Last updated: October 24, 2026
who is responsible
The data controller is Zahira El Talhaoui, a sole proprietorship registered in Quebec (NEQ 2273778631), 5741 Jean-Talon Street East, Montréal, Quebec H1S 1M3, Canada, publisher of Olaé. She is also the person in charge of the protection of personal information under Quebec law (Law 25). For any question about your data: contact@getolae.com (subject "Personal data").
For Agency accounts, the agency is responsible for its own clients' data that it enters into Olaé; Olaé then acts as a processor on its behalf. A data processing agreement is available on request.
data and purposes
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email address, name, language, login credentials | Create and manage your account | Contract | As long as the account exists, then 3 years to handle any claims |
| Brand profile, content, calendar, conversations with the coach | Provide the service | Contract | Until you delete them or your account |
| Connected social accounts and post statistics | Publish on your behalf and analyze your results | Contract | Until the account is disconnected |
| Subscription and invoices (your card number stays with Stripe) | Collect payment and invoice | Contract and legal obligation | 10 years for accounting records |
| Email address left for the guide or news | Send you the guide and tips | Consent | Until you unsubscribe, at most 3 years without interaction |
| Messages sent through the contact form | Reply to you | Legitimate interest | 3 years after the last exchange |
| Technical logs (IP address, date, actions) | Security and abuse prevention | Legitimate interest and legal obligation | 12 months |
Olaé does not sell or rent your data, and does not use it for advertising.
social media accounts
When you connect an account (Instagram, Facebook, TikTok, LinkedIn, YouTube, Pinterest, X, Threads), you approve access on the network's official page. Olaé never sees your password. It receives an access token, stored encrypted, and only uses the permissions needed to:
- read the account's basic information (name, photo, handle) to show it in your workspace;
- publish the content you scheduled yourself, at the time you chose;
- read the statistics of those posts for account analysis.
Olaé does not read your private messages and never publishes anything you haven't scheduled. You can remove access at any time from Olaé or from the network's settings; the data received from that network is then erased (see Delete my data).
Depending on the network, publishing may go through the provider Ayrshare, acting on behalf of Olaé.
artificial intelligence
To generate your text, Olaé sends its AI provider (Anthropic) the information the request needs: your brand profile and your instructions. To create an image, Olaé sends Google (Gemini API, paid tier) your instructions, your brand colors and, if you pick one, the "template" photo. This data is not used to train the providers' models, and Olaé does not use it to train any AI either. No decision with a legal effect on you is made automatically.
Generated content is a suggestion: review it before publishing.
service providers
| Provider | Role | Location |
|---|---|---|
| Vercel | Hosting of the website and app | United States, global network |
| Supabase | Database, authentication, files | European Union |
| Stripe | Payment and invoicing | Ireland, United States |
| Anthropic | AI text generation | United States |
| Google (Gemini) | AI image creation | United States |
| Resend | Sending emails | United States |
| Ayrshare | Scheduled publishing to networks | United States |
These providers only use your data for the service they provide to Olaé, under a contract that requires it (GDPR article 28).
international transfers
Olaé is published from Canada, a country recognized by the European Commission as providing adequate data protection. Some providers are located in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where the provider participates, by the EU–U.S. Data Privacy Framework.
security
Encrypted connections (HTTPS), network access tokens encrypted in the database, data access limited to people who need it, payments handled by a certified provider. No social media password is ever stored.
your rights
At any time you can ask to access your data, correct it, erase it, receive it in a portable format, restrict its processing, object to processing based on legitimate interest, withdraw your consent, and give instructions about what happens to your data after your death.
Much of this can be done directly in the app (Settings, export, account deletion). Otherwise, email contact@getolae.com; you'll get an answer within one month. If you believe your rights are not respected, you can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or, if you live in the European Union, your country's data protection authority (in France, the CNIL, cnil.fr).
minimum age
Olaé is intended for people aged 15 and over. Paid plans are reserved for adults or for people acting with their parents' consent.
changes
This policy may change, for example when a new provider is added. For any significant change, an email will let you know before it takes effect.
This policy is a translation for convenience. If there is any difference, the French version prevails.