Privacy Policy

1. Controller

The controller of your personal data is ONEXO.pl Adrian Sokół, ul. Wojska Polskiego 9/D211, 39-300 Mielec, Polska, NIP (tax ID) 8172211997, REGON 526100591, e-mail [email protected] ("we"). We have not appointed a data protection officer; write to [email protected] with any question about your data.

2. Data we process

We do not read your followers, private messages, comments, contacts or statistics on any platform, and we do not use analytics, advertising or tracking tools.

• Account data: your name, e-mail address, the password in hashed form (we never store it in plain text), whether your e-mail address is confirmed, and the secret and backup codes of two-step verification, stored encrypted.
• Workspace data: organizations, brands, members of your team, their roles and invitations (the invited e-mail address and role).
• Connected social media accounts: the identifier, username, display name and profile picture of each account you connect, the access and refresh tokens issued by the platform, their expiry and the permissions you granted (details per platform in sections 5 to 10).
• Content: the text, photos and videos you upload, the accounts and time you choose for publishing, the settings for each platform, and the result of each publication (the identifier and link of the post on the platform, or the error the platform returned).
• Security and technical data: the IP address and browser of each session, sign-in attempts and request counters used to block abuse, and a log of actions taken in your organization (for example who connected or disconnected an account or published a post).

3. Purposes and legal bases

Giving your data is voluntary, but without an e-mail address and a password we cannot create an account, and without connecting a social media account we cannot publish to it. We do not make decisions based solely on automated processing and we do not profile you.

• Providing the service: creating and running your account and workspace, connecting your social media accounts and publishing or scheduling the content you choose (Art. 6(1)(b) GDPR, performance of a contract).
• Service e-mails: confirming your address, resetting your password, invitations to an organization and messages about failed publications (Art. 6(1)(b) GDPR).
• Security: two-step verification, protection against password guessing and abuse, investigating incidents and keeping backups (Art. 6(1)(f) GDPR, our legitimate interest in a secure and reliable service).
• Handling complaints, requests and claims (Art. 6(1)(f) GDPR) and meeting legal obligations, for example answering lawful requests of public authorities (Art. 6(1)(c) GDPR).

4. How we use data from social media platforms

We receive data from a platform only after you click "Connect" in SocialSync and authorize our application on that platform's own page. We ask only for the permissions needed to identify the connected account and publish the content you choose. SocialSync cannot take over or delete your social media accounts: we never ask for permissions to delete or edit your profile, and SocialSync does not delete posts or change your profile name, picture, description or links.

Data received from a platform is used only to show which account is connected and to publish to it the content that you or a member of your organization prepared and scheduled. We do not sell it, we do not use it for advertising or marketing, we do not share it with anyone except the platform itself, we do not combine it with data from other sources and we do not use it to train artificial intelligence models.

Access tokens are encrypted before they are stored. Only the separate publishing process holds the key to decrypt them; they are never shown in the interface, sent to your browser or written to logs.

You can disconnect an account in the Accounts page of the application at any time. We then delete the account's identifier, username, display name, picture and tokens immediately. You can also revoke our access in the platform's settings (links below); publishing to that account then stops.

5. TikTok

SocialSync uses the TikTok Login Kit and the Content Posting API with the permissions user.info.basic (your open ID, display name and avatar, to show which account is connected) and video.publish (to publish the videos and photos you choose to your TikTok account, with the privacy level and interaction settings you select before publishing). We do not access your existing videos, followers, messages or analytics.

• TikTok Terms of Service
• TikTok Privacy Policy
• Revoke access: TikTok app, Settings and privacy, Security and permissions, Apps and services permissions

6. Facebook, Instagram and Threads (Meta)

To publish photos and videos, Instagram and Threads download the file from a link on socialsync.pl that contains a long random key; the file is not listed or linked anywhere else. How to delete your data, including after removing our app in Meta settings, is described on our data deletion page.

• Facebook Pages: pages_show_list (the list of Pages you manage, with their name, identifier and picture, so you can choose which to connect), pages_read_engagement (basic information about the chosen Page and the Page access token needed to publish) and pages_manage_posts (publishing the posts you choose to the chosen Page).
• Instagram professional accounts: instagram_business_basic (identifier, username, profile picture and account type) and instagram_business_content_publish (publishing the photos, videos and carousels you choose).
• Threads: threads_basic (identifier, username and profile picture) and threads_content_publish (publishing the posts you choose).

• Meta Privacy Policy
• Facebook: Settings, Business integrations
• Instagram: Settings, Website permissions, Apps and websites
• Data deletion instructions for SocialSync

7. LinkedIn

SocialSync uses Sign In with LinkedIn using OpenID Connect and Share on LinkedIn with the permissions openid and profile (your member identifier, name and profile picture, to show which profile is connected) and w_member_social (publishing the posts you choose on your behalf). We do not receive your e-mail address, connections, messages or any other profile data from LinkedIn.

We delete LinkedIn data as soon as you disconnect the profile or revoke access, and on your request at any time.

• LinkedIn User Agreement
• LinkedIn Privacy Policy
• Revoke access: Settings, Data privacy, Permitted services

8. YouTube and Google

SocialSync uses YouTube API Services. With the permissions youtube.upload (uploading the videos you choose to your channel, with the title, description and privacy status you set) and youtube.readonly (your channel's identifier, name and picture, and the processing status of uploaded videos) we act only on your instruction. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google's processing of your data is governed by the Google Privacy Policy.

SocialSync's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, do not use it to train AI models, and people at our company read it only with your consent, when needed for security or when required by law.

We do not store cookies or read information from your device on behalf of YouTube.

• YouTube Terms of Service
• Google Privacy Policy
• Revoke access: Google Account, Third-party connections

9. X

Permissions: users.read and tweet.read (your account identifier, name, username and picture), tweet.write and media.write (publishing the posts and media you choose) and offline.access (keeping the connection without asking you to sign in again).

• X Terms of Service
• X Privacy Policy
• Revoke access: Settings, Security and account access, Apps and sessions

10. Pinterest

Permissions: user_accounts:read (your username and picture), boards:read (the list of your boards, so you can choose where to pin), and pins:read and pins:write (publishing the Pins you choose and checking their status).

• Pinterest Terms of Service
• Pinterest Privacy Policy
• Revoke access: Settings, Security and logins, Apps

11. Recipients

The platforms (TikTok, Meta, Google, LinkedIn, X, Pinterest) may process data outside the European Economic Area under their own safeguards. We transfer data to them only when you publish to them. The current list of our providers is available on request at [email protected].

• The social media platforms you connect, when you publish to them. Content published on a platform is then processed by that platform as a separate controller, under its own terms and privacy policy.
• Our hosting provider, which runs the server, database and file storage, and our e-mail delivery provider, which sends service e-mails. Both process data only on our instructions, under a data processing agreement.
• When you set a password we check it against known data breaches: only the first five characters of a one-way hash of the password are sent to the Have I Been Pwned service, never the password itself or any data that identifies you.
• Public authorities, only when the law requires us to disclose data.

12. How long we keep data

• Account, workspace and content data, including uploaded files and the log of actions: for as long as your account exists, or until you delete the item earlier.
• Connected account data and tokens: until you disconnect the account; they are deleted immediately.
• Sessions: until you sign out or for at most 14 days of inactivity. Counters of requests per IP address used to block abuse hold only the latest count and serve no other purpose.
• After you ask us to delete your account we erase your data within 30 days. Backups of the database are kept for 14 days, so deleted data disappears from them within that time.
• Data needed to handle a complaint or claim: until it is resolved and the limitation period expires.

13. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to object to processing based on our legitimate interest. To use them, write to [email protected]; we answer within one month. You also have the right to lodge a complaint with the supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

14. Cookies and browser storage

We use only what the service needs to work: a session cookie that keeps you signed in, a cookie with your chosen language and your theme setting stored in the browser. We use no analytics, advertising or third-party cookies, so no consent banner is needed.

15. Security

Connections are encrypted with TLS, passwords are hashed, platform tokens are encrypted with a key kept away from the web server, and owners and administrators of an organization must use two-step verification.

16. Children

SocialSync is a professional tool for adults and is not directed to children. We do not knowingly process data of persons under 18.

17. Changes to this policy

We publish every change on this page with a new date. We will tell you about a material change by e-mail before it takes effect.