Security
and privacy

Passwords are protected with irreversible salted bcrypt hashing: not even we can read them.

After 5 failed sign-in attempts the account is locked for 15 minutes, against brute-force attacks.

HttpOnly and Secure cookies, unreadable by scripts. On logout the session is invalidated immediately on the server.

Each client sees only their own campaigns, invoices and messages; management functions are reserved to the Super Admin.

All traffic between your browser and the platform travels encrypted via HTTPS.

Sensitive operations are only accepted when they come from our own site (origin check and strict CORS).

Rate limits on sign-in, analyses, chatbot and statistics prevent automated, large-scale use.

Incoming messages from Stripe and WhatsApp are only accepted with a valid cryptographic signature.

Service keys stay on the server and are never shown in full; social tokens are encrypted.

Card data is entered and processed directly by Stripe (PCI DSS Level 1 certified): it never passes through our servers.

We only collect what the service needs; business contacts come from public, lawful sources.

Visit statistics start only after your consent, with an anonymised IP address; heatmaps and visits delete themselves after 90 days.

In the event of a high-risk data breach we notify the FDPIC and the affected people as soon as possible, as required by art. 24 nFADP.