The answers your procurement team asks for

Where the data lives

PlanVortex runs on dedicated servers that we operate ourselves, and we use Cloudflare to store the files you upload and to protect web traffic. Here is what there is and where each piece sits.

• The service (the API, the dashboard and the background job scheduler) runs on dedicated servers hosted with Arsys, a Spanish provider belonging to the European IONOS group, in its Logroño data centre.
• The database and the cache are ours and live on that same machine. They are not exposed to the internet: only the service itself talks to them. There is no third-party managed database anywhere.
• Identity is handled by a Keycloak instance that is also ours and also lives there. No external login provider gets to see who signs in to your account.
• The files you upload are stored in Cloudflare R2 under European Union jurisdiction, a storage option that guarantees objects never leave the EU. The bucket is private: it has no public or guessable address, and everything is served through signed links that expire.
• The email we send you (account notices, billing and invitations) goes out from our own mail server. We use no bulk-sending platform, so your address never ends up on anyone's list.

There are two transfers outside the European Economic Area. The first is AI generation, and only if you use it: what you ask for travels to the model provider. On the free plan it never happens, because the free plan includes no AI credits. The second is Google, which handles analytics (only if you accept them) and the contact form's reCAPTCHA with transfers to the US. Both are spelled out in the table below.

Who else touches the data: the five sub-processors

A sub-processor is a company that processes data on our behalf so the service can work. There are five. We use no product analytics, support, session recording or lead capture tools.

What we store from the accounts you connect

The access permission to your social accounts is the most sensitive thing you trust us with, and this is what we do with it.

• The access permission (the OAuth token) never leaves the server. The API strips it from every response before sending it, so it cannot be read from the dashboard, from an integration or from an activity log, not even with your own session signed in.
• From each network we request only the minimum permission needed by the feature you are about to use.
• The secrets you hand us on purpose (your own API keys, your Discord application credentials) are stored encrypted with AES-256-GCM and are write-only: they can be replaced, but never read back.
• What we pull from the networks (posts, counters, comments and reviews) is a working copy that is continuously refreshed against the network itself. We do not build a parallel archive that outlives disconnection.
• When you disconnect an account we revoke the permission against that network at that very moment (it stops being valid instantly) and delete its credentials from our database.
• If you connect a WooCommerce store, the key your WordPress creates is read-only, but WooCommerce does not separate permissions by kind of data: that same key could also read the store's orders and customers. We only use it to read the product catalogue, the store's name and its currency and tax settings (no personal data), and the code that talks to your store has a closed list of routes that includes neither orders nor customers. We store it encrypted and it never leaves through the API. When you disconnect the store we delete it, but WooCommerce does not let an application delete its own key: you delete it in your WordPress, under WooCommerce → Settings → Advanced → REST API.
• When you close your account, an automated process that runs daily deletes it completely in under 24 hours. The only exception is invoices, which tax law requires us to keep.

The full detail (encryption in transit, access control, retention periods and how to exercise your rights) is in the privacy policy. Read the privacy policy

AI-generated images: they leave marked

The EU AI Act (Article 50) requires whoever provides a system that generates images to mark them in a machine-readable format. At PlanVortex that part is ours, and this is what we do.

• The image model we use by default (Google's Gemini) marks every image in three ways: a C2PA manifest signed by Google, IPTC metadata declaring it AI-generated, and SynthID, an invisible watermark in the pixels themselves. We checked it with a real image: the signature validates against the official C2PA trust list.
• We store the image exactly as it arrives, without changing a byte. If its aspect ratio already works for the network, that same file is published, with all three marks.
• If it has to be cropped or compressed for a network, the C2PA signature stops being valid, because the pixels change. In that case we write the IPTC metadata again, and SynthID stays in the image.
• We tell TikTok when publishing, so it shows its AI-generated content label. Other networks, such as Meta's, LinkedIn or Pinterest, read the file's metadata and decide for themselves whether to label it. For the ones that label nothing, the dashboard offers to add a line to the text that says so.
• The API says what is AI: every generated image carries an ai_generated field (provider, model and date), and every publication says whether its text or its image came from AI. That lets you show the label in your own product.
• If you connect your own AI provider, the origin marks depend on that provider. If an image arrives with none, we add the IPTC metadata when storing it.

Anyone can check it with free public tools:

• The Content Credentials verifier, to read the C2PA manifest
• The Gemini app, asking whether the image was created with Google AI (SynthID)

If an image could pass for real, telling your audience it was generated with AI is up to whoever publishes it (Article 50(4)), not to us. We give you the mark, the signal to the network and the label, and the decision is yours.

Availability commitment

That works out to a maximum of about 43 minutes of downtime a month. It is a service target, not an agreement with penalties: we would rather publish the number we are aiming at than publish none.

• Planned maintenance is announced at least 48 hours in advance and carried out outside Spanish business hours. It does not count as downtime.
• When an incident affects the service we notify the administrators of the affected accounts by email, and afterwards we publish what happened and what we did about it.
• Scheduled posts are not lost if the service goes down: they stay pending and go out when it comes back.
• What we cannot guarantee is the availability of the social networks themselves. If Instagram stops accepting posts, PlanVortex keeps running and keeps retrying, but the outcome is up to them.

If your procurement needs a signed service level agreement, with penalties and committed response times, write to us and we will talk it through. It is not in the small print because we would rather not promise it automatically to everyone.