Privacy Policy

Last updated November 1, 2026

This page was drafted for review by qualified counsel.

At a glance

• Kokoriko SAS runs Postocial and is responsible for the personal data described in this policy.
• We collect what we need to run your account and to publish and message for you: your account details, the social accounts and messaging channels you connect, your content and contacts, and basic technical data.
• We don't sell personal data, and we don't use it for advertising.
• Our website sets no cookies and uses no analytics. The app uses only the cookies it needs to work.
• Service providers help us run Postocial, including our platform provider and our hosting in Germany. Our Sub-processors page lists them.
• You can see, correct, get a copy of or delete your data. Email hello@postocial.com to ask.

Who we are

Kokoriko SAS ("Postocial", "we", "us") is the controller of the personal data described in this policy, except where we process data for our customers, as the next section explains.

• Registered address: 6 rue d'Armaille, 75017 Paris, France
• Email: hello@postocial.com

When this policy applies

This policy covers personal data we handle when you visit postocial.com, sign up for or use the Postocial app (including its API and MCP server), are invited to a workspace, or contact us.

When we act for our customers

Postocial customers use the app to work with their own audiences: people who comment on or message their social accounts, people who review their Google Business Profile, contacts who reach them on WhatsApp, Telegram, SMS or live chat, and visitors to their bio pages, short links and QR codes, including people who fill in their forms. For this data, the customer is the controller and we process it on their behalf under our Data Processing Addendum. If you're one of these people, please contact the business you dealt with. If you contact us instead, we'll point you to them or pass your request on where we can.

Information we collect

Information you give us

• Account details: your name, email address, password, profile photo, language, time zone and preferences, and your two-factor authentication settings.
• Workspace and team details: your workspace and brand names, the team members you invite and their roles, and the client invite links and shared calendar links you create.
• Billing details: your plan, billing name, address and country, tax ID if you give one, and billing history. Stripe collects your payment card details. We don't receive or store your full card number.
• Content: posts, drafts, captions, hashtags, media, comments, templates and variables, tags, CSV files for bulk posts, RSS feed addresses, bio pages, saved replies and internal notes.
• Contacts and automations: the contacts you add or import, such as names, phone numbers, email addresses, tags, custom fields, pipeline stages and whether they opted in or out, and the automations, broadcasts, segments, meeting types and AI Knowledge sources you create.
• Messages to us: what you send when you email us for support or with a question, and your replies to our emails.

Information from the networks you connect

When you connect a social account or messaging channel, the network sends us data through its API. What we receive depends on the network and the permissions you grant, and can include:

• account, page or channel identifiers, names, usernames and profile images;
• access tokens that let us publish and read data for you;
• the pages, boards, blogs, subreddits, channels or groups you manage;
• your published posts and their metrics, such as views, reactions and follower counts;
• for networks connected to the inbox, comments, direct messages and reviews, with the names and profile details of the people who wrote them;
• for messaging channels, the messages and contact details that reach your inbox: WhatsApp numbers and messages, chats with your Telegram bot, and texts sent and received through your SMS provider;
• when a conversation starts from a click-to-message ad on Facebook, Instagram or WhatsApp, the referral data Meta passes with the message, such as the ad ID, ad headline and click ID.

For X, we also store the API key and secret of the X developer app you connect.

If you add the live-chat widget to your website, it sends us the messages visitors write and the details your widget asks for, such as an email address, and can include the page they chatted from.

Information created as you use Postocial

• Usage and log data: IP address, browser and device type, the pages and features you use, times, errors, and security events such as sign-ins.
• Analytics: follower growth, engagement, top posts and best times to post, calculated from network data.
• Developer data: the API keys and personal access tokens you create, the webhook addresses you register, and records of the requests made with them.
• AI data: your prompts, the content you ask the AI to work on, and what it generates.
• Cookies: the few cookies the app needs, described in our Cookie Policy.

Information from services you use with Postocial

If you import media from Dropbox or Google Drive, pick photos from Unsplash or GIFs from Giphy, or edit images in Adobe Express, we receive the files and details you choose. If you connect Zapier, a tool you point at our REST API or webhooks yourself (such as n8n), an AI assistant through MCP, an AI provider with your own key, or your own payment, store, CRM or calendar account, we exchange the data that integration needs, such as contact details, bookings, orders and payment status.

Information from our website

Our website, postocial.com, sets no cookies and runs no analytics or advertising tools. The site runs on our own server, hosted by Contabo in Germany. Like any web server, it receives the technical data every web request includes, such as IP address and browser type, to deliver the site and keep it secure. The free tools on our website, such as the character counter and image resizer, run in your browser: the text and images you use with them aren't sent to us.

How we use information

We use personal data only for the purposes below. If you're in the European Economic Area (EEA), the UK or Switzerland, the table also shows the legal basis for each purpose.

You need to give us your name, email address and payment details to create an account and start a trial. Without them, we can't provide the service. Everything else depends on the features you use.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects. The AI features in the composer produce suggestions when you ask for them. AI replies in automations answer contacts automatically, but only in the automations a workspace sets up and through the AI provider it connects.

AI features

• When you use the built-in AI writing assistant or AI images, we send your prompt and the content the task needs, such as a draft post, to OpenAI, our AI provider. The result comes back to your workspace.
• [AI training commitment, to be confirmed by counsel with the platform provider and OpenAI]
• AI reply suggestions in the inbox, AI Reply steps in automations and AI Knowledge use the AI provider your workspace connects with its own key: OpenAI, Anthropic (Claude), Google (Gemini) or DeepSeek. The messages, contact details and knowledge sources a reply needs go to that provider under your agreement with it. That provider decides how it stores and uses the data and where it processes it. For example, DeepSeek's privacy policy says it processes data in China.
• AI output can be wrong. Review AI writing before you publish or send it, and keep a person available when AI replies answer your contacts.

Google and YouTube data

Postocial uses YouTube API Services and other Google APIs. The Google Privacy Policy explains how Google handles data. When you use YouTube features in Postocial, you agree to the YouTube Terms of Service.

• What we access. When you connect a YouTube channel, we access its details (such as name, ID and profile image), the videos you publish or schedule through Postocial and, when you use those features, analytics for your channel and videos and comments for the inbox. When you connect a Google Business Profile, we access the locations you manage, the updates, offers and events you publish, and reviews for the inbox. When you import from Google Drive, we access the files you choose.
• How we use it. Only to provide the features you use: publishing, analytics, the inbox and media import. We don't use Google user data for advertising, we don't sell it, and we don't use it to train AI models.
• Who we share it with. Only the service providers that help us run those features, listed on our Sub-processors page, and only to provide them, or when the law requires it.
• How long we keep it. Only as long as the features you use need it. We refresh or delete it as the YouTube API Services policies require, including after you revoke access.
• How to revoke access. Disconnect the account in Postocial, or remove access on Google's security settings page. To have the data we hold deleted, delete your Postocial account or email hello@postocial.com.

Postocial's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Postocial doesn't show ads, and doesn't let third parties serve ads in the app.

Data from other networks

• Meta (Facebook, Instagram, Threads and WhatsApp). We process the data Meta's APIs provide, such as Page and account details, access tokens, posts, insights, comments and messages, only to provide the features you use and as the Meta Platform Terms allow. To have it deleted, disconnect the account in Postocial, delete your Postocial account, or email hello@postocial.com with the name of the account. We'll confirm by email when the data is deleted.
• WhatsApp. When you connect a WhatsApp Business number, we receive its business profile and message templates, and the messages and contact details of the people who chat with you. We handle that data as the WhatsApp Business Terms allow. If you turn on purchase reporting for Click-to-WhatsApp ads, we send Meta only the ad click ID, the purchase value and its currency, and we skip blocked and opted-out contacts.
• Click-to-message ads. When someone messages you from an ad on Facebook, Instagram or WhatsApp, Meta passes the ad ID, headline and click ID with the conversation. We use them to show which ad started it.
• TikTok. We access your TikTok account details, such as display name and profile image, and the settings TikTok asks us to show before you post, such as the privacy options for your account. We upload only the videos and photos you choose to publish, and use this data only to provide the TikTok features you use, such as publishing and analytics.
• X. We access X through the X developer app you connect, with your own keys.
• LinkedIn, Pinterest, Reddit, Tumblr, Bluesky, Mastodon and Telegram. We access the account details, tokens and content needed to publish and, where the network allows, analytics and inbox items.
• Telegram bots. When you connect your own bot with its token, we receive the messages people send it, and we use the token to reply and to send broadcasts to people who started the bot.
• SMS. When you connect Twilio or Plivo, we send your texts through that provider with the credentials you enter, and receive replies and delivery reports. A custom SMS gateway only sends texts.

When you publish, the network receives your post and handles it under its own terms and privacy policy. We don't control what a network does with what you publish.

Disconnecting accounts and deleting data

• In Postocial: remove a social account or messaging channel from your workspace to stop publishing or messaging through it and stop collecting new data from it.
• On the network: you can also revoke access in the network's settings for connected or authorized apps. There, the app may be listed under the name Postocial or under the name of our platform provider, shown on our Sub-processors page.

• Published posts: deleting a post in Postocial may not remove it from the network where it was published. Delete it on the network as well if you need to.
• Your account: you can delete your account in the app. This deletes your workspace and its content, as described in How long we keep data.

How we share information

We don't sell personal data, and we don't share it for cross-context behavioral advertising. We share it only as described here.

• Service providers. Companies that process data for us under contracts that limit what they can do with it: our platform provider, which operates the app for us; hosting in Germany; realtime updates; the app's font (Bunny Fonts); payments (Stripe); AI (OpenAI); and email. Our Sub-processors page has the full list.
• Networks and services you connect. When you publish, reply or connect an integration, we send the network or service the data it needs to do what you asked. That includes the providers your workspace chooses for messaging and sales, which act under their own terms: WhatsApp (Meta), your SMS provider, payment providers for payment links (Stripe, PayPal, Razorpay, Paystack, MyFatoorah and Mercado Pago), stores (Shopify and WooCommerce), CRM and productivity tools (HubSpot, Mailchimp, Google Sheets, Slack and Zapier), calendars and video meetings (Google Calendar and Zoom), and the AI provider you connect with your own key.
• Your workspace. Team members and clients you invite see workspace content according to their role. Anyone with a shared calendar link sees the posts it shares.
• Support access. Our support staff, and the staff of our platform provider [conditions to be confirmed with the platform provider], may access your workspace to fix a problem you report or to protect the service.
• Legal reasons. To comply with the law, respond to valid requests from authorities, enforce our terms, or protect the rights, safety and security of people and of Postocial.
• Business transfers. If Postocial is involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner, who must keep protecting it as this policy describes or tell you about any change.
• With your consent. In any other case, only when you ask us to or agree to it.

International transfers

The Postocial app is hosted in Germany. Some of our service providers are based in, or process data in, other countries, including the United States: our platform provider, Pusher (realtime updates), Stripe and OpenAI. The networks and services you connect may process data wherever they operate. That includes the AI provider your workspace connects with its own key, which may process data outside the EEA: DeepSeek, for example, says it processes data in China.

Some of our providers process personal data outside the EEA, the UK and Switzerland. Where the destination has no EU adequacy decision, the transfer relies on the European Commission's Standard Contractual Clauses (plus the UK Addendum for UK data) or on the provider's certification under the EU-U.S. Data Privacy Framework. Email hello@postocial.com for a copy of the safeguard that applies.

How long we keep data

We keep personal data only as long as we need it for the purposes in this policy. This is how we decide.

Deleted data can remain in backups until they're overwritten in the normal backup cycle. We don't use backups for anything else in the meantime.

How we protect data

• Encrypted connections (HTTPS) between your browser and Postocial.
• Roles in each workspace (admin, member and viewer), custom team roles that can limit people to some messaging channels, and two-factor authentication for sign-in.
• An audit log of admin and destructive actions in each workspace.
• Workspaces kept separate from one another, and access to customer data limited to the people who need it.
• [Backup and monitoring commitments, to be confirmed with the platform provider]
• API keys with fine-grained permissions and rate limits, and signed webhooks.

No system is perfectly secure. If a personal data breach affects you, we'll tell you and the authorities as the law requires.

Your rights

In the EEA, the UK and Switzerland

Under the GDPR, the UK GDPR and Swiss data protection law, you have the right to:

• access your personal data and get a copy of it;
• correct data that is inaccurate or incomplete;
• have your data deleted;
• restrict how we use your data;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive the data you gave us in a structured, machine-readable format, and have it sent to another company;
• withdraw your consent at any time, without affecting processing that happened before.

How to make a request

You can do many things yourself in the app: edit your profile, disconnect social accounts, delete content or delete your account. For anything else, email hello@postocial.com from the address on your account. We may ask you to confirm your identity. We reply within one month. If a request is complex, we may need up to two more months, and we'll tell you if so. Requests are free, unless they're clearly unfounded or excessive.

Complaints

If you're unhappy with how we handle your data, please tell us first at hello@postocial.com. We acknowledge complaints within 30 days and tell you the outcome. You can also complain to the data protection authority where you live or work: in the EEA, see the list of national authorities; in the UK, contact the Information Commissioner's Office.

Other US states

If you live in a US state with a consumer privacy law, you can make requests the same way. If we decline your request, you can appeal by replying to our decision, and we'll tell you the outcome of your appeal.

California privacy rights

This section is for California residents and applies to the extent the California Consumer Privacy Act (CCPA) covers our processing. In the past 12 months, we collected these categories of personal information:

• Sources: you, your team, the networks and services you connect, and your browser or device.
• Purposes: the business purposes in How we use information, such as providing and securing the service, billing, support, fixing problems and meeting legal duties.
• Disclosures: we disclose each category to our service providers for these business purposes, and to the networks and services you connect, at your direction.
• No sale or sharing: we don't sell personal information or share it for cross-context behavioral advertising, and we haven't in the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
• Sensitive personal information: we use it only to provide the service and keep it secure, never to infer characteristics about you.
• Retention: as described in How long we keep data.

You have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and to opt out of its sale or sharing, which we don't do. We won't treat you differently for using these rights. To make a request, email hello@postocial.com. We confirm your identity by matching the email address on your account and may ask for more information. An authorized agent can make a request for you with your signed permission, and we may ask you to confirm your identity directly. We respond within 45 days, or tell you if we need up to 45 more. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing. Because we don't sell or share personal information, nothing else changes.

Children

Postocial is not for anyone under 18. We don't knowingly collect personal data from children. If you believe a child has given us personal data, email hello@postocial.com and we'll delete it.

Changes to this policy

We update this policy when our practices, our service providers or the law change. We post the new version here with a new date. If a change is material, we'll also tell you by email or in the app before it takes effect.

Contact us

For privacy questions or requests, email hello@postocial.com or write to Kokoriko SAS, 6 rue d'Armaille, 75017 Paris, France.