This policy explains what personal data Swonkie, Lda. ("Swonkie", "we", "us") collects through Rizamo, why, and what you can do about it. Rizamo is a product of Swonkie. Words with capitals, such as Team, Account, Agent and End User, have the meaning given in our Terms of Service.
1. Who we are
Swonkie, Lda., NIPC 514107502, Rua do Progresso, n.º 140, 2.º andar, Fração BS, Vilarinho das Cambas, 4760-841 Vila Nova de Famalicão, Portugal. For anything about privacy, write to hi@rizamo.com.
2. Our role
- We are the controller of the data we need to run our business: your Team and its members, billing, security, support, and visits to rizamo.com.
- We are a processor of Customer Data: the content, comments, messages, reviews and metrics of the Accounts you connect, and anything your Agents or Customer Applications send us. You, our customer, decide what happens to it. Our Data Processing Agreement covers this.
- Networks are independent controllers of the data they hold. Their own privacy policies apply to it.
If you interacted with an Account that one of our customers manages, for example by commenting on a post or sending a message to a brand, that customer is the controller of your data. You can still contact us and we will help (section 13).
3. What we collect
- Team and sign-in data: names, email addresses, password hashes or sign-in provider identifiers, roles, invitations.
- Billing data: billing name and address, tax number, plan, invoices. Card details are handled by our payment provider; we never see full card numbers.
- Usage and security data: IP addresses, browser and device information, API, MCP and CLI requests with their timestamps, the API key or OAuth client used, webhook deliveries, and audit events such as who changed a post.
- Connected Account data: the access tokens a Network gives us when you connect an Account, the Account's public profile (name, handle, picture, ID), and the posts, media, comments, messages, mentions, reviews and metrics we fetch so the Service works. This can include personal data of people who interact with your Accounts, such as their name, handle, profile picture and what they wrote.
- Content you create: posts, media, custom fields, notes, assignments and replies, whether written by you, your team or your Agents.
- Support data: what you send us when you ask for help.
- Website data: pages visited on rizamo.com and technical data needed to serve them. With your consent, also clicks, session recordings with typed text hidden, and a random identifier in a cookie; with marketing consent, data collected by advertising tags (see section 15).
- Waitlist data: the email address you give us to join the waitlist, the page you joined from, and your country, worked out from your IP address.
4. Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: publish, sync analytics, run the inbox, send webhooks | Team, Connected Account, content, usage | Contract; for Customer Data, your instructions as controller |
| Create and secure your Team, stop abuse and fraud | Team, usage and security | Legitimate interest in keeping the Service safe |
| Bill you and keep accounting records | Billing | Contract and legal obligation |
| Support and service emails | Team, support | Contract |
| Improve the Service with aggregated statistics | Usage, de-identified | Legitimate interest |
| Product news and marketing emails | Team email | Consent or legitimate interest; you can opt out at any time |
| Tell you when Rizamo opens | Waitlist data | Consent; you can ask us to remove you at any time |
| Count and improve visits to rizamo.com without cookies | Website data, without identifiers stored on your device | Legitimate interest in knowing how the site is used |
| Analytics with cookies and session recordings on rizamo.com | Website data | Consent, which you can withdraw in Cookie settings |
| Measure our advertising | Website data and advertising identifiers | Consent, which you can withdraw in Cookie settings |
| Comply with the law and answer authorities | Any, as required | Legal obligation |
We do not sell personal data, we do not use it for advertising profiles, and we do not use Customer Data or Network data to train AI models.
5. AI agents and MCP
When you connect an Agent through our MCP server or API:
- You approve access on a consent screen (OAuth) or by creating an API key. OAuth access tokens are short-lived and refreshed; API keys last until you delete them.
- The Agent can do what the granted scopes and Profiles allow, such as reading posts, analytics and inbox threads, creating and scheduling posts, and replying to comments and messages.
- Data the Agent reads from Rizamo is sent to the Agent and to the model provider it uses. Their privacy policies apply from that point. Choose Agents you trust with that data.
- We log each tool call and API request, with the Agent or key that made it, so you can see who did what.
- You can revoke an Agent at any time in the web app, under API keys or Connected apps.
6. Data from Networks
6.1 YouTube
Rizamo uses YouTube API Services. When you connect a YouTube channel, we access, store and use the channel's identity, videos, comments and analytics to publish, measure and answer comments for you. We share this data only with you, the people in your Team and the Agents and applications you connect. By using Rizamo with YouTube you agree to the YouTube Terms of Service, and Google's Privacy Policy applies to Google's handling of your data.
You can revoke Rizamo's access to your YouTube data at any time on the Google security settings page. When you revoke access, disconnect the channel or ask us to delete its data, we delete the data we stored from YouTube within 7 days. Deleting data in Rizamo does not delete anything on YouTube.
6.2 Google user data
Rizamo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you see, we do not transfer it except as needed for those features, for security or by law, and people at Swonkie do not read it unless you ask us to, it is needed for security, or the law requires it.
6.3 Facebook, Instagram and Threads
We use Meta's APIs to publish, read insights, and manage comments, messages and mentions of the Pages and accounts you connect. To ask us to delete data we received from Meta, follow our data deletion instructions. If you remove Rizamo from your Facebook or Instagram settings, Meta tells us and we delete the related data.
6.4 LinkedIn, TikTok, Pinterest, Google Business Profile and X
We use each Network's API only for the features you use, under that Network's terms. When you disconnect an Account or ask us, we delete its tokens at once and the data we stored from it within the periods in section 10. You can also revoke access from the Network's own settings; see Data deletion.
7. If you connected an account through an app built on Rizamo
Some of our customers build their own applications on Rizamo. When you connect a social account through one of those applications, the Network's consent screen may show Rizamo. In that case the application's operator decides how your data is used, and its privacy policy applies; Rizamo processes your data for that operator. If you want your data deleted, ask the operator, or write to us at hi@rizamo.com and we will pass on your request and help.
8. Who we share it with
- Service providers that host and run Rizamo for us, under contracts that protect your data. The current list is on our subprocessors page.
- Advertising providers, only if you accept marketing cookies on rizamo.com: Google, through Google Tag Manager, and the ad networks whose tags we use to measure our campaigns. They act as independent controllers for their own purposes, under their own privacy policies.
- Networks, when you ask us to publish, reply or fetch data from them.
- People in your Team, the Agents you connect and the webhook endpoints you configure.
- Professional advisers, such as lawyers and auditors, under confidentiality.
- Authorities, when the law requires it. We review requests and push back on those that are not valid.
- A buyer or successor of our business, who must keep protecting your data as this policy says.
9. International transfers
Rizamo runs on Cloudflare's global network, and our main database is hosted in the United States. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, for providers certified under it) or on the European Commission's Standard Contractual Clauses with the UK Addendum, plus additional measures such as encryption.
10. How long we keep it
| Data | How long |
|---|---|
| Network access tokens | Until you disconnect the Account or the Network revokes them, then deleted at once |
| Content, comments, messages and metrics of a connected Account | While it is connected. After you disconnect it: YouTube within 7 days, LinkedIn within 10 days, X within 24 hours, others within 30 days |
| Team, posts, custom fields and settings | While your Team exists, then 30 days for export before deletion |
| API, MCP and webhook logs | 90 days |
| Backups | Up to 30 days, then overwritten |
| Invoices and accounting records | As long as tax law requires |
| Support conversations | 2 years after they close |
| Waitlist sign-ups | Until we invite you, and no more than 12 months; sooner if you ask |
We may keep data longer when the law requires it or to defend a legal claim, and only for that purpose.
11. Deleting data and revoking access
- Disconnect an Account in the web app to delete its tokens and start deletion of its data.
- Delete your Team in the web app to delete everything after the 30-day export period.
- Revoke Rizamo in each Network's settings. Links for each Network are on our Data deletion page.
- Or write to hi@rizamo.com.
12. Security
We encrypt data in transit with TLS and encrypt Network access tokens at rest. Access to production systems is limited to the people who need it and is logged. API keys are stored as hashes. We will notify affected customers and, where required, the supervisory authority without undue delay and within 72 hours of becoming aware of a personal data breach. To report a vulnerability, write to hi@rizamo.com.
13. Your rights
Depending on where you live, you have the right to access, correct, delete, restrict or object to the use of your personal data, to receive it in a portable format, and to withdraw consent at any time. Write to hi@rizamo.com. We reply within one month.
If we hold your data as a processor for one of our customers, we will forward your request to that customer within 5 business days and help them answer it.
You can complain to a data protection authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt. You can also complain to the authority where you live or work.
California residents. We do not sell or share personal information for cross-context behavioural advertising. You can ask to know, correct or delete your personal information, and we will not discriminate against you for doing so.
14. Children
Rizamo is not for anyone under 18, and we do not knowingly collect their data. If you believe we have, write to us and we will delete it.
15. Cookies
rizamo.com asks before using any cookie that is not strictly necessary. You can change your choice at any time with Cookie settings in the footer of every page.
| When | What | Provider | How long |
|---|---|---|---|
| Always | Remembers your cookie choice, in your browser's storage (rizamo-consent) |
Rizamo | Until you clear it |
| Always | Counts visits without cookies, with a privacy-preserving hash computed on PostHog's servers; nothing is stored on your device | PostHog (EU) | Not stored on your device |
| With analytics consent | A random identifier in a cookie (ph_..._posthog) to recognise returning visitors, page and click analytics, and session recordings with typed text hidden |
PostHog (EU) | 1 year |
| With marketing consent | Google Tag Manager and the advertising tags it loads, to measure our campaigns | Google and the ad networks we use | As set by each provider |
The web app at app.rizamo.com uses strictly necessary cookies to keep you signed in and secure your session. Our payment provider sets its own cookies on the checkout page to prevent fraud.
16. Changes
We will post any change here and update the date at the top. If a change is material, we will tell you by email or in the web app before it takes effect. If we ever want to use Google user data in a new way, we will ask for your consent first.
17. Contact
Swonkie, Lda., Rua do Progresso, n.º 140, 2.º andar, Fração BS, Vilarinho das Cambas, 4760-841 Vila Nova de Famalicão, Portugal. hi@rizamo.com