Sistema 10KPrivacy Policy
This Privacy Policy explains what personal data Sistema 10K (the "Service", available at www.sistema10k.com.ar) processes, why, who it is shared with, how long it is kept and how you can exercise your rights. It applies to the web platform, to the TikTok and Instagram connections and to any communication with us. By using the Service you accept this Policy; if you do not agree, please do not use it.
1. Data controller
The data controller is Joaquín Vega, who operates Sistema 10K as an individual from Rosario, Province of Santa Fe, Argentina. For any privacy question, email vegajoaquins@icloud.com.
2. Data we collect
a) Your Sistema 10K account
- Name, username and email address.
- Password: never stored in readable form; we only store a salted cryptographic hash (scrypt).
- Assigned plan, role (client or administrator), sign-up date, last login date and the date you accepted the Terms.
- If you subscribe: the email of your Mercado Pago account, your subscription status, plan, and the date, amount and status of each charge. We never receive or store your card details: Mercado Pago processes them.
- How many AI requests you use per month, to enforce your plan's limit.
- If you add it, your own Anthropic API key, stored encrypted.
b) Content you add to the platform
Story sequences, reference accounts, ideas, notes about your videos, assigned topics, conversations with the AI assistant, training instructions, posting calendar, goals and metrics you enter manually.
c) TikTok data (only if you connect your account)
The connection uses TikTok Login Kit and you authorize each permission on TikTok's official screen. Depending on the permissions granted we receive:
| Scope | Data |
|---|---|
user.info.basic | Account identifiers (open_id, union_id), avatar and display name. |
user.info.profile | Username, profile link, bio and verified status. |
user.info.stats | Follower, following, likes and video counts. |
video.list | For your public videos: ID, title, description, publish date, cover image, share link, duration and view, like, comment and share counts. |
We also receive from TikTok an access token and a refresh token, which we store encrypted and use only to read the data above. We do not access your messages, drafts, other people's data or any private information not listed above.
d) Instagram data (only if you connect a profile)
Through the official Instagram API (Meta), when you log in with Instagram and grant the instagram_business_basic and instagram_business_manage_insights permissions on Instagram's official screen (or with a token you generate and paste into the platform): ID, username, name, profile picture, account type, follower, following and post counts; and for your posts: caption, type, date, permalink, thumbnail, likes, comments and, if the token allows it, views, reach, saves and shares. The token is stored encrypted.
e) Google Drive
If you set up a public Google Drive folder for your stories, we read the names and IDs of the images in that folder. We do not access your Google account.
f) Technical data
- A session cookie required to keep you signed in (see Cookies).
- The IP address and username of failed login attempts, to block abusive attempts.
- Technical logs automatically generated by our hosting provider (for example IP address, date and path of each request, and errors), used to operate and protect the Service.
3. How we use your data
- To provide the Service: create and manage your account, authenticate you and show your profiles, metrics and videos on the dashboard.
- To track your growth: once a day we automatically sync connected profiles to store your follower and post history.
- To analyze your content: compute video rankings, performance by topic and your posting goal.
- AI features: when you use the AI chat, generators or analyses, we send the AI provider your request and the necessary context (for example metrics, video texts and your notes).
- Security: prevent unauthorized access, abuse and fraud, and keep the system secure.
- Communications: answer your questions and notify you of important changes to the Service or this Policy.
- Legal compliance and valid requests from authorities.
4. Legal bases
We process your data with your consent (given when you sign up, accept this Policy and authorize each TikTok or Instagram connection), because it is necessary to provide the Service you requested and, for security and abuse prevention, based on our legitimate interest in protecting the Service and its users. You can withdraw consent at any time by disconnecting your accounts or deleting your data, without affecting the lawfulness of prior processing.
5. Who we share data with
Only with the providers we need to run the Service, who process data on our behalf under their own policies:
| Provider | Role |
|---|---|
| Vercel Inc. | Hosting of the website and server functions. |
| Neon | Database storing accounts, connected profiles, metrics and content. |
| Mercado Pago (MercadoLibre S.R.L.) | Subscription billing. We send your email, plan and amount; Mercado Pago handles payment data under its own privacy policy. |
| Anthropic PBC | Processing of AI features, only when you use them. |
| TikTok and Meta (Instagram) | Source of your account data, through their official APIs and your authorizations. |
| Reading the public Google Drive folder you configure. |
We may also disclose data when required by law, court order or a competent authority, or to protect the rights, safety or property of the Service, its users or others. If the Service is transferred to a new owner, your data would be transferred under the same terms of this Policy and we would let you know.
6. International transfers
Our providers store data mainly on servers located in the United States and other countries that may not have data protection laws equivalent to Argentina's. By using the Service you consent to this transfer, which we carry out with providers that apply adequate technical and contractual safeguards.
7. How long we keep data
- Account and content: while your account is active. If you request deletion, we delete it within 30 days, except what we must keep by law.
- TikTok and Instagram tokens: until you disconnect the profile; on disconnection we delete them immediately (and, for TikTok, we also ask TikTok to revoke the access).
- Synced metrics history and videos: until you delete the profile from the platform or request deletion of your account.
- Failed login attempts: up to 24 hours. Sessions: up to 30 days or until you log out.
- Provider backups and technical logs: automatically overwritten within short periods of no more than 30 days.
8. Security
We use encrypted connections (HTTPS) across the site; store passwords with scrypt hashing; encrypt TikTok, Instagram and Anthropic tokens with AES-256-GCM before storing them; use HttpOnly and Secure session cookies; rate-limit login attempts; and each user can only access their own data. No system is infallible: if we detect an incident affecting your data, we will notify you and take appropriate action.
9. Your rights
You can exercise at any time your rights of access, rectification, update, deletion, objection and portability and withdraw your consent by emailing vegajoaquins@icloud.com from the address linked to your account. We answer access requests within 10 calendar days and rectification or deletion requests within 5 business days, as required by Argentine Law No. 25,326. Access is free of charge at intervals of no less than six months, unless a legitimate interest is shown.
Many actions can be done directly in the platform: correcting your name and password, disconnecting or deleting profiles and removing your AI key.
The Argentine Agency for Access to Public Information (AAIP), as the Control Body of Law No. 25,326, is empowered to handle complaints and claims filed by anyone whose rights are affected by non-compliance with personal data protection rules.
If you live in the European Economic Area, the United Kingdom or another jurisdiction granting additional rights, you can exercise them through the same channel and lodge a complaint with your local data protection authority.
10. How to revoke TikTok and Instagram access
- From Sistema 10K: in Conexiones (Connections) click Desconectar (Disconnect) on the profile — this deletes the token and, for TikTok, revokes access — or Eliminar (Delete), which also deletes that profile's stored history and videos.
- From TikTok: in the TikTok app's security and app permissions settings, remove Sistema 10K's access. From then on we can no longer read data from your account.
- From Instagram: in Instagram settings, under Apps and websites, remove the app's access.
More details in Data deletion.
11. Cookies and local storage
We use a single cookie, s10k, strictly necessary to keep you signed in (HttpOnly, Secure, up to 30 days). Your browser also stores your light or dark theme preference. We do not use analytics, advertising or third-party tracking cookies.
12. Children
The Service is intended for people aged 18 or older. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.
13. Changes to this Policy
We may update this Policy to reflect changes in the Service or the law. We will publish the new version on this page with its update date and, for material changes, notify you by email or in the platform before they take effect.
14. Contact
For any question, request or complaint about your data: vegajoaquins@icloud.com · Sistema 10K · Rosario, Santa Fe, Argentina.