Privacy Policy
1. Who we are
Sisifo is an online platform for marketing agencies that brings together social media and website analytics for their clients, a leads manager, alerts and reports. The service is operated by:
- Controller: Kent Keybert Fórnica
- Address: Caracas, Venezuela
- Contact and privacy email: kent@ky-3d.com
- Website: https://legal.ky-3d.com
"We" means Kent Keybert Fórnica; "agency" means the company that subscribes to Sisifo; "user" means each person with an account on the platform; and "agency client" means the brands or businesses whose accounts the agency manages.
2. Our role for each type of data
- Platform users' data (name, email, password): we are the controller.
- Data the agency enters or collects about its clients (client records, contacts, leads, website form data, metrics from connected accounts): the agency is the controller and we act as a processor on its instructions. The agency must have a legal basis to process it and, where applicable, inform data subjects (for example, through a privacy notice on the website where the pixel is installed).
3. Data we process
3.1 Account data
- Name, email address and password (stored only as a hash, never in plain text).
- If you sign in with Google: your Google account name, email and profile picture.
- Preferences such as language, the agency you belong to and your role.
3.2 Data entered by the agency
- Client details: brand name, industry, country, website, brand color, notes and tags.
- Contact details of people at those companies (name, email, phone, job title).
- Manually entered leads, notes, activity history, alert rules and report settings.
3.3 Data from accounts connected by the agency's clients
When an account owner (for example, of a Google account or a business page on social media) authorizes the connection via OAuth, we obtain read-only access to:
- The ID, name and email of the authorizing account.
- Aggregated performance metrics: followers, reach, impressions, engagements, views, visits, sessions, conversions, search clicks and impressions, among others.
- The account's posts and their metrics (text, type, date, link and thumbnail).
- Access and refresh tokens, stored encrypted.
We do not read private messages, publish content or change any settings in connected accounts.
3.4 Web analytics pixel data
If the agency installs the Sisifo pixel on its client's website, visits to that site are recorded without cookies:
- Page visited, referring page, campaign parameters (UTM) and time on page.
- Device type, browser, operating system and, when provided by the network provider, approximate country.
- A daily anonymous identifier: a code derived from the IP address and browser, combined with a random key that changes every 24 hours. The IP address is not stored and the identifier cannot recognize the same person across days.
- A session identifier kept in the browser's session storage, deleted when the tab is closed.
- The pixel honors "Do Not Track" and "Global Privacy Control": if the browser sends them, nothing is recorded.
Forms: only if the agency enables this option, when a visitor submits a form on that site the submitted fields (e.g., name, email, phone and message) are recorded to create a lead. Password, payment card and identity document fields are never recorded. The agency is responsible for disclosing this in that site's privacy notice.
3.5 Technical and security data
Server logs (IP address, browser, date and requested page) to prevent abuse, debug errors and protect the service.
4. How we use data
- To provide the service: dashboards, daily metric syncs, alerts, reports and exports.
- To manage accounts, teams, roles and access.
- To send service communications: invitations, alerts, expired-connection notices and reports.
- To keep the service secure, prevent fraud and abuse, and comply with legal obligations.
- To handle support and data subject requests.
We do not sell personal data, use it for advertising, or use it to train artificial intelligence models.
5. Data obtained from Google APIs
Sisifo requests the following Google permissions, always read-only and only when the account owner explicitly grants them:
| Scope | How we use it |
|---|---|
openid, email, profile | Identify the connected Google account or the account you sign in with. |
analytics.readonly | List the Google Analytics 4 properties the account can access and read aggregated daily metrics (users, sessions, page views, bounce rate, duration and conversions) for the selected property. |
webmasters.readonly | List the account's Google Search Console sites and read daily clicks, impressions, CTR and average position for the selected site. |
Sisifo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we use Google user data only to display these metrics to the relevant agency and client within Sisifo; we do not transfer it to third parties except to infrastructure providers needed to provide the service, as required by law, or for security purposes; we do not use it for advertising; we do not sell it; and no human reads it unless the user has given explicit consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymized for internal operations.
6. Data from Meta, TikTok, LinkedIn and YouTube
When these integrations become available, the same principles apply: read-only access to the business pages and accounts the owner authorizes, limited to performance metrics and posts, in accordance with each platform's terms (Meta Platform Terms, TikTok Developer Terms, LinkedIn API Terms and YouTube API Services Terms of Service). Use of YouTube API Services is also subject to the Google Privacy Policy.
7. Cookies and local storage
On the platform we only use strictly necessary cookies:
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token, better-auth.session_data | Keep you securely signed in. | Up to 14 days |
NEXT_LOCALE | Remember your language. | 1 year |
sisifo_oauth_state | Protect the external account connection flow. | 10 minutes |
We do not use advertising or third-party analytics cookies. The pixel installed on client websites does not use cookies.
8. Who we share data with
- Service providers (processors) bound by contract to protect the data: Amazon Web Services (hosting, databases and email delivery).
- Connected platforms (Google, Meta, TikTok, LinkedIn): only to request the data the owner authorized; we do not send them platform data.
- Within the agency: agency members see data according to their role; agency clients with read-only access see only their own data.
- Authorities: when required by law or court order.
- Corporate transactions: in a merger or sale, data may be transferred to the successor, who will be bound by this policy.
9. International transfers
Our servers are located in the United States (Amazon Web Services). By using Sisifo, data is transferred to and stored there. We apply appropriate safeguards — contracts with our providers, encryption and access controls — to ensure a level of protection equivalent to that required by your country's law.
10. How long we keep data
| Data | Retention |
|---|---|
| User account | While the account is active. |
| Agency data and aggregated daily metrics | While the agency keeps its account, to allow period comparisons. |
| Individual pixel events | 13 months; afterwards only daily totals are kept. |
| Connected account tokens | Until the account is disconnected or access is revoked. |
| Server logs | 30 days. |
| Backups | Up to 35 days. |
When an agency closes its account or requests deletion, we delete its data within 30 days, and it disappears from backups when their rotation cycle completes.
11. Security
- Encrypted connections over HTTPS.
- External account access tokens encrypted with AES-256-GCM, never sent to the browser.
- Passwords stored as hashes.
- Strict data separation between agencies and role-based access control.
- Regular backups and restricted infrastructure access.
No system is completely infallible. If we detect a security breach affecting your data, we will notify you and the competent authorities as required by law.
12. Your rights
Under applicable law — including the right of habeas data in Article 28 of the Constitution of Venezuela, Colombia's Law 1581 of 2012, Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, Peru's Law 29733, Argentina's Law 25,326, Chile's Law 19,628 and Brazil's General Data Protection Law (LGPD) — you may:
- Access your data and learn how we process it.
- Correct inaccurate or incomplete data.
- Delete your data when it is no longer needed.
- Object to certain processing or withdraw your consent.
- Request portability of your data in a structured format.
- File a complaint with your country's data protection authority.
To exercise them, email kent@ky-3d.com with your name, the right you want to exercise and a way to verify your identity. We will respond within the time limits set by your country's law and, in any case, within 15 business days.
If your data was entered by an agency (for example, you are a lead or a contact of one of its clients), you may contact that agency, which is the controller; you may also write to us and we will forward your request.
13. How to revoke access to your accounts
- In Sisifo: in the client's settings, click "Disconnect". We revoke the permission on the platform and stop importing data.
- Google: at myaccount.google.com/permissions, remove Sisifo's access.
- Meta (Facebook and Instagram): in Settings → Security → Business Integrations, remove Sisifo.
- To also delete already imported data, follow the data deletion instructions.
14. Children
Sisifo is a business service not directed at anyone under 18. We do not knowingly collect children's data on the platform.
15. Changes to this policy
We may update this policy to reflect changes in the service or the law. We will post the new version on this page with its date and, for significant changes, notify you by email or in the platform before they take effect.
16. Contact
For any questions about this policy or your data: kent@ky-3d.com · Kent Keybert Fórnica, Caracas, Venezuela.