Worgam Privacy Policy
This English version is provided for convenience only. In case of any discrepancy, the Spanish version shall prevail as the legally binding text.
- Version: 1.0
- Last updated: 13 April 2026
- Scope: users of the Worgam service (worgam.com) worldwide, with specific GDPR provisions for users residing in the European Economic Area.
1. Data Controller
In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, "GDPR") and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and guarantee of digital rights ("LOPDGDD"), the Data Controller is:
- Holder: Jose Manuel Guerrero (natural person, self-employed / autonomo)
- Commercial name: Worgam
- Tax ID (NIF): 71427380Y
- City: Leon, Spain
- Commercial Registry details: Not applicable — natural person (self-employed). Registered with the Spanish Tax Agency (Agencia Tributaria) and the Social Security Special Regime for Self-Employed Workers (RETA).
- Contact email:
[email protected] - Website: https://worgam.com
For the holder's privacy, the full postal address is not published in this document. Users needing to send certified postal communications may request the address in writing at
[email protected].
1.1 Data Protection Officer (DPO)
No Data Protection Officer has been appointed. Pursuant to Article 37 GDPR and Article 34 of the Spanish LOPDGDD, Worgam does not meet any of the mandatory appointment criteria: the Data Controller is not a public authority, does not carry out regular and systematic large-scale monitoring of data subjects, and does not process special categories of data on a large scale. Any data protection queries may be addressed directly to [email protected].
2. Purposes of processing and legal basis
Worgam processes personal data exclusively for the following purposes, each one grounded on a specific legal basis under Article 6 GDPR:
| # | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| 1 | Creation and management of the user account (registration, authentication, password recovery). | Performance of a contract (Art. 6(1)(b)). |
| 2 | Provision of the service: OAuth connection to social networks, reading of the user's own public metrics, calculation of the Account Score and of the estimated economic value of the account. | Performance of a contract (Art. 6(1)(b)). |
| 3 | Subscription and billing management through Stripe. | Performance of a contract (Art. 6(1)(b)) and compliance with legal tax and accounting obligations (Art. 6(1)(c)). |
| 4 | Sending transactional emails (welcome, score ready, campaign matches, subscription changes). | Performance of a contract (Art. 6(1)(b)). |
| 5 | Marketing and product news communications. | Consent of the data subject (Art. 6(1)(a)), revocable at any time. |
| 6 | Security, fraud prevention and audit logging (audit_log, user_sessions). |
Legitimate interest of the controller (Art. 6(1)(f)). |
| 7 | Internal aggregated product analytics and service improvement. | Legitimate interest (Art. 6(1)(f)), preferably using pseudonymised or aggregated data. |
| 8 | Marketplace management: intermediation between creators and brands, commission processing and payments via Stripe Connect. | Performance of a contract (Art. 6(1)(b)). |
| 9 | Error monitoring and service stability through incident tracking tools. | Legitimate interest of the controller (Art. 6(1)(f)) to ensure service quality and security. |
| 10 | Compliance with legal, judicial or administrative requests. | Legal obligation (Art. 6(1)(c)). |
Worgam does not process any special categories of data (health, ethnicity, religious beliefs, sexual orientation, biometric or political data) and does not take automated decisions with legal effects on the user within the meaning of Art. 22 GDPR. The Account Score and estimated economic value are informational only and produce no legal effect on the data subject.
3. Categories of data processed
3.1 Identification and account data
- Email address (mandatory).
- Name or display name (optional).
- Password, stored exclusively as a cryptographic hash (never in plaintext).
- Avatar URL.
- Language, timezone and user role.
- Sign-up, last login, email verification and soft-delete timestamps.
3.2 Connection and security data
- Session identifiers.
- IP address, user agent, approximate country inferred from IP.
- Event logs (pages visited, actions taken).
- Audit log (
audit_log) of sensitive operations performed on the account.
3.3 Connected social-media account data
When the user authorises Worgam to connect one or more of their Instagram, YouTube or Facebook accounts, Worgam receives and stores via OAuth 2.0:
- Platform account identifier (
platform_account_id). - Username, display name, profile picture, biography and associated website.
- Public metrics: followers, following, number of posts.
- OAuth tokens (access and, where applicable, refresh) stored encrypted and used exclusively to request further data from the user on official APIs.
- Aggregated content metrics: likes, comments, shares, saves, reach, impressions, watch time, engagement rate.
- Aggregated and anonymised audience demographics (age ranges, gender, top countries) only where the platform exposes them to the account owner and never at an identifiable individual-follower level.
OAuth scopes requested:
- Instagram (Meta):
instagram_business_basic,instagram_business_manage_insights. Only Business or Creator accounts are supported. Worgam never publishes content or sends messages on behalf of the user. - Facebook (Meta):
public_profile,pages_show_list,pages_read_engagement,pages_read_user_content,read_insights. Only Facebook Pages managed by the user are connected; personal profiles are not processed. - YouTube (Google):
youtube.readonly,yt-analytics.readonly,userinfo.profile. Read-only access; Worgam never modifies, uploads, deletes or publishes videos.
3.4 Billing data
- Stripe customer identifier (
stripe_customer_id). - Subscription plan, status, invoiced amounts, payment history, invoice IDs.
- Marketplace transaction data processed via Stripe Connect (amounts, commissions, connected account identifiers).
- Worgam never stores full card details on its systems. Card data is processed directly by Stripe.
3.5 Service-derived data
- Scores (Account Score, Growth Score, Engagement Score, etc.) computed by Worgam.
- Estimated economic value per content format and per month.
- Growth predictions and recommendations generated by Worgam's algorithms.
4. Recipients and processors
Worgam relies on technology providers acting as data processors in the sense of Article 28 GDPR, under written processing agreements:
| Provider | Purpose | Location | Privacy policy |
|---|---|---|---|
| Hetzner Online GmbH | Hosting (servers and database) | Germany and/or Finland (EU/EEA) | https://www.hetzner.com/legal/privacy-policy |
| Stripe Payments Europe, Ltd. | Payment processing, subscription management and Stripe Connect (marketplace) | Ireland (EU), with onward transfers to Stripe Inc. (USA) | https://stripe.com/privacy |
| Resend, Inc. | Transactional and marketing email delivery | United States | https://resend.com/legal/privacy-policy |
| Meta Platforms Ireland Ltd. | Instagram and Facebook OAuth API | Ireland (EU) and USA | https://www.facebook.com/privacy/policy |
| Google Ireland Ltd. | YouTube and Google OAuth API | Ireland (EU) and USA | https://policies.google.com/privacy |
| Cloudflare, Inc. | CDN, firewall and DDoS protection | Global, with EU presence | https://www.cloudflare.com/privacypolicy/ |
| Functional Software, Inc. (Sentry) | Error monitoring and application stability | United States | https://sentry.io/privacy/ |
Worgam does not sell or share personal data with third parties for commercial purposes. Communication to processors is strictly limited to what is necessary to operate the service.
Worgam may also disclose data to competent public authorities (tax authorities, law enforcement, courts) when required by law.
5. International data transfers
Some of the processors above (Stripe, Resend, Cloudflare, Meta, Google and Sentry) may process personal data outside the European Economic Area, notably in the United States. To guarantee an adequate level of protection, Worgam relies on the transfer mechanisms laid down in Chapter V GDPR:
- EU-US Data Privacy Framework adequacy decision of 10 July 2023, for US providers certified under the DPF.
- Standard Contractual Clauses (SCCs) adopted by Commission Implementing Decision (EU) 2021/914, where the provider is not DPF-certified.
- Additional technical and organisational safeguards (encryption in transit and at rest, pseudonymisation where possible).
The user may request a copy of the safeguards in place by writing to [email protected].
6. Retention periods
| Data | Retention |
|---|---|
| User account data | As long as the account remains active. Upon deletion request, logical deletion is immediate and physical deletion occurs within 30 days. |
| Social-media OAuth tokens | Until the user disconnects the account, revokes the permission at the platform, or deletes their Worgam account. |
| Historical social-media metrics | As long as the user account remains active. |
| Billing and accounting records | 6 years from invoice issuance (Spanish Commercial Code Art. 30 and General Tax Act Art. 66). |
| Audit and security logs | 12 months, unless longer retention is legally required or necessary to defend against claims. |
| Transactional email metadata (Resend) | 12 months. |
| Marketing consents | Until revoked by the user; proof of revocation is kept for 3 years. |
| Marketplace transaction data | 6 years in accordance with tax and accounting obligations. |
7. Data subject rights
Under Articles 15 to 22 GDPR and Articles 12 to 18 LOPDGDD, users have the right to:
- Access their personal data.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten").
- Object to processing based on legitimate interest or direct marketing.
- Restrict processing in the cases provided for by law.
- Data portability.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
- Not be subject to automated decision-making with legal effects (Art. 22 GDPR).
How to exercise these rights
- Through the in-app account settings: "Export my data", "Disconnect account" and "Delete my account" options.
- By email to
[email protected], attaching proof of identity and stating clearly the right being exercised. - By postal mail to the address indicated in Section 1.
Worgam will respond within one (1) month, extendable by two additional months for complex requests (Art. 12(3) GDPR).
Complaint to a supervisory authority
Users may lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: https://www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
- Phone: +34 901 100 099 / +34 912 663 517
Users residing in another EEA country may lodge a complaint before their local supervisory authority.
8. Security measures
Worgam implements appropriate technical and organisational measures in accordance with Art. 32 GDPR:
- TLS 1.2/1.3 encryption in transit on all client-server communications.
- Encryption at rest for OAuth tokens and passwords (bcrypt or equivalent).
- Least-privilege access control.
- Regular encrypted backups with retention policy.
- Audit logging of sensitive operations.
- Perimeter protection via Cloudflare WAF and DDoS mitigation.
- Environment segregation (development, staging, production).
- Error monitoring via Sentry for rapid detection and resolution of technical incidents.
- Breach notification procedure under Arts. 33 and 34 GDPR (AEPD notification within 72 hours and data subject notification where high risk exists).
9. Minors
Worgam is not directed at children under 16 years of age. Under Art. 8 GDPR, Worgam does not knowingly collect personal data from minors below that age. If a parent or legal guardian becomes aware that a minor has provided personal data without authorisation, they may request immediate deletion at [email protected].
10. Cookies
For the use of first- and third-party cookies, please consult the Cookie Policy at https://worgam.com/cookies.
11. Changes to this Policy
Worgam may update this Privacy Policy from time to time. Material changes will be communicated with reasonable advance notice by email and/or through a prominent in-app notice. The current version is always available at https://worgam.com/privacy.
12. Governing law
This Policy is governed by Spanish law and by the GDPR and LOPDGDD in particular.
Document updated 13 April 2026 — version 1.0. Spanish version prevails in case of discrepancy.