Privacy Policy

Effective date: October 13, 2026. Last updated: October 13, 2026.

1. Who we are

This Privacy Policy explains how PumpBeat Creative Studio (“PumpBeat”, “we”, “us”) handles personal information. PumpBeat is operated by Roxana Mendriel, Lima, Peru (the data controller). Contact: mariamendriel@icloud.com.

PumpBeat is a private tool used to plan, produce, approve, schedule and publish social media content for the brands managed by Roxana Mendriel, and to measure the results of that content. It is available at https://pumpbeat.byroxanamendriel.com (studio, password protected) and https://clientes.byroxanamendriel.com (client review links). On TikTok for Developers and Meta for Developers the app is registered as “PumpBeat Studio”.

2. Information we collect

Information you give us: brand and campaign information, briefs, notes, content files (photos, videos, audio, designs), captions, hashtags, schedules, and the name and comments a client enters when reviewing a piece.

Information from connected Instagram accounts (Instagram API with Instagram Login), only after the account owner authorizes it, with these permissions:

• instagram_business_basic: account ID, username, name, profile picture, biography, website, follower and following counts, number of posts, and the list of the account’s own media (caption, media type, permalink, thumbnail, timestamp, like and comment counts).
• instagram_business_manage_insights: metrics of the account and of its own media (for example reach, views, saves, shares, total interactions, profile views, website clicks and aggregated audience demographics by age range, gender, city and country).
• instagram_business_manage_comments: comments on the account’s own media (text, username of the commenter, like count and time), to read audience feedback. We do not reply to or delete comments automatically.
• instagram_business_content_publish: to publish the photos, videos, Reels and stories that were approved and scheduled for that account.

Information from connected Facebook Pages and Meta accounts (only if a brand connects them through Facebook Login): page name and ID, page followers, page posts and their engagement, Instagram accounts linked to the page and, if the brand uses Meta Ads, read-only advertising performance (spend, impressions, reach, clicks) through pages_show_list, pages_read_engagement, read_insights, instagram_basic, instagram_manage_insights, business_management, ads_read, instagram_content_publish and pages_manage_posts. We never create, edit or pay for ads.

Information from connected TikTok accounts (TikTok Login Kit, Display API and Content Posting API), only after the account owner authorizes it, with these scopes:

• user.info.basic and user.info.profile: open ID, display name, username, avatar, bio, profile link and verification status.
• user.info.stats: follower, following, likes and video counts.
• video.list: the account’s own public videos with title, description, duration, cover image, share link, creation time and view, like, comment and share counts.
• video.upload: to send an approved video to the account’s TikTok inbox as a draft, so the owner finishes and posts it in the TikTok app.
• video.publish: to post an approved video directly to the account, using the privacy level, interaction settings (comments, duet, stitch) and commercial content disclosure chosen by the user at the moment of scheduling, after confirming TikTok’s Music Usage Confirmation.

Access tokens: the authorization tokens issued by Instagram, Meta and TikTok, used only to perform the actions above. We never receive or store social network passwords.

Technical information: a session cookie to keep the studio user signed in, and basic server logs (date, time, requested page, IP address) kept for security for up to 30 days. We do not use advertising cookies, tracking pixels or third-party analytics on this website or in the studio.

Public information: to study trends, we may read publicly available information about public posts on TikTok and other platforms (for example the view count of a public video) without signing in to any account. We use it only in aggregate to understand formats and trends; we do not build profiles of individuals.

3. How we use information

We use the information only to provide the service to the brand that connected its account:

• to show the brand its profile, content and metrics inside the studio;
• to plan and produce content and to measure what works;
• to publish, at the scheduled time, only the content that was approved and scheduled for that account;
• to send review links to clients and record their approval or comments;
• to send the studio user notifications about the status of the work (for example, “published” or “ready for review”);
• to keep the service secure and fix problems.

We do not sell personal information, we do not use data from Instagram, Meta or TikTok for advertising, profiling, data brokering or to train artificial intelligence models, and we do not combine data from different brands.

Artificial intelligence. Some features (for example writing scripts, analyzing account metrics or analyzing reference videos) use the Claude AI service provided by Anthropic. When those features are used, the relevant content and aggregated metrics of that brand are sent to Anthropic only to generate the requested result. Under Anthropic’s commercial terms this data is not used to train their models.

4. How we store and protect information

Studio data is stored on a computer controlled by the operator, protected by the device’s encryption and by a password-protected studio access over HTTPS.

To publish scheduled content when that computer is off, a copy of each scheduled post (the approved file, caption, schedule and the access token of that account) is kept in our private cloud publisher hosted on Cloudflare. Access tokens are encrypted (AES-256-GCM). Files are deleted from the cloud as soon as the post is published or cancelled.

Only the operator has access to the studio. Clients only see the pieces shared with them through a private, revocable link.

5. How we share information

We share information only with the service providers needed to run the service, under their own terms and only for that purpose:

• Meta Platforms (Instagram and Facebook) and TikTok: to read the connected account’s data and publish approved content, as authorized by the account owner;
• Cloudflare: hosting of this website, secure connection to the studio and the cloud publisher;
• Anthropic: AI features described in section 3;
• Telegram: status notifications sent only to the operator (they do not include data of third parties beyond the brand name and the post link).

We may disclose information if required by law or a valid order of a competent authority. We do not share data with any other third party.

6. Data retention

Account data and metrics are kept while the account remains connected and the brand remains a client. Content files and campaign materials are kept for the duration of the working relationship.

When an account is disconnected, its access token is deleted immediately and its synced profile, posts, metrics and comments are deleted within 30 days, unless the brand asks us to keep its own campaign history. Cloud copies of scheduled posts are deleted after publication or cancellation.

7. Your rights and choices

You can revoke access at any time:

• Instagram: Settings › Apps and websites (or Website permissions) › Active › remove the app.
• Facebook: Settings & privacy › Settings › Business integrations › remove the app.
• TikTok: Settings and privacy › Security and permissions › Apps and services permissions › remove the app.

You can ask us to access, correct, delete or stop processing your information, as provided by Peru’s Personal Data Protection Law (Law No. 29733) and other applicable laws, by writing to mariamendriel@icloud.com. See also our Data Deletion Instructions.

8. Data deletion

To delete all data related to your Instagram, Facebook or TikTok account, follow the Data Deletion Instructions or email mariamendriel@icloud.com with the subject “Data deletion”. We confirm and complete the deletion within 30 days.

9. Children

PumpBeat is a professional tool for businesses. It is not directed to anyone under 18 and we do not knowingly collect information from children.

10. International transfers

The operator is in Peru. Some service providers (Cloudflare, Anthropic, Meta, TikTok, Telegram) may process information in other countries. They do so under their own data-protection commitments.

11. Compliance with platform terms

We use data from Instagram, Facebook and TikTok in accordance with the Meta Platform Terms, the Meta Developer Policies, the TikTok Developer Terms of Service and the TikTok Developer Guidelines, and only for the purposes described in this policy.

12. Changes to this policy

If we change this policy, we will update the date at the top of this page. If the change is significant, we will notify the brands that have connected accounts.

13. Contact

Roxana Mendriel — PumpBeat Creative Studio, Lima, Peru. Email: mariamendriel@icloud.com.