Privacy Policy — Publish on Social Media

Last updated: 1 July 2026

1. Who we are

Publish on Social Media is a product of R24k Web-Ateljé, a Swedish sole-trader business (enskild firma) registered in Sweden.

Business name: R24k Web-Ateljé
Country: Sweden
Contact email: hello@publishonsocialmedia.com

As a Swedish business, we are subject to GDPR (General Data Protection Regulation) and the Swedish Data Protection Act (Dataskyddslagen).

2. Data we collect

Account data

When you create an account, we collect your name, email address, and password (stored as a bcrypt hash -- we never store your plaintext password). You may also provide your agency or business name.

Connected site data

When you connect a WordPress site, we store the site URL and the WordPress application password you provide. This is encrypted at rest. We use it solely to read your site's content via the WordPress REST API.

Content data

When you select a post or page to create a draft, we temporarily store the imported title, body text and image URLs to generate your social content. Generated visuals (posters, reels) are stored in your account storage up to your plan limit.

Social account data

When you connect a social media platform (Instagram, Facebook, etc.), we store the display name and account identifiers provided by the platform. Authentication tokens are managed by our third-party posting service (Zernio) and are not stored directly by us.

Payment data

We use Stripe to handle all payments. We do not store credit card numbers or full payment details on our servers. We store only what Stripe provides: your Stripe customer ID, subscription status, and billing period.

Usage data

We collect basic server logs (IP address, browser type, pages visited, timestamps) for security and debugging purposes. We do not use third-party analytics trackers on this site.

3. How we use your data

To provide, operate and maintain the service
To authenticate you and protect your account
To connect to your WordPress site and read your content when you request it
To generate AI visuals and captions using your content
To publish content to your connected social accounts on your behalf
To process payments through Stripe
To send transactional emails (account verification, password reset, payment receipts)
To investigate security incidents and debug errors

We do not sell your data. We do not use your content to train AI models. We do not send marketing emails without your explicit consent.

4. Legal basis for processing (GDPR)

Contract performance (Art. 6(1)(b)): processing your account data, site connections, and content generation is necessary to deliver the service you signed up for.
Legal obligation (Art. 6(1)(c)): retaining payment records as required by Swedish accounting law.
Legitimate interests (Art. 6(1)(f)): server logs for security purposes.

5. Third-party processors

We share data with the following processors to deliver the service:

Stripe -- payment processing. Processes billing information. Stripe Privacy Policy
Zernio -- social media publishing. Manages OAuth connections to Instagram, Facebook, LinkedIn, TikTok, etc., and handles post delivery. Their platform receives the media files and captions you publish.
FAL.ai -- AI image generation. Receives image URLs and parameters to generate poster visuals. Images are processed per-request and not retained by FAL.ai beyond the generation request.
Anthropic -- AI caption generation. Receives the content text you import from your site to write captions. Processed per-request.
DigitalOcean -- infrastructure. Our servers run on DigitalOcean (Frankfurt region). Your data is stored in the EU.

6. Data retention

Account data: retained until you delete your account.
Generated visuals and uploaded files: retained up to your storage limit. Files older than 30 days may be purged automatically to manage storage. You can delete them at any time.
Server logs: retained for 90 days.
Payment records: retained for 7 years as required by Swedish accounting law.

7. Your rights under GDPR

As a data subject, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your account and associated data
Export your data in a portable format
Object to processing based on legitimate interests
Lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, imy.se)

To exercise any of these rights, contact us at hello@publishonsocialmedia.com. We respond within 30 days.

8. Cookies

The application uses a single httpOnly session cookie to keep you logged in. This is strictly necessary for the service to function. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

9. Security

We protect your data with HTTPS in transit and encryption at rest for sensitive credentials. Passwords are hashed with bcrypt. Our servers are hosted in a DigitalOcean datacenter in Frankfurt (EU) with access restricted to authorized personnel only.

10. Children

This service is intended for business users. We do not knowingly collect data from anyone under 16 years of age.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to active account holders. The updated policy will always be available at this URL with the date of the last revision.

12. Contact

For any privacy-related questions, requests, or concerns:
Email: hello@publishonsocialmedia.com