Privacy Policy
Updated · Multi Post Social guide
This privacy policy explains what Multi Post Social collects when you use the website and the product, why we collect it, how long we keep it, who we share it with and the rights you have. It is written for the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and similar laws. Effective date: October 27, 2026.
1. Who is responsible
Multi Post Social is the data controller for the personal data described here. Questions, requests and complaints go to [email protected]. If you are a client of an agency that uses Multi Post Social on your behalf, that agency is the controller for the content it manages and we process it under their instructions.
2. What we collect
- Account data: name, email address, password hash, time zone, avatar settings, two-factor status, plan and billing cycle.
- Connected-channel tokens: the access tokens each social network issues when you connect a channel, plus the channel's public identifiers, name, follower count and posting schedule. We never receive your network password.
- Post content: text, media, links, tags, notes, approval decisions and scheduling data for the posts you create.
- Inbox content: comments, direct messages, mentions and reviews that networks deliver to your connected channels, including the public names and handles of the people who wrote them, and your replies.
- Analytics data: impressions, reach, engagement and click counts that networks report for your posts and channels.
- Usage logs: IP address, browser type, pages viewed, actions taken, timestamps and error reports, used for security and to keep the service working.
- Billing data: handled by our payment processor; we store the plan, invoices and the last four digits of a card, never the full number.
- Support messages: what you send us by email or through the contact page.
3. Why we use it and on what legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide the service: publishing, inbox, analytics, collaboration | Account, tokens, post content, inbox content, analytics | Performance of a contract |
| Keep accounts secure and prevent abuse | Usage logs, account data | Legitimate interest; legal obligation |
| Billing and invoices | Account and billing data | Performance of a contract; legal obligation |
| Support and answering requests | Support messages, account data | Performance of a contract |
| Product emails about your account (failed posts, approvals, reports) | Account data, notification preferences | Performance of a contract |
| Product news (optional) | Email address | Consent, withdrawn any time |
| Improving the product with aggregated usage statistics | Usage logs, aggregated | Legitimate interest |
We do not sell personal data, and we do not use your post or inbox content to train AI models. AI features process the text you submit only to return a suggestion to you.
4. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While the account exists, then deleted within 30 days of account deletion |
| Connected-channel tokens | Until the channel is disconnected or the account is deleted; revoked at the network at that moment |
| Post content and approvals | While the account exists; drafts and published records deleted with the account |
| Inbox content | According to your plan’s history limit, then rolled off; deleted with the account |
| Analytics data | According to your plan’s analytics history; aggregated data may be kept without identifiers |
| Usage and security logs | 12 months |
| Invoices | As long as tax law requires, typically 7 to 10 years |
| Support messages | 24 months after the conversation closes |
5. Who we share it with
- Social networks: to publish your posts and read your analytics and inbox, we send and receive data through each network's official API under the permissions you granted. Each network's own privacy policy applies to what happens there.
- Payment processor: handles card and PayPal payments; we receive confirmation and a token, not your card number.
- Hosting and infrastructure: the website and product run on Cloudflare's network and storage.
- Email delivery: a transactional email provider sends account and notification emails.
- Team members and clients you invite: see the workspace data their role allows.
- Authorities: only when the law requires and after review of the request.
Providers act as processors under written agreements and may not use your data for their own purposes.
6. International transfers
Our infrastructure stores data in several regions, and the social networks you connect operate worldwide. Where personal data leaves the European Economic Area or the United Kingdom, we rely on standard contractual clauses or an adequacy decision, and on the processor's own certified transfer mechanisms.
7. Your rights
Depending on where you live, you can:
- Access the personal data we hold about you.
- Export your workspaces as a machine-readable file from Settings → Data.
- Correct inaccurate data in Settings or by asking us.
- Delete your account and data from Settings → Danger zone, or by email.
- Object to processing based on legitimate interest, or restrict it.
- Withdraw consent for product news with the unsubscribe link.
- Complain to your local data-protection authority.
California residents have the right to know, delete and opt out of sale; we do not sell personal data and do not discriminate for exercising rights. We answer requests within 30 days and may ask you to confirm your identity first.
8. Cookies and local storage
The website uses only strictly necessary cookies and local storage for sessions, preferences and the browser demo. We set no advertising cookies and no third-party analytics cookies by default. The cookie policy lists each item.
9. Children
Multi Post Social is for people aged 16 and older. We do not knowingly collect data from younger children; if you believe a child has created an account, email us and we will delete it.
10. Security
Tokens are encrypted at rest, traffic is encrypted in transit, two-factor authentication is available on every plan and access inside the company is limited to people who need it. The security guide explains the controls in plain words and how to report a vulnerability.
11. Changes to this policy
We will post changes here with a new effective date and, for material changes, email account owners at least 14 days before they take effect.
12. Contact
Email [email protected] for any privacy question or request, or use the contact page.