Privacy Policy

Who we are

Barreto Tech (Norwegian organisation number 922923086) is a sole proprietorship based at Sølvspennetunet 56, 4032 Stavanger, Norway. It is the data controller for the websites and applications listed on this page. Contact: [email protected].

Scope

This policy covers:

• barreto.work and the other websites Barreto Tech publishes.
• Barreto Tech Social — our internal social media publishing tool, a self-hosted instance of the open-source Postizapplication. It is used only by Barreto Tech and the businesses we manage to plan and publish content to social media accounts that those businesses own.

Websites

Our websites are static pages served through Cloudflare. They set no advertising or analytics cookies. Cloudflare processes connection metadata (such as IP address and user agent) to serve and protect the site, underCloudflare's privacy policy.

The chat widget on some pages is provided by a Chatwoot instance we host ourselves. If you write to us there, we keep the conversation and any contact details you choose to share so that we can reply. Nothing is sent to third-party marketing services.

Barreto Tech Social

When a social media account is connected to Barreto Tech Social through a platform's official login (Meta, LinkedIn, Threads and similar), the platform issues us an access token for that account. We store:

• the access token and the account's public identifier, name and profile picture;
• the posts we draft and publish, including any media we upload for them;
• engagement statistics the platform returns for those posts.

We use this data for exactly one purpose: to publish and manage content on behalf of the connected accounts, at the request of the people who own them. We do not read, collect or store data about other platform users — followers, commenters or the public — beyond what the platform returns as engagement counts on our own posts.

The tool is single-tenant and runs on servers Barreto Tech operates in Norway. Access is limited to Barreto Tech and to the owners of the businesses whose accounts are connected. We do not sell, rent or share this data with anyone, and we do not use it for advertising or profiling.

Data received from Meta platforms (Facebook, Instagram, Threads) is handled in accordance with theMeta Platform Terms; data from LinkedIn in accordance with theLinkedIn API Terms of Use.

Retention and deletion

Access tokens are kept for as long as an account stays connected. Disconnecting an account inside the tool, or removing the app's access from the platform's own settings (for example Facebook → Settings → Business integrations, or LinkedIn → Settings → Permitted services), invalidates the token; we then delete it together with the account record. Drafts and published-post records are kept while the business uses the tool. Backups are rotated within 14 days.

To request deletion of any data we hold about you or an account you control, email[email protected]. We answer within 30 days and confirm when the deletion is complete. This address also serves as the data deletion instruction endpoint required by Meta.

Your rights

Under the GDPR you may ask for access to, correction of, or deletion of your personal data, and you may object to or restrict its processing. Write to[email protected]. You may also lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

Changes

We update this page when our practices change. The date at the top reflects the latest revision.