Privacy Policy

Cenelira is provided by Cenelira Ltd, a company registered in England and Wales with company number 17124132. Its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. You can contact us at [email protected].

For the personal data in your own Cenelira account, such as your email address, your sign-in details and the messages you send us, Cenelira Ltd is the controller: it decides why and how that data is used, and this policy describes it.

For personal data that a workspace puts into Cenelira or collects through it, such as the content of posts and the details of people a workspace shares a link with, the workspace is the controller and Cenelira Ltd is its processor. We handle that data on the workspace's instructions under our Data Processing Agreement.

UK data protection law lets us use personal data only when it gives us a reason to, called a lawful basis. For the data we control, described in "Who we are" above, these are ours.

To provide the service you asked for

We create and secure your account and your sessions, run your workspaces and team access, store, schedule and publish what you give us, connect and refresh the platforms you choose, send you service emails such as sign-in codes, invitations and review decisions, take payment through Stripe, and answer your support requests. All of this is necessary for our contract with you. If you ask us for an invite, we use your email address to reply. That is a step you asked us to take before any contract.

Because we have a legitimate interest

We also use personal data for the purposes below. Each is a legitimate interest of ours, and most are also in the interests of the people who use Cenelira:

• keeping the service secure, preventing abuse and being able to establish who did what: security and audit records, and limits on repeated requests that use your internet address;
• finding and fixing faults, including an email that did not arrive: error reports, from which passwords, access tokens and link secrets are removed, server logs, and the delivery records our email provider keeps of the service emails we send;
• being able to show that a deletion was carried out, and making sure deleted data does not come back: a small record of each deletion;
• stopping a post being published twice, and settling what was published and when: a record of each attempt to publish;
• recovering the service after a failure, if and when we keep recovery copies of the database;
• protecting the forms on our website from abuse: the internet address kept with a website sign-up;
• answering people who write to us without having an account, and establishing, exercising or defending legal claims.

We have assessed each of these uses and recorded the assessment. They are not used to send you marketing, to target advertising at you or to profile you. We concluded that your interests do not override them. You have the right to object: see "Your right to object" below.

With your consent

If you join our updates list, or ask to be told when a checklist is ready, we email you because you asked us to. You can withdraw your consent at any time, by using the unsubscribe link in any of those emails or by writing to [email protected]. Withdrawing does not affect what we did before you withdrew.

To meet a legal obligation

We answer data protection requests and complaints, and keep the accounting and tax records the law requires of a company, because the law obliges us to.

Data a workspace controls

For the content of posts and the details of people a workspace shares a link with, the workspace decides the lawful basis, and we act on its instructions.

You need to give us an email address to have an account. Without one we cannot create the account or sign you in. A paid plan needs payment details, which you give to Stripe.

Everything else is your choice: connecting a platform, uploading content, inviting people and joining the updates list. If you choose not to, that part of the service is not available to you. No law requires you to give us any of it.

Our website has forms that ask for an email address: one to ask for an invite, and others to hear about updates or to be told when a checklist is ready. We keep your email address with the page you used and the internet address of your request.

These forms used to record two more things with a sign-up: the page you came from, and any campaign tags in the link that brought you to us. They no longer do. What was already recorded is being deleted, and until that is finished a sign-up made before the change may still hold it.

If you asked for an invite, we use the address only to write to you about your invite. If you signed up for updates or a checklist, we use it only to send you what you signed up for, and every such email has an unsubscribe link. We keep a sign-up until you ask us to remove it, which you can do at any time by writing to [email protected].

Cenelira customers can send a link to someone outside their workspace, usually their own client, so that person can review a post before it is published or look at a report. You do not need a Cenelira account to use either link. Whichever link you use, your internet address is handled by our network and hosting providers as part of delivering the page to you.

A workspace can save its clients as contacts: a name, an email address, and whether that person can approve posts, receives reports and receives links to published posts. Only the workspace's owners and admins can see a contact's email address. Its other members see the name.

Where a workspace has its client approve posts, a personal link is made for each contact who can approve when the team shares a post. A decision made through a personal link is recorded under that contact's name. You are not asked to type your name or email address on a personal link, and the email address is not stored with the decision. We record when a personal link was last opened, and the workspace's team can see whether it has been opened. In those workspaces, a link that the team copies and shares by hand can be used to view a post but cannot record the client's decision.

If you were sent a review link

The page shows you the post, its media and its caption. If you approve the post or ask for changes, we ask for your full name and email address. You do not have to give them, but a decision cannot be recorded through the link without them. We store them with your decision so the workspace has a record of who decided what. We also record how many times the link has been opened and when it was last opened, and the workspace's team can see that the link has been viewed.

Your name and email address are then:

• shown to the members of the workspace that sent you the link;
• included in the approval records the workspace can download from Cenelira.

Your name, without your email address, is also shown on the review link itself, next to your decision, to anyone who opens that link afterwards.

We do not use them for marketing, we do not create an account for you and we do not send you email unless a workspace has saved you as a contact. They stay with the approval record until the workspace is deleted, unless they are erased sooner.

If a workspace has saved you as a contact, Cenelira may email you on its behalf: a request to approve a post, a reminder about it, a note that the team replied to your message, a link to a published post if the workspace turned that on, or a report. Every one of these emails has a link that stops them with one click, without signing in. Opening it stops that kind of email from that workspace, and the page it opens lets you stop every email from that workspace or undo the change. The emails contain no tracking pixels. We keep a record that each email was sent, without its text, for 30 days after it is sent or dropped; the record behind a request to approve is kept until its link stops working, if that is later. A request to stop is kept as a one-way fingerprint of your address, without your name or the address itself, until the workspace is deleted or your data is erased, so it still applies if the workspace removes you and saves you again.

A workspace that has saved you as a contact who can approve posts can also turn on an approvals page for you: a private page with its own lasting address, which you sign in to with a code sent by email. Cenelira emails you that address on the workspace's behalf when the page is turned on, when its address is replaced and when a team member sends it again. That email has the same stop link as the others. To sign in you ask the page for a code, and we email six digits to the address the workspace saved for you. The code works for 10 minutes. That one email has no stop link, because it is sent only when a code is asked for on your page. If you receive one you did not ask for, you can ignore it: nobody can sign in without the code.

After you enter the code, your browser keeps one cookie that keeps you signed in on that browser for 30 days, unless you sign out or the workspace ends your sign-in sooner by replacing the address, turning the page off, or changing your email address or your permission to approve. We store the secret part of your page's address and each code only as salted hashes, an encrypted copy of the address so that it can be emailed to you again, and for each sign-in its times and a one-way fingerprint of the cookie. The workspace's owners and admins can see whether your page is on, when you last signed in, and whether sign-in is paused after too many wrong codes. Your internet address is used briefly to limit how often the page is opened and how often codes are asked for or tried. A sign-in record is deleted one day after it ends. Everything else we store for your page is deleted when the workspace removes you as a contact, when your data is erased and when the workspace is deleted. Records of these two emails are kept as described above. Anyone who can read the inbox of the address the workspace saved for you can sign in to your page.

On your approvals page you see the posts that are waiting for you, and you can approve a post or ask for changes there without typing your name: the decision is recorded under the name the workspace saved for you, with a note that it was confirmed by signing in with an emailed code. You can take an approval back on that page until the post starts going out. A take-back covers every account your approval still applies to, and once the post has started going out to any of them it can no longer be taken back. A take-back is recorded with your saved name, like the decision, the workspace's team is told, and the post does not go out to those accounts until it is approved again.

Your approvals page also shows a record of your decisions, which you can download if the workspace allows it. A CSV file is made when you ask for it and is not stored. If you ask for a PDF, we prepare it and store it for 24 hours so that you can download it. It holds the workspace's name and, for each of your decisions in the period you chose, its time, the decision and how it was confirmed, the account, when the post was due to go out, its wording and first comment, how many pictures and videos it had, its version code and what happened next. It does not contain the pictures or videos themselves. Only a browser signed in to your page can download it. It is deleted after 24 hours, or sooner if the workspace switches record downloads off or turns your page off, your email address changes, the workspace removes you as a contact, your data is erased or the workspace is deleted.

Whenever a client's decision on a post is recorded, on an approvals page, through a review link or by a team member on the client's behalf, we keep a copy of what was decided on: the post's caption and first comment, the time it was due to go out, the name of the account it was going to, and for each picture or video an identifier and a fingerprint of its contents. The copy does not contain the pictures or videos themselves, and it does not contain your name or email address. It is kept with the post and deleted when the post or the workspace is deleted.

You can also write messages to the team about a post through a review link or on your approvals page, and the team can reply. A message is plain text of up to 2,000 characters. On a personal link or your approvals page your message is stored under your saved name. On a link the team shared by hand we ask for a name, and it is stored with the message. Messages are stored with the post, shown to the workspace's team and to anyone who opens that post through a review link or an approvals page, and kept until the post or the workspace is deleted, unless they are removed or erased sooner. Writing a message does not approve the post or ask for changes. Do not put sensitive personal information in a message.

When a workspace removes a contact, the contact's email address is deleted. The name stays on the approvals that person already gave, marked “(removed contact)”, so the workspace's approval record stays readable. A one-way fingerprint of the deleted address is kept with the name so that a later request to erase can find those records. The fingerprint does not contain the address, but it can be used to check whether a given address is the one that was deleted. If your data is erased at your request, the name and the fingerprint are removed as well.

The messages that person wrote stay in the same way: the name and the text are kept, with the fingerprint. If your data is erased at your request, the text of your messages and the name on them are removed, and so is the text of any message that contains your email address. A message written under a typed name on a link shared by hand is not connected to an email address, so a request made by address finds it only if the name or the text contains that address. The workspace's owners and admins can remove such a message, which removes the typed name and the text.

If you were sent a report link

Before any numbers are shown, you are asked to accept the report terms. We do not ask for your name or email address. On the link we record how many times it has been opened and when it was last opened, how many viewers have accepted the terms, and the first and latest time they did.

So that you are not asked again, your browser keeps one cookie for that link. It lasts no longer than the link does, and never longer than 180 days. The page also keeps a short note in the browser tab recording when you accepted, so it can tell you if your browser is blocking cookies. Neither is used to identify you or to follow you to other sites.

A report link stops working after 90 days unless the workspace renews it, and the workspace can turn it off at any time. To stop the link being guessed or abused, we use the internet address your request comes from to limit how many attempts can be made in a short time.

Who is responsible for your details

The workspace that sent you the link decides why your details are used and is the controller of them. Cenelira Ltd handles them for that workspace as its processor. To see, correct or remove your details, ask the workspace that sent you the link. You can also email [email protected] from the address you gave, and we will pass your request to the workspace and help it respond.

Cenelira uses cookies and your browser's storage to keep you signed in, to keep the service secure and to remember your choices. This section lists each one, what it is for and how long it lasts.

Opening a page of our website does not by itself make our code set a cookie. Our cookies are set when you sign in, while you use the app, when you connect a platform, or when you accept the terms of a report link.

Cookies we set

• __Secure-next-auth.session-token (a long one is split into numbered parts): keeps you signed in. Kept: up to 30 days after you sign in or after the app last refreshed your session, or until you sign out.
• __Host-next-auth.csrf-token: protects signing in and signing out against requests forged by another site. Kept: it has no set lifetime: your browser keeps it until it ends its session, usually when you close it.
• __Secure-next-auth.callback-url: remembers which page to take you to after you sign in. Kept: it has no set lifetime: your browser keeps it until it ends its session, usually when you close it.
• __Secure-next-auth.state and __Secure-next-auth.pkce.code_verifier: protect a sign-in with Google while it is under way. Kept: 15 minutes at most.
• pp_active_workspace: remembers which workspace you have open. Kept: 30 days from when it was last set.
• names that start with pp_ and contain state, return_to, pkce or source_connection_id: protect the connection of a social platform account while you are making it, and bring you back to the page you started from. Kept: 10 minutes at most.
• cenelira_report_terms_ followed by the id of the link: records that you accepted the terms of a report link, so that you are not asked again. Kept: as long as the link works, and never more than 180 days.
• cenelira_home_ followed by the id of the page: keeps you signed in to an approvals page a team set up for you, after you entered the code emailed to you; set only for a client who signs in to such a page. Kept: 30 days, or until you sign out or the team ends your sign-in.
• pp_admin_step_up: used by company staff only: records a recent extra identity check before an administration action. Kept: 10 minutes.

Entries in your browser's storage

These stay in your browser. Unlike cookies, your browser does not send them to us with each request.

• names that start with postpilot.scheduleWizard.draft: a schedule you have started and not yet submitted, so that it is still there after a reload. Kept: until you submit or discard it, or sign out.
• names that start with postpilot.connections.callback-statuses: the error from a platform connection that failed, so that the connections page can keep showing it. Kept: until the error is cleared or you sign out.
• names that start with postpilot.onboarding, cenelira.onboarding or cenelira.release: that you closed a getting-started panel or a notice, so that it stays closed. Kept: until you sign out.
• names that start with cenelira.report-terms-accepted: the time you accepted the terms of a report link, so that the page can tell you if your browser is blocking cookies. Kept: until the page has read it, or you close the tab.
• theme: the appearance you chose under Theme, in the account menu or on a review or report page: Light, Dark or Match system. Kept: until you change it or clear your browser's storage; it is a device setting and is not removed when you sign out.
• nextauth.message: tells your other open tabs that you signed in or out. Kept: until the next such message replaces it, or you clear your browser's storage.

You can delete cookies and stored entries in your browser's settings at any time. Without the sign-in cookies you cannot stay signed in. Signing out removes the stored entries whose names start with postpilot. or cenelira.

What our pages read from your device

• Pages that have a dark version check whether your device is set to a light or a dark appearance, so that they can match it. Those pages are the app when you are signed in, the pages our own staff use, and a review, a report or an approvals page opened from a link. Each of them has a Theme setting, in the account menu of the app or at the top of a review, report or approvals page, where you can choose Light, Dark or Match system. While Light or Dark is chosen, our pages do not check your device. Our other pages do not check it and are always light. The check happens in your browser.
• Pages that show or ask for times read your device's time zone, to show times in your local time and to offer it as your time zone. You can choose a different time zone in Settings.
• Pages in the app check the width of your browser window, and whether your device asks for reduced motion, to lay themselves out.
• When you accept the terms of a report link, or sign in to an approvals page a team set up for you, the page checks whether your browser accepts cookies, so that it can tell you if they are blocked.

Reports your browser sends

Our pages include error-reporting code from Sentry, our error-monitoring provider. It is served from our own site as part of our pages, not loaded from Sentry's servers. When something fails on a page, it sends Sentry a report made by Sentry's reporting kit: the report describes the error, the page and the browser it happened in, and what happened on the page just before. Before a report leaves your browser, our code removes passwords, access tokens, cookies, the secret part of a link and the address of the page you were on before, and keeps the text of a page element's label, title and alternative text out of it. The code sends Sentry nothing unless an error happens, apart from a count of error reports that were not sent. It sets no cookie and keeps nothing in your browser's storage.

Our pages carry a security policy that tells your browser what they may load. If your browser blocks something under it, your browser sends our server a report. From a report our server keeps what was blocked and under which rule, with the addresses of the page, of what was blocked and of the script concerned. Before it keeps them, it removes the secret part of a review link, a report link or an approvals page address from those addresses, and it does not keep the address of the page you were on before. Our server deletes its copy 30 days later. It also sends those addresses and the rule to Sentry, our error-monitoring provider, which keeps its copy for its own retention period.

Other companies

Cloudflare, the network provider that carries traffic to our site, can set security cookies of its own, for example __cf_bm or cf_clearance, when it checks that a visitor is a person and not an automated program. Cloudflare lists them, and how long each lasts, on its page about its cookies.

When you sign in with Google, connect a social platform or pay through Stripe, you are taken to that company's own site. It uses its own cookies there, under its own policy.

None of this is used for advertising or to follow you to other sites. Our pages load no advertising or analytics code, and no script from another company's servers.

Cenelira Ltd is based in the United Kingdom. To run Cenelira we use the service providers below, and some of them store or handle data outside the United Kingdom.

• Railway Corporation: Hosts the application, the main database and the job queues, and keeps server logs. Location: United States.
• Cloudflare, Inc.: Carries traffic to Cenelira through its network and stores uploaded media and exported files. Location: Cloudflare's global network, including the United Kingdom, the European Union and the United States.
• Plus Five Five, Inc. (Resend): Sends email for Cenelira, such as sign-in codes, workspace invitations, review decisions and the emails a workspace has Cenelira send to its saved client contacts. Location: United States, where Resend stores its records; emails are sent from Ireland.
• Functional Software, Inc. (Sentry): Receives error reports from the application. Access tokens, passwords and cookies are removed before a report is sent. Location: Germany.
• Amazon Web Services: Stores recovery records that let us show a deletion happened and stop deleted data coming back. They hold coded identifiers and checksums, and no names, email addresses or content. Location: Sweden.
• Google (Google Workspace): Hosts the mailbox for messages sent to our support address. Location: Google's data centres, including in the European Union and the United States.
• Stripe: Runs the checkout page and subscription billing. It collects payment details itself. Location: United States.

Transfers to the United States go to providers certified under the UK Extension to the EU-US Data Privacy Framework, which UK adequacy regulations cover. Countries in the European Economic Area are also covered by UK adequacy regulations. Where a provider's contract with us includes the UK International Data Transfer Addendum, that applies as well. Our Data Processing Agreement lists the basis for each company that handles data on a workspace's behalf, and you can ask us for a copy of the safeguards at [email protected].

UK data protection law gives you the right to ask for a copy of your personal data, to have it corrected or erased, to have its use restricted, to object to its use, and to receive it in a portable form. Some of these rights apply only in certain situations.

• If the data is in your own Cenelira account, email [email protected]. We will reply without undue delay and within one month.
• If a workspace holds the data, for example because you were sent a review link, ask that workspace. If you ask us instead, we pass your request to the workspace and help it respond. You can ask for what the workspace holds under your email address to be erased: your saved contact details, your name and email address on approvals and requests for changes, and your name on an approval you took back, including those you gave before you were removed as a contact, and your address where a team member typed it into the reason for an approval recorded on your behalf. It also covers the messages you wrote to the team through a review link or your approvals page. It also covers the records of emails sent to you as a contact and your requests to stop them. It also covers your approvals page, if a workspace turned one on for you, with its sign-ins. The workspace's owners and admins can do this themselves in Cenelira, and our staff can do it on the workspace's instruction. Approval record files the workspace generated before the erasure, and that could name that person, are removed as part of it: they can no longer be downloaded and the stored files are deleted. A copy that someone had already downloaded cannot be recalled.

Your right to object

You have the right to object at any time to our use of your personal data where we rely on a legitimate interest. Write to [email protected] and tell us what you object to and why. We will stop unless we have compelling reasons that override your interests, or we need the data for a legal claim.

You can also object at any time to your data being used for direct marketing, and we will always stop.

Complaints

If you think your personal data has been handled wrongly, you can complain to us at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commission, the UK data protection regulator, at ico.org.uk/make-a-complaint.

Cenelira is a tool for people who publish for a business, a team, an agency or themselves, and it is not aimed at children. Our Terms of Service require you to be 18 or over to use it. We do not ask for your age or date of birth. If you believe someone under 18 has an account, write to [email protected] and we will look into it.