Privacy Policy

1. Introduction

Thanks for using AdaptlyPost, our social media management platform. This Privacy Policy explains how Taras Shynkarenko, operating under the brand name AdaptlyPost ('we', 'us', or 'our'), handles your data when you use our service. We've written this in plain language to make it easy to understand. If you use AdaptlyPost to handle other people's personal data for your business, we process that data for you as a processor under our Data Processing Agreement. If you disagree with anything here, please don't use our platform.

2. Data Controller

The entity responsible for your personal data is:

3. What Information We Collect

We collect data you give us directly, information generated when you use our service, and some data from third-party sources.

4. How We Use Your Data

Here's what we do with the information we collect:

• Provide, run and support our platform

• Process your payments and subscriptions

• Send you important updates and security alerts

• Answer your questions and support requests

• Understand how people use our service

• Fix bugs and prevent security issues

• Customize your experience

• Meet our legal obligations

• Send you marketing emails (only if you've opted in)

5. Legal Basis (GDPR)

If you're in the EU, here's our legal justification for processing your data:

• Contract: We need your data to provide the service you signed up for

• Legitimate interest: To keep our platform secure, prevent abuse and fix errors

• Legal obligation: To comply with tax, accounting, and other laws

• Consent: For website analytics and marketing cookies and session recordings in the EU, EEA and UK, and for marketing emails. You can withdraw consent at any time

6. Who We Share Your Data With

We only share your information when necessary:

7. AI Features

Some features send the text, images or prompts you give them to an AI provider. Here is how that works:

• •

  Providers: captions are written by Anthropic (Claude). Images and image analysis use OpenAI. Some text features use xAI (Grok) and Google (Gemini). Embeddings use OpenAI

• •

  API terms: we use each provider's business API. Under their API terms, these providers don't train their models on API data. They keep it for a limited period for abuse monitoring, typically 30 days

• •

  No training: we don't use your content to train or fine-tune any AI model

• •

  Your own key: if you add your own API key for OpenAI, Anthropic, Google or OpenRouter, those requests go to that provider under your own agreement with them

• •

  AI history: your chats, writer drafts and image sessions stay in your account until you delete them or your account is deleted. Deleted AI history is purged after 30 days

• •

  Location: these providers process data mainly in the USA. Section 15 explains how these transfers are protected

8. How We Protect Your Data

We take security seriously. Our measures include:

• Our servers, database and backups are in the EU (Hetzner, in Finland and Germany)

• All connections to AdaptlyPost use TLS encryption

• Social media tokens are encrypted with AES-256

• Access to production systems is limited to the people who need it

• Hourly database backups, and system logs for monitoring and incident response

That said, no system is completely bulletproof. While we do everything we can to protect your data, we can't guarantee 100% security.

9. How Long We Keep Your Data

We keep your information only as long as needed for the purposes described here, or as required by law. When we don't need it anymore, we permanently delete or anonymize it.

How long we keep each type of data:

• Account data: while your account is active. You can delete your account in Settings. If you own an organization that has other members, transfer ownership or remove them first. Deleting your account deletes all of your AI history and the organizations where you are the only member, with their workspaces, connected accounts and posts, and cancels an active subscription. Deletion takes effect immediately. You can also ask us at contact@adaptlypost.com

• Organizations and workspaces: deleting an organization deletes its workspaces, connected accounts and tokens, and posts. It deletes AI history only for members who have no other organization left, because AI history belongs to each user. Deleting a workspace deletes its posts but not AI history. Media files are removed within 14 days

• Post media: removed from storage after a post is published and its previews are made. Media of failed posts is removed after 14 days

• AI history: kept until you delete it or your account is deleted. Deleted AI history is purged after 30 days

• Service logs: up to 90 days

• Backups: deleted data leaves our backups within 21 days

• Billing and invoice records: as long as Polish tax law requires, which is 5 years from the end of the tax year

• Support history: for service quality and legal compliance

10. Your Privacy Rights

Under GDPR and similar laws, you can:

• Access your data: Get a copy of what we have about you

• Correct your data: Fix anything that's wrong or incomplete

• Delete your data: Ask us to remove your information (with some exceptions). You can delete your account in Settings. If you own an organization that has other members, transfer ownership or remove them first. Deleting your account deletes all of your AI history and the organizations where you are the only member, with their workspaces, connected accounts and posts, and cancels an active subscription. Deletion takes effect immediately. You can also ask us at contact@adaptlypost.com.

• Restrict processing: Limit how we use your data

• Export your data: Export analytics as CSV, XLSX or PDF in the app, get your posts and drafts through the REST API (GET /social-posts), or ask us at contact@adaptlypost.com for a full export, which we send within 30 days

• Object: Say no to certain uses, especially marketing

• Withdraw consent: Change your mind about things you've agreed to

• File a complaint: Contact your data protection authority if you're unhappy

To exercise these rights, email contact@adaptlypost.com. We reply within one month, as the GDPR requires.

11. Cookies & Tracking

We use cookies and similar technologies. In the EU, EEA and UK, only strictly necessary cookies are set until you consent. Here is what we use:

In the EU, EEA and UK, analytics and marketing run only after you consent. Elsewhere they are on by default. You can change your choice at any time in cookie preferences. Our Cookie Policy lists every cookie.

12. Service Providers

We use these kinds of service providers. Our Sub-processors page lists each one, what it does, where it processes data and how transfers outside the EU are protected:

• Hosting, database and backups: Hetzner (Finland and Germany)

• CDN, DNS, security, website hosting and media storage: Cloudflare (media stored in the EU)

• Sign-in and account management: WorkOS (USA)

• Bot protection and sign-up checks: Arcjet (USA) and Cloudflare Turnstile

• Payments: Mollie (EU). Lifetime licences: AppSumo (USA)

• Email: Resend (Ireland) and SendFox (USA). Support inbox: Zoho (USA). Support chat: Heyo (Singapore)

• Logs, error tracking and product analytics: PostHog (EU), Axiom (Germany), Better Stack (Germany), Grafana Labs (Europe)

• AI: Anthropic, OpenAI, Google and xAI (see section 7)

• YouTube backup uploads: bundle.social (Poland), only for channels with the backup turned on

• Website analytics and marketing, only after consent in the EU, EEA and UK: RudderStack, Google Analytics and Google Ads, Ahrefs, Rekomi

Social networks and other services you connect receive data because you ask us to send it. Their own terms and privacy policies cover what they do with it.

13. Social Media Platform Integration

When you connect your social media accounts to AdaptlyPost, the following platform-specific terms apply:

14. Browser Extension

The AdaptlyPost browser extension is an optional way to compose, schedule and publish posts without opening the dashboard. It is available for Chrome, Firefox, Microsoft Edge and Opera. Everything above applies to it. This section describes what it does in addition.

• •

  Authentication. The extension asks for an AdaptlyPost API token that you create yourself under Manage, API & AI Agents. The token is kept in local browser storage on your own device and is sent only to the AdaptlyPost API. Deleting the token immediately ends the extension’s access.

• •

  Post content. The text, images and scheduling times you enter in the extension are sent to the AdaptlyPost API and stored in your account, exactly as if you had entered them in the dashboard. Images are uploaded to our storage provider through a short-lived pre-signed URL.

• •

  Page content. The extension has no content scripts and reads no page automatically. It reads the page you are on only when you choose one of its right-click actions, and only to capture what that action is for: the page title and OpenGraph image, the text you highlighted, or the image you right-clicked. That data goes into the composer, where you can edit or remove it before anything is sent.

• •

  Publishing status. After you publish, the extension asks the AdaptlyPost API every 30 seconds, for up to ten minutes, whether each network has accepted the post, then reports the outcome in a desktop notification. No other background activity takes place.

• •

  Local storage. Your token, your unsent draft and the accounts you last selected are kept in local browser storage on your device. Removing the extension deletes them.

The extension contains no analytics, advertising or tracking code. It communicates with the AdaptlyPost API and our storage provider, and with no other host. Your browsing history is never collected.

15. International Data Transfers

Our servers, database, backups and media storage are in the EU. Some service providers process data outside the EU, mainly in the USA. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the Standard Contractual Clauses approved by the European Commission (2021/914). Our Sub-processors page shows where each provider processes data.

16. Children's Privacy

AdaptlyPost is not intended for use by children under 16. We don't knowingly collect data from children. If you're a parent and think your child has shared information with us, let us know and we'll delete it immediately.

17. Do Not Track

Some browsers have a 'Do Not Track' setting. Our platform doesn't currently respond to these signals, but you can control tracking through your cookie preferences.

18. Updates to This Policy

We may update this policy occasionally to reflect changes in our practices or legal requirements. When we make significant changes, we'll update the date at the top and notify you via email or through the AdaptlyPost platform. Continuing to use our service means you accept the updated policy.

19. Get in Touch

Questions about this policy or how we handle your data? Contact us:

20. Data Protection Authority

If you're in the EU and want to file a complaint, contact your local data protection authority. In Poland, that's: