Last updated: 22 July 2026
Privacy Policy
Effective Date: 22 July 2026
Version: 1.0
BAG S.r.l. | Via Santa Maria, 86090 Pesche (IS), Italy
info@bag-adv.com | cadence.bag-adv.com
1. Introduction
This Privacy Policy explains how BAG S.r.l. ("BAG", "we", "us", "our") collects, uses, stores, shares, and protects personal data in connection with CADENCE, the LinkedIn presence service accessible at cadence.bag-adv.com (the "Service").
We are committed to processing personal data lawfully, fairly, and transparently, in accordance with Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
This Policy should be read together with our Terms of Service at cadence.bag-adv.com/terms.
2. Data Controller
BAG S.r.l.
Via Santa Maria, 86090 Pesche (IS), Italy
Email: info@bag-adv.com
BAG acts as Data Controller in respect of personal data relating to you as a client of the Service. Where you submit personal data relating to third parties, BAG acts as Data Processor on your behalf, and you act as Data Controller.
3. Personal Data We Collect
3.1 Data You Provide
| Category | Examples |
|---|---|
| Identity and contact | Name, company name, email address, telephone number |
| Professional profile | Website URL, LinkedIn profile URL, description of your business, target audience, positioning, brand voice, objectives, proof points, topics to avoid |
| Research preferences | Publications, sources, and keywords you select to inform your content |
| Publishing preferences | Publication days, time, timezone, and content language |
| Support communications | Any information you provide when contacting us |
3.2 Data From Connected Accounts
When you authorise CADENCE to connect to your Slack workspace and LinkedIn account, we receive and store:
- Slack: an access credential and the identifier of the channel you select, used solely to deliver posts for your review. We do not read your Slack messages, conversations, or files.
- LinkedIn: an access token, a refresh token where provided, its expiry, your LinkedIn member identifier, and the scope of permission granted. These are used solely to publish content that you have approved. We do not read your LinkedIn messages, connections, or private profile data.
Access tokens are stored in encrypted form and are used exclusively for the purposes described in this Policy.
3.3 Data Generated Through the Service
- Post copy and images generated for you
- Your edits, approvals, rejections, and scheduling changes
- Publication records, including identifiers of published posts
- Delivery, error, and diagnostic logs
3.4 Data Collected Automatically
- IP address, browser type, device and operating system information
- Interaction and usage data relating to the Service
- Essential cookies as described in Section 9
3.5 Payment Data
Payments are processed by our payment processor. BAG does not collect or store your full card details. We receive only transaction confirmation data and limited billing information necessary for accounting and tax purposes.
4. Purposes and Legal Bases
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing the Service: generating, delivering, and publishing content | Performance of a contract (Art. 6(1)(b)) |
| Connecting to and publishing via your Slack and LinkedIn accounts | Performance of a contract and your explicit authorisation (Art. 6(1)(b)) |
| Processing payments, invoicing, and accounting | Contract and legal obligation (Art. 6(1)(b), 6(1)(c)) |
| Customer support and service communications | Performance of a contract (Art. 6(1)(b)) |
| Maintaining security, preventing abuse, diagnosing faults | Legitimate interests (Art. 6(1)(f)) |
| Improving and developing the Service | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications, where applicable | Consent (Art. 6(1)(a)) |
| Compliance with legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
5. AI Processing and Training
The Service uses third-party artificial intelligence systems to generate post copy and images. To do so, your Brand Inputs and related context are transmitted to those providers solely for the purpose of producing content for you.
We do not use your personal data, Brand Inputs, or generated content to train artificial intelligence or machine learning models, whether our own or those of any third party. Our AI providers are engaged under commercial API terms which do not permit the use of submitted data for model training.
6. Sub-processors and Disclosure
We do not sell, rent, or trade your personal data, and we do not share it with third parties for their own marketing purposes.
We do, however, rely on the following categories of sub-processor to operate the Service. Each is bound by a data processing agreement and processes data only on our documented instructions.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic (Claude) | Generation of post copy | United States |
| OpenAI (GPT / GPT-Image) | Generation of post images | United States |
| Perplexity | Research and market signal retrieval, where enabled | United States |
| Slack Technologies | Delivery of posts for your review | United States |
| Publication of approved posts | United States / Ireland | |
| Stripe | Payment processing | United States / Ireland |
| Supabase / Lovable Cloud | Application hosting, database, and file storage | European Union / United States |
We may also disclose personal data where:
- required by law, court order, or a competent authority — and we will notify you where legally permitted to do so;
- necessary to establish, exercise, or defend legal claims;
- a business transfer occurs, such as a merger, acquisition, or sale of assets, in which case your data would remain subject to equivalent protections and you would be notified;
- you have given explicit consent to a specific disclosure.
An updated list of sub-processors is maintained and may be requested at any time by contacting info@bag-adv.com.
7. International Transfers
Certain sub-processors are located outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA, we rely on one or more of the following safeguards under Chapter V of the GDPR:
- Standard Contractual Clauses approved by the European Commission;
- the EU–US Data Privacy Framework, where the recipient is certified;
- your explicit consent, where applicable.
You may request further information about the safeguards applied by contacting info@bag-adv.com.
8. Data Retention
| Data | Retention Period |
|---|---|
| Account and brand data | For the duration of the Service, and 30 days after termination |
| Generated and published posts | For the duration of the Service, and 30 days after termination |
| Access tokens for Connected Accounts | Deleted promptly upon termination or revocation |
| Billing and invoicing records | 10 years, as required by Italian tax law |
| Diagnostic and security logs | Up to 12 months |
Following termination and expiry of the periods above, personal data is deleted or irreversibly anonymised, except where a longer retention period is required by law.
9. Cookies
We use only cookies that are strictly necessary for the Service to function, including session and security cookies. We do not use third-party advertising cookies.
Where non-essential cookies or analytics are used, you will be presented with a consent banner in accordance with Italian Legislative Decree 69/2012 and may manage your preferences at any time. You may also control cookies through your browser settings, although disabling essential cookies may prevent parts of the Service from functioning.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- encryption of data in transit (TLS) and encryption of stored access credentials;
- access controls limiting access to personal data to authorised personnel;
- token-based, non-guessable access links for client-facing pages;
- private storage buckets with time-limited signed access for generated media;
- logging and monitoring of access and errors;
- periodic review of security practices.
No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Garante per la protezione dei dati personali within 72 hours and inform you where required under Articles 33 and 34 GDPR.
11. Your Rights
Under the GDPR you have the right to:
- Access (Art. 15) — obtain confirmation of processing and a copy of your personal data;
- Rectification (Art. 16) — have inaccurate or incomplete data corrected;
- Erasure (Art. 17) — request deletion of your personal data;
- Restriction (Art. 18) — request restriction of processing;
- Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format;
- Object (Art. 21) — object to processing based on legitimate interests;
- Withdraw consent (Art. 7(3)) — at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
- Not be subject to solely automated decision-making producing legal or similarly significant effects (Art. 22). The Service does not make such decisions about you.
To exercise these rights, contact info@bag-adv.com. We will respond within one month, extendable by two further months for complex requests, in accordance with Article 12(3) GDPR.
You may also revoke CADENCE's access to your Slack or LinkedIn account at any time, directly through those platforms' settings or by contacting us.
You have the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the supervisory authority of your habitual residence.
12. Children
The Service is intended exclusively for professional and business use by persons aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Third-Party Links and Platforms
The Service interacts with, and may contain links to, third-party platforms including Slack and LinkedIn. Your use of those platforms is governed by their own terms and privacy policies. We are not responsible for their practices and encourage you to review them.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be notified by email to the address associated with your account and by updating the "Last Updated" date on this page. Continued use of the Service after the effective date constitutes acknowledgement of the revised Policy.
15. Contact
BAG S.r.l.
Via Santa Maria, 86090 Pesche (IS), Italy
Email: info@bag-adv.com
Web: cadence.bag-adv.com
Data Protection Officer: to be appointed in accordance with Article 37 GDPR where required. Contact: info@bag-adv.com
Supervisory Authority: Garante per la protezione dei dati personali — www.garanteprivacy.it
This Privacy Policy has been prepared by reference to applicable EU and Italian law as at 22 July 2026. It does not constitute legal advice. BAG S.r.l. recommends obtaining independent qualified legal counsel.
© 2026 BAG S.r.l. All rights reserved | cadence.bag-adv.com