Privacy Policy — AMASFLY Studio
DRAFT FOR REVIEW BY THE CEO'S HUMAN COUNSEL. Prepared by Carola (Legal Advisor, AMASFLY) on October 15, 2026. This is not final legal advice.
[[VARIABLE]]= pending CEO decision. English translation of the Spanish original; see section 17.
Version 0.2 (draft, adjusted for U.S. Customers) · Effective as of [[EFFECTIVE_DATE]]
This Policy explains how personal data is processed by AMASFLY Studio, a platform operated by AMASFLY S.R.L. It includes Annex A (Data Processing for Customers), Annex B (Subprocessors) and Annex C (Security Measures).
1. Who we are
- Legal name: AMASFLY S.R.L. · Tax ID (NIT): 330630021
- Address: El Trompillo Airport, Hangar 9, Santa Cruz de la Sierra, Bolivia
- Privacy contact: [[STUDIO_PRIVACY_EMAIL]]
2. Three distinct roles
The Studio processes data from three groups, and our role is different for each:
| Data | Whose | Our role | Who decides what it is used for |
|---|---|---|---|
| Account and billing data of the Customer and its users (name, email, job title, access logs) | The Customer's people | Controller | AMASFLY |
| Customer Content (logos, photos, videos, text) and Third-Party Data appearing in it | Customers, employees, residents, minors, etc. | Processor (we process on the Customer's behalf) | The Customer |
| Social media interactions (comments, direct messages, reactions, public names of followers) and metrics received from Meta | Followers and audience of the Customer's pages | Processor | The Customer |
For the second and third groups, the Customer is the data controller and is responsible for having the legal basis, notices and consents. What we agree with the Customer is in Annex A.
3. Legal framework
3.1. Bolivia. We process data in accordance with applicable Bolivian law, in particular the Political Constitution of the State (art. 21, no. 2: privacy, intimacy, honor, reputation, own image and dignity; and art. 130: privacy protection action), Law No. 164 on telecommunications and information and communication technologies, and Law No. 453 on the rights of users and consumers. As of the date of this draft, no general personal data protection law enacted in Bolivia has been found; a bill is under consideration (Bill No. 538/2025-2026, according to sources consulted) whose status must be confirmed with the official source before publication. Even so, we apply reasonable standards.
3.2. Customers and audiences outside Bolivia. If the Customer or the persons whose data we process are in the European Union, the United Kingdom, the United States or another jurisdiction, we additionally apply the commitments in Annex A (which follow the content of Article 28 of the GDPR and the service-provider requirements of applicable U.S. state laws) and, for Customers in the U.S., Annex D.
3.2.1. United States. There is no general federal privacy law; the FTC Act (what we promise here must be true) and state laws apply. Florida: the Florida Digital Bill of Rights (Fla. Stat. 501.701 et seq.) binds only "controllers" with more than US$ 1 billion in global gross annual revenue that also meet one of three conditions (50% or more of revenue from online advertising, a smart speaker with a virtual assistant, or an app store with 250,000 or more apps); on our information, neither AMASFLY nor small Florida Customers meet it, so we do not treat it as applicable [[counsel to confirm for each Customer]]. Other states have their own thresholds (for example, California requires revenue of US$ 26,625,000 or more since 1 Jan 2025, among other criteria; Texas exempts small businesses as defined by the SBA unless they sell sensitive data without consent). Whether or not they apply, we commit by contract (Annex A.14 and Annex D) to treat the data as a service provider. Florida's data breach law (Fla. Stat. 501.171) does apply to any business that holds personal information and to whoever processes it for another (section 12 and Annex A.16). (Note to counsel: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.702.html (definition of controller and processor); http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.715.html (sale of sensitive data, same set of persons); https://cppa.ca.gov/regulations/cpi_adjustment.html (CPPA, adjusted threshold); https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act (Texas AG); http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html. The text of other state laws and their application to small processors were not verified.)
3.3. Third-party platforms. The Customer and AMASFLY must comply with Meta's Platform Terms (which require, among other things, a public privacy policy, an explanation of how to request data deletion, and deletion of platform data when the user requests it or it is no longer needed), and with the usage policies of OpenAI and the other providers.
4. What data we process
From the Customer and its users: name, email, phone, job title, role in the Studio (Human Reviewer, alternate, editor), credentials (encrypted password), access and approval logs, billing data provided by Paddle (we do not store full card data).
From the Customer Content: logos, photos, videos, audio, text, brand data and the locations of the work shown. It may include images of persons (including minors), voices, homes and offices of third parties, vehicle license plates, documents and visible addresses. For that reason:
- The Customer must warrant that it has the rights and consents (Terms, clause 6).
- The Platform warns upon upload and applies automatic detection of faces, license plates and sensitive text to suggest blurring (technical spec).
- Data we do not want to receive: identity documents, health or financial data, identifiable minors without consent, or special categories of data. If they arrive, we block or delete them.
From Meta (through the connection authorized by the Customer): page and account identifiers, access tokens (encrypted), posts, metrics, and the content and public names of comments and direct messages received by the Customer's pages.
Usage and security: IP addresses, device, activity logs, moderation results and audit logs.
AI generation: instructions (prompts), references and results sent to AI providers, and the associated consumption.
5. What we use data for and on what basis
| Purpose | Basis |
|---|---|
| Providing the Studio to the Customer (generating pieces, calendar, publishing, advertising, reports, draft replies) | Performance of the contract; the Customer instructs us |
| Processing follower interactions to propose replies | Customer's instruction (controller); the Customer must have a legal basis |
| Billing and meeting tax obligations | Contract and legal obligation |
| Moderation, security, fraud and abuse prevention, reporting of crimes | Legitimate interest and legal obligation |
| Support and service improvement using aggregated or strictly necessary data (never the Customer's material) | Legitimate interest |
| Commercial communications to the Customer's users | Only with separate, optional consent |
6. Golden rule: one Customer's material belongs only to that Customer
6.1. Isolation. Each Customer has a separate workspace. Its material is not visible to or usable by other Customers.
6.2. No reuse. Customer Content, Third-Party Data, interactions and Generated Content are not used to produce another Customer's pieces, nor as examples, nor in portfolios or demonstrations, without the Customer's express written authorization.
6.3. No model is trained. AMASFLY does not train, fine-tune or improve its own or third-party AI models with Customers' material. We send material only to the providers in Annex B, to carry out the requested task. According to OpenAI's current documentation, data sent to its API is not used to train its models unless the customer expressly opts in. Video and voice providers are contracted and reviewed on the same standard (to be verified for each provider; see Annex B).
6.4. Minors' data and faces. Photos with identifiable persons are not sent to image or video generators unless the Customer confirms on the Platform that it holds the consent of those persons (or of their parents or guardians, in the case of minors). By default, identifiable minors are blocked from generation and publication.
7. Who we share data with (subprocessors)
List in Annex B. We do not sell personal data or use it for third-party advertising. We share only with: the subprocessors in Annex B; the authorities, when the law requires; and whoever the Customer designates.
8. International transfers
8.1. Data of people in the U.S. processed from Bolivia. The Studio is operated from Bolivia: AMASFLY personnel (technical support and compliance review) may access, remotely and with logging, data of U.S. followers and prospects hosted by our subprocessors in the U.S. (Annex B). We will not transfer that data to countries that the U.S. Department of Justice designates as "of concern", nor to persons or systems located in them [[Counsel and CEO: see the note on Kling]]. The transfer is covered by this section, Annex A (A.13 and A.14), Annex D and each subprocessor's terms. (Note to counsel: no general U.S. rule restricting sending personal data to Bolivia was found. The Department of Justice rule on bulk sensitive data (28 CFR Part 202) designates six countries of concern: China, Cuba, Iran, North Korea, Russia and Venezuela; Bolivia is not listed (https://www.ecfr.gov/current/title-28/part-202/section-202.601). Alert: Kling belongs to Kuaishou (China) and is used through Higgsfield with the Customer's account; where the data is processed was not verified. Meanwhile, do not send to video any images of identifiable people (already blocked by default, section 6.4) or follower data.)
8.2. Our providers operate mainly in the United States and other countries. We apply contracts and reasonable safeguards. For EU or UK customers, transfers rely on the applicable GDPR Chapter V mechanisms (for example, standard contractual clauses or the EU–U.S. Data Privacy Framework, depending on the provider). [[Counsel: confirm mechanisms per provider.]]
9. How long we retain data
[[CEO: the periods below are Carola's proposal; confirm or change.]]
| Data | Proposed period | What happens afterward |
|---|---|---|
| Customer Content (photos, videos, logos) and Generated Content | For the duration of the contract + [[30]] days Exit Period | Deletion; backups up to [[30]] more days |
| Approved and published Pieces (Customer's archive) | Same as above | Same |
| Comments and direct messages from followers | [[12]] months from receipt | Deletion or anonymization; sooner if the follower or the Customer asks for deletion |
| Meta tokens | Until revocation or end of the contract | Immediate revocation and deletion |
| Moderation results and audit log (without unnecessary personal content: ID, date, category, decision, deciding user) | [[24]] months | Deletion |
| Account and billing data | For the duration of the contract + [[5]] years for tax and accounting records [[Counsel: confirm the Bolivian legal period]] | Deletion |
| Security logs (IP, access) | [[12]] months | Deletion |
| Material reported as child sexual abuse and its records | Preserved in isolated, encrypted form for the period required by the authority or the law (U.S. law requires providers to preserve content reported to NCMEC for 1 year, following the 2024 reform) | Handed over or deleted only by order of the authority |
| Records under legal hold | The legal period | Deletion |
AI providers apply their own technical retention periods (for example, OpenAI retains abuse-monitoring logs for up to 30 days by default). See Annex B.
10. Individuals' rights
10.1. Anyone who appears in the Customer's material, or interacts with the Customer's pages, may request access, rectification, deletion, objection or restriction of their data, and may bring the constitutional privacy protection action in Bolivia. If you are in the EU, the UK or California, you also have the rights your law gives you.
10.2. How to exercise them. Write to [[STUDIO_PRIVACY_EMAIL]]. Because we are processors of the Customer's data, we will forward your request to the Customer (who decides) and will help it respond within [[15]] business days. For account and billing data, we respond directly.
10.3. Deletion of Meta data. To comply with Meta's terms, we offer a simple way to request deletion of the data we receive from Meta about you: [[STUDIO_DATA_DELETION_URL]]. We handle the request without delay and confirm in the manner Meta establishes.
10.4. Removing a post. If you appear in a post made by the Studio without your consent, write to [[ABUSE_EMAIL]]; we remove it immediately once verified and notify the Customer.
11. Minors
The Studio is not directed at minors. The Customer must not upload material with identifiable minors without the consent of their parents or guardians, and the Platform blocks such cases by default. We do not knowingly collect data of minors among followers; if we receive it from Meta, we treat it as Customer data and delete it if the Customer so requests.
12. Security
We apply the measures in Annex C. If a security breach affecting personal data occurs, we notify the Customer without undue delay and, at most, within [[48]] hours of becoming aware, and in any case within the shortest legal period that applies to us, so that it can meet its own deadlines (for example, the GDPR requires the controller to notify the authority within 72 hours, where feasible; Florida law requires a third-party agent to notify as soon as practicable and no later than 10 days after determining or having reason to believe a breach occurred, and requires the covered entity to notify affected individuals within 30 days and, if 500 or more Floridians are affected, the Department of Legal Affairs). (Note to counsel: http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html.)
13. Artificial intelligence
The Studio is a SaaS platform with AI agents: pieces, campaigns and drafts are generated by the Platform's agents, and the Customer (or the authorized user of its account, the Human Reviewer) reviews and approves before publication. No AMASFLY personnel write or design on the Customer's behalf; only technical support and compliance review of flagged cases. We do not make automated decisions with legal effects on individuals. We may label AI-generated content, as Meta requires.
14. Cookies and analytics
The Platform uses strictly necessary cookies and [[minimal analytics: yes/no]]. We do not use third-party advertising cookies.
15. Changes
We will announce material changes at least [[15]] days in advance. The current version will always be at [[URL]].
16. Contact
[[STUDIO_PRIVACY_EMAIL]] · AMASFLY S.R.L., El Trompillo Airport, Hangar 9, Santa Cruz de la Sierra, Bolivia.
17. Languages and versions
This Policy exists in Spanish and English. If there is any discrepancy between the two versions, the version indicated in clause 25.4 of the Terms prevails [[CEO DECISION]]. AMASFLY S.R.L. is a Bolivian company.
Annex A — Data Processing for Customers (processor agreement)
This Annex forms part of the contract between AMASFLY (the "Processor") and the Customer (the "Controller") and applies to the personal data we process on the Customer's behalf in the Studio.
A.1 Subject matter, duration, nature and purpose. Hosting, processing, transforming with AI, moderating, displaying to the Human Reviewer, publishing on Meta, managing advertising, reporting and proposing replies, solely to provide the Studio, during the contract and the Exit Period.
A.2 Types of data and data subjects. Data from the Customer Content and interactions (section 4); data subjects: end customers, residents, employees, minors, followers, audience of the pages.
A.3 Instructions. AMASFLY processes data only on the Customer's documented instructions (the contract, the Platform configuration and the Human Reviewer's approvals). If an instruction appears to infringe the law, we notify the Customer immediately.
A.4 Confidentiality. Authorized personnel are bound by confidentiality. Access is on a least-privilege basis and logged.
A.5 Security. Measures in Annex C.
A.6 Subprocessors. The Customer gives general authorization for the subprocessors in Annex B. We will give [[15]] days' notice of any addition or replacement; the Customer may object on reasonable grounds and, if unresolved, terminate the contract. We impose equivalent obligations on each subprocessor and remain liable to the Customer for them.
A.7 Data subject rights. We assist the Customer in responding to requests for access, rectification, deletion, objection, restriction and portability, and forward those we receive.
A.8 Security breaches. We notify the Customer without undue delay and within the period in section 12, with the information available so that it can meet its obligations.
A.9 Assistance. We assist the Customer with impact assessments, consultations with authorities and security measures, to a reasonable extent.
A.10 Return and deletion. Upon termination of the contract, and as the Customer elects, we return (export during the Exit Period) and then delete all data and copies, except those the law requires us to retain (section 9).
A.11 Audit. We make available to the Customer the information necessary to demonstrate compliance and allow reasonable audits, with advance notice, once a year, at the Customer's expense, subject to confidentiality.
A.12 Customer (controller) obligations. The Customer: (a) has a legal basis and, where applicable, consents for the data to be processed, including Third-Party Data; (b) informs individuals (privacy notice on its pages and posts); (c) does not upload prohibited categories of data (section 4); (d) designates within its account the users who act as Human Reviewer (who belong to the Customer); (e) responds to data subjects' requests.
A.13 International transfers. The Customer authorizes transfers to the subprocessors in Annex B and the remote access from Bolivia by AMASFLY personnel (section 8.1). For Customers subject to the GDPR, the parties will agree on standard contractual clauses or the equivalent mechanism when necessary. [[Counsel]]
A.14 U.S. rules. For Customers subject to U.S. state privacy laws (such as California's), AMASFLY acts as a service provider / processor: it does not sell or share personal data, does not retain, use or disclose it outside the purpose of the contract or outside the direct relationship with the Customer, does not combine it with data from other customers, imposes equivalent obligations on its subprocessors, notifies the Customer if it can no longer meet the applicable law, and allows the Customer to take reasonable steps to stop and remediate unauthorized use. [[Counsel: confirm the terms required by each relevant state law.]]
A.15 Liability. Subject to the limits in the Terms, except where the law does not permit limitation.
A.16 Incidents under Florida law. Notice to the Customer follows section 12. The Customer (as the "covered entity") decides and carries out the notices to affected individuals and the authority; AMASFLY cooperates with the information it has.
Annex B — Subprocessors
[[Initial list proposed by Carola based on what was stated in the engagement; Development must confirm it before publication. Region data and terms: to be verified.]]
| Subprocessor | Purpose | Data received | Country / region | Terms notes |
|---|---|---|---|---|
| Cloudflare, Inc. | Platform hosting, database, file storage, task queue, security | All stored Customer Content; metadata | U.S. and global network [[confirm data region]] | Infrastructure provider |
| OpenAI, L.L.C. | Generation of images, text and voice; moderation | Prompts, images and text sent per task | U.S. [[confirm project data region]] | Per its documentation, data sent via API is not used for training by default; abuse-monitoring logs are retained up to 30 days by default; the moderation endpoint does not generate monitoring retention and is free |
| Higgsfield / Kling (Kuaishou) | Video generation | Reference images, prompts and videos | [[to be verified]] | Acts through the Customer's own Higgsfield account, under the terms the Customer accepts with Higgsfield; AMASFLY does not bill this service. Retention and training terms not verified. Until verified, do not send sensitive material (technical spec, section 8) |
| Meta Platforms, Inc. (Facebook, Instagram) | Publishing, advertising, metrics, comments and messages | Published content, interactions | U.S. and global | Also an independent third party with its own policies toward users |
| Paddle.com Market Ltd. (merchant of record) | Billing of the monthly fee and overage; taxes; receipts | Billing and payment data | UK / EU / global | Registered seller of the subscription and treats payment data as an independent controller |
| AMASFLY S.R.L. (Bolivia) | Platform operation, technical support and compliance review | Remote, logged access to the data hosted by the subprocessors | Bolivia | It is the processor; see section 8.1 |
| Transactional email provider [[confirm which]] | Notices and reminders to the Human Reviewer | Email and name | [[to be verified]] | |
| Synthetic voice provider [[if an external one is used; local voice requires no subprocessor]] | Narration | Script text | [[to be verified]] |
Annex C — Security Measures
- Logical isolation per Customer across all data and files (organization key on every record; automated isolation tests).
- Encryption in transit (TLS) and at rest; Meta tokens and API keys encrypted and not visible to AMASFLY personnel.
- Authentication with email verification, attempt limits and two-factor authentication for AMASFLY's team and for the Human Reviewer. [[CEO: two-factor for the Human Reviewer is a recommendation]]
- Least privilege and logging of personnel access; access to a Customer's material only for technical support or compliance review, with logging.
- Immutable audit log of approvals, publications, spend and moderation.
- Encrypted backups with a defined deletion period.
- Incident response procedure and child abuse material procedure (Acceptable Use Policy and technical spec).
- Periodic review of subprocessors.
Annex D — Addendum for Customers domiciled in the U.S.
[[Draft for counsel. Supplements Annex A; in case of conflict, this Annex prevails for U.S. Customers.]]
D.1 Roles. The Customer is the business that decides what the data of its followers, prospects and customers is used for; AMASFLY is its service provider / processor.
D.2 Use limits. AMASFLY does not sell or share that data, does not use it for its own or third-party advertising, does not combine it with data from other Customers and uses it only to provide the Studio.
D.3 Where it is and who accesses it. The data is hosted by subprocessors in the U.S. (Annex B) and AMASFLY personnel access it remotely from Bolivia (section 8.1). It is not transferred to countries of concern designated by the U.S. Department of Justice.
D.4 Marketing messages to the Customer's customers. The Studio does not send marketing SMS, calls or emails to the Customer's customers or prospects. If it is offered in the future, a prior addendum will be required and, before any list is loaded, proof of written consent from each recipient, respect for calling hours and opt-outs, and compliance with the TCPA, Florida's telemarketing law and CAN-SPAM (Acceptable Use Policy, section 4.8). Replying on Meta (comments and direct messages) to someone who wrote first is not a marketing send by SMS.
D.5 Consumer requests. We forward to the Customer the requests we receive within [[10]] business days and help it respond.
D.6 Incidents. Section 12 and Annex A.16.
D.7 Note. The Customer, as controller, keeps its own privacy notice where the applicable state law requires it.
Draft — pending final legal review