Privacy Policy
021flow (“we”) operates cewebro (cewebro.com), a tool for running virtual-character social media accounts. cewebro is an internal tool used by its operator; it does not offer sign-up to the public. This policy explains what personal information we handle and how you can exercise your rights.
1. What we process and why
| Who | Data | Purpose | Legal basis |
|---|---|---|---|
| The operator (console user) | Google account email, sign-in records | Console sign-in and access control | Contract |
| Social accounts the operator connects | Platform-issued credentials (access/refresh tokens; app passwords for Bluesky), account IDs and usernames, Mastodon/Bluesky server addresses, post IDs and metrics (views, likes, votes, comment counts), follower counts | Publishing to Instagram, Threads, X, Reddit, Bluesky and Mastodon, and planning the next posts from performance | Contract |
| People who comment on our characters’ posts | Comment text, commenter username, comment ID and time, an AI summary of the comment’s tone and intent | Replying to comments on our own posts and showing reactions to the operator | Legitimate interests (GDPR Art. 6(1)(f); PIPA Art. 15(1)(6)) — only comments already made public on our own posts |
| People on Reddit who call a bot-mode character by u/username or reply to its comment | That comment’s text, username, comment ID and time, where the conversation is (community, post title, the comment just above), and “!optout” requests (stored as a hash instead of the username) | Posting a human-reviewed reply to the person who called the character, and not replying again to people who asked us to stop | Legitimate interests (GDPR Art. 6(1)(f); PIPA Art. 15(1)(6)) — only public comments that call the character directly; we do not go looking for posts |
| People who click a post link (cewebro.com/r/…) | Click time and the country code supplied by Cloudflare | Measuring traffic by region | Legitimate interests — we do not store IP addresses, cookies, device data or city-level location |
| Site visitors | IP address (held up to 10 minutes for rate limiting), requested URL and time | Blocking abusive traffic and keeping the service secure | Legitimate interests |
| Privacy requesters | Email, platform/account information, request details, identity review and outcome | Verifying identity and handling rights requests | Handling rights requests |
| Contributors who permit content reuse | Operator-entered label, original and consent-proof URLs and hashes, allowed channels, locales, edits, derivatives, dates, withdrawal instructions and review records | Checking reuse permission and withdrawals | Contribution permission and rights verification |
When posting to a Reddit community we read and keep its public description and rules for one day. Product integrations send us aggregated counts by country and source only, never data that identifies a person. The operator separately registers permitted contribution originals and evidence; we do not automatically harvest arbitrary users’ posts or profiles.
2. Retention and deletion
| Data | Kept for |
|---|---|
| Social account credentials | Deleted immediately when the account is disconnected or access is revoked on the platform |
| Activity records (including sign-ins) | 90 days |
| Post metric and follower observations | 100 days |
| Commenter usernames, comment text and analysis summaries | Deleted automatically 180 days after collection; unsent reply drafts expire too. Reply history, replies already sent and aggregate tone counts remain. An in-flight request has up to 15 minutes for delivery-state recovery before the next cleanup removes the source text, while preserving delivery uncertainty. Earlier erasure is available on request after verifying identity. For Reddit bot mode, the conversation context (post title, comment just above) is deleted at the same time. |
| Reddit bot mode “!optout” requests | Kept only as a hash, not the username, until withdrawn with “!optin”, so we can keep the promise not to reply again. Erased on request after verifying identity. |
| Link clicks | 180 days |
| IP addresses for rate limiting | Up to 10 minutes |
| Our characters’ posts and their metrics | Deleting a character removes unpublished drafts and scheduled items. Published records and media need separate review; original platform posts are not automatically deleted. |
| Rights request records | Kept while processing; scheduled for automatic deletion 90 days after completion. |
| Contribution originals and consent evidence | Kept as needed to verify permission and withdrawal scope. No automatic blanket expiry is configured; deletion requests require reviewing originals, derivatives and reasons to retain evidence. |
| Database backups (operating machine and separate machine) | Created daily and kept for 14 days on the operating machine; an encrypted copy including media is kept on a separate machine (latest 7). Older backups of these two kinds are deleted automatically. |
| NAS asset copies | Images, videos and contribution originals are kept as encrypted versions separately from the database and offsite recovery copies above. No retention period has been set yet, so these copies do not expire automatically and the automatic deletion of the database backups above does not apply to them. Withdrawal or erasure requests require a separate review of the originals, derivatives and copies, their retention basis and the scope of erasure. |
Database cleanup runs periodically, so expiry is not immediate. Information removed from live storage may remain in backups or on external platforms and needs separate review. If data is restored from a backup, erasure and correction requests completed after that backup are applied again to the restored data before operation resumes. Credentials and rights-request details are encrypted at rest.
3. Sharing
We do not sell or share personal information with third parties, except where required by law.
4. Service providers and international transfers
We use the following providers. Their retention and reuse depend on the applicable contracts, API settings and policies. Personal information someone includes in a comment may be sent as part of the comment text.
| Recipient (country) | Purpose | Data | When / how |
|---|---|---|---|
| Anthropic, PBC (USA) | Drafting posts and replies, analysing comments | Comment text and post context (stored commenter usernames and account IDs are not added separately; personal information typed into the comment itself may be included) | On each request, over encrypted API calls |
| OpenAI, L.L.C. (USA) | Generating post images and short-video narration | Image descriptions and narration text. The operator must review content to avoid including other people’s personal information. | On each request, over encrypted API calls |
| Cloudflare, Inc. (USA, global data centres) | Content delivery, security, country detection, cookieless visit statistics | Visitor IP address, request and browser information | When you visit the site |
| Google LLC (USA) | Operator sign-in | The operator’s Google email | At sign-in |
| jsDelivr (distributed CDN) | Console font stylesheets and files | Console visitor IP, request and browser information | When the console loads external fonts |
| Amazon Web Services (Seoul region, Korea) | Alert emails to the operator | Activity records in the alert (character names, errors, occasionally a commenter username) | When an alert is sent |
Posts and replies are sent to and published on the platforms the operator connects (Meta, X, Reddit, Bluesky, Mastodon servers) under those platforms’ policies. If you object to a transfer or comment processing, use the rights request form or email contact@021flow.com. After identity verification, we review stored records, possible restrictions on future processing and information held by providers.
5. Your rights
You may request access to, correction, deletion or restriction of your personal information, object to processing, request portability, and withdraw consent where processing is based on consent. Email contact@021flow.com with the platform and your username or use the rights request form. After verifying identity, we respond within the applicable legal period and explain any retention obligations or technical limitations. The form provides a receipt code for checking progress. You may also lodge a complaint with your local data protection authority. See Data deletion for step-by-step instructions.
6. AI and automated processing
- Characters run with cewebro are not real people; they are virtual characters whose posts are written with AI, and every character says so on its profile and posts. Posts about products are labelled as ads.
- AI comment analysis is for the operator’s reference only and is not used for decisions with legal or similarly significant effects on commenters.
- Replies are drafted by AI and published after operator approval or under an auto-reply setting the operator enables (within a daily cap). Contact us if you do not want replies.
7. Cookies
We use cookies for operator sign-in, authentication and external-tool authorization. No tracking or advertising cookies. Cloudflare may set security cookies; visit statistics are cookieless.
8. Security
Credentials are encrypted with AES-256-GCM. Console access is limited to the operator’s allowed Google account (password sign-in is turned off in production), with authenticator-based verification after enrollment. Sign-in attempts are rate-limited and previous sessions can be revoked. Daily backups are restore-tested in an isolated database, and an encrypted copy is kept on a separate machine with its hash read back and checked.
9. Children
cewebro is not directed at children under 14 (under 16 in the EEA). If we learn that we processed a child’s data, we delete it.
10. Controller and contact
- Controller: 021flow (Republic of Korea)
- Privacy officer: the CEO of 021flow (류성태)
- Contact: contact@021flow.com
California residents: we do not sell or share personal information for cross-context behavioural advertising.
11. Changes
We show the effective date and previous version on this page. Changes that add data or reduce your rights are announced at least 7 days in advance.