Payments Europe Ltd. (Ireland): subscription payments and billing.
- GitHub, Inc. (a Microsoft subsidiary, United States): encrypted copy of backups; Reels rendering.
- Meta Platforms Ireland Ltd.: Instagram tester invitations for early access members; forms in our ads; Instagram connection.
Requests from public authorities
If a public authority asks us for personal data, including data received from Instagram, we first check that the request is lawful and well-founded. We challenge any request we consider unlawful or disproportionate, we only disclose the strict minimum requested, and we keep a written record of each request, our response and its legal basis. Where the law allows it, we inform the person concerned. To date, we have not received any such request.
Transfers outside the European Union
Stripe, GitHub, Cloudflare and Meta may process data in the United States. These transfers are covered by the EU-U.S. Data Privacy Framework, which these companies have joined, and by the European Commission's Standard Contractual Clauses.
Your rights
You can ask to access, correct or erase your data, restrict its processing or receive it in a portable format. You can also object to processing based on our legitimate interest, withdraw your consent at any time and give instructions on what happens to your data after your death.
Write to contact@foliocast.fr. We reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority in your country.
Last updated: 8 October 2026. The French version of this policy is available at foliocast.fr/confidentialite.html.