Social Studio 355Privacy policy
Version: 26 October 2026
This is an English translation. The Polish version is the binding one; if the two differ, the Polish version prevails.
This policy explains what personal data we process on the Social Studio 355 website, in forms, on the blog and in the Social Studio 355 panel, why, on what legal basis, and what rights you have. We apply the General Data Protection Regulation (GDPR, EU 2016/679).
1. Data controller and contact
Controller:
Mateusz Blachnierek, Promno 4a, 62-010 Promno, Poland
Email:
[email protected]We have not appointed a data protection officer. For anything about your data, write to the email address above.
2. What data, why and on what basis
| Situation | Data | Purpose | Legal basis (GDPR) | How long |
|---|
| “Sign up”, “Try it free” or access request form | full name, email, optionally: company name, website or profile address, message | replying to your enquiry, preparing an offer or a panel invitation | Art. 6(1)(b) (steps taken at your request before entering into a contract) and (f) (legitimate interest: replying to a message) | up to 12 months from the last contact, unless we sign a contract |
| Panel account | full name, email, password hash (not the password itself), role in the organization, sign-in sessions | creating and running the account, sign-in, security | Art. 6(1)(b) (contract) and (f) (service security) | while the account exists; after deletion up to 30 days (backups) |
| Free trial and subscription | account data, chosen plan, Stripe customer and subscription IDs, trial and payment dates, payment status (no full card details — Stripe handles those) | providing the service, billing | Art. 6(1)(b) and (c) (tax and accounting obligations) | for the duration of the contract; billing documents — 5 years from the end of the tax year |
| Emails from the panel (invitations, password reset, confirmations) | email, name, message content | account handling | Art. 6(1)(b) | as account data |
| Complaints and reports | data provided in the report | handling the complaint or content report | Art. 6(1)(c) and (f) | until claims become time-barred |
| Click on a shortened link from a post | date and time, channel, a one-off hash of the IP address and browser (the IP address itself is not stored) | aggregate click counts for the client, filtering out bots | Art. 6(1)(f) | 13 months |
| Server logs | IP address, date and time, page address, browser type | security and abuse detection | Art. 6(1)(f) | up to 30 days |
Providing data is voluntary, but without your name and email we can’t reply to the form or create an account. We don’t make decisions about you based solely on automated processing, including profiling.
3. Data that clients process in the panel
Social Studio 355 is a panel for preparing, scheduling and publishing content to connected social media accounts, provided to organizations (e.g. newsrooms and publishers) and to creators — the operator’s clients. Each client’s data is processed to provide the service to that client. For third-party data that a client puts in the panel (e.g. comments, people’s images in materials), the client is the controller, and the operator processes it on the client’s behalf under a data processing agreement (Art. 28 GDPR).
The panel stores company names, IDs and names of connected accounts, granted access tokens, drafts, uploaded photos and videos, scheduled times and the history of requested posts. Passwords to social platforms are entered on those platforms’ own pages. The panel stores users’ password hashes and the sessions needed to sign in. Integration tokens and secrets are encrypted on the server.
The data is used to sign in, show connected accounts, prepare content, carry out explicitly approved requests and check their results. When connecting TikTok, the app requests user.info.basic, video.upload and — once direct posting is enabled — video.publish. The TikTok account name and avatar are used to show which account a video will go to. A video is posted to the TikTok account only after the user explicitly confirms, with the visibility, interaction settings and commercial content disclosure the user chose, or it is sent to the TikTok inbox where the user finishes posting. The panel doesn’t change the video content and doesn’t add watermarks.
Google: YouTube and Google Drive. Social Studio 355 uses YouTube API Services. When connecting a YouTube channel, the app requests the youtube.readonly scope (reading the channel, videos and stats), youtube.upload (uploading videos) and youtube.force-ssl (managing videos and comments) — only to show which channel a video will go to, publish a video the user approved, show its stats and let the user reply to comments. When connecting Google Drive, the app only requests access to files the user picks or creates through the panel (the drive.file scope) and the account’s email address. By using the YouTube integration you agree to the YouTube Terms of Service, and Google processes data in line with the Google Privacy Policy. You can revoke access at any time in the panel (disconnecting the channel deletes the tokens immediately) or on your Google account permissions page. We’ll delete any other Google data at your request within 30 days — see Data deletion.
Social Studio 355’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t sell Google data, don’t use it for advertising or to train artificial intelligence models, and don’t let people see it except when the user asks for it, or when security or the law requires it. The text of a YouTube comment is sent to OpenAI only when the user asks for a reply suggestion; OpenAI doesn’t use data sent through its API to train models.
Link clicks. If a client has link tracking turned on, a link in the post text (Facebook, X, YouTube, Dailymotion) is replaced with a short Social Studio 355 address, separate for each channel. When someone clicks it, we record the date and time and a one-off salted hash built from the IP address, browser and date — the IP address itself is not stored, and the hash changes every day, so it can’t be used to track a person across days. Clicks from bots (e.g. link previews) aren’t counted. This serves only to show the client the total number of clicks per platform. We delete click data after 13 months.
Assistant and graphics generator. If a client turns on the assistant (a Telegram bot, an app in ChatGPT or the generator), the uploaded photo and text are sent to OpenAI to translate and summarize the material, prepare the graphic text and post caption, and — when a photo contains text — remove it from the image. Messages with the bot pass through Telegram’s servers. OpenAI doesn’t receive platform access tokens, and a ready suggestion goes to publishing only after the user approves it.
Comments and reply suggestions. The panel fetches from connected channels (Facebook, Instagram, YouTube) the comment text, the author’s name and profile picture and post statistics, so they can be replied to and analysed. A reply is published only after explicit approval by a panel user. To prepare a reply suggestion, the panel sends OpenAI the text of the comment, thread and post, this author’s earlier comments under the company’s posts and the company’s guidelines; OpenAI doesn’t receive access tokens. The operator’s optional ChatGPT assistant has access to the same data through a token that can be revoked at any time.
Drafts, files and history are kept for the duration of the cooperation with the client, or until deleted at the client’s request or by the operator. Disconnecting an integration deletes its local tokens; it doesn’t delete materials already sent to the platform. You can additionally revoke the platform’s consent in its settings. Backups are used to restore the service and may contain earlier data until the operator deletes the backup. Content published on social media is deleted separately on the given platform. Data deletion instructions: /en/data-deletion.
4. Who we share data with
- the server and hosting provider on which the website and panel run,
- the email provider we send messages through,
- social platforms (Meta — Facebook and Instagram, Google — YouTube, TikTok, X, Dailymotion) — only as part of a connection or a post you requested; the platforms process data under their own rules,
- OpenAI — when preparing comment reply suggestions and in the assistant and graphics generator, as described above,
- Telegram — when you use the Social Studio 355 bot in Telegram,
- Cloudflare, Inc. — handles traffic to the website and panel (attack protection, encrypted connection),
- the payment operator Stripe Payments Europe, Ltd. (Ireland) — when you add a card and pay for a subscription; full card details go directly to Stripe, we don’t see or store them,
- public authorities, when the law requires it.
Some of these recipients (e.g. OpenAI, Meta, Google, Stripe, Cloudflare, Telegram) are based outside the European Economic Area, mainly in the USA. Transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission. You can get a copy of the safeguards by writing to the contact address. We don’t sell data.
5. Cookies and browser storage
The website and panel use only strictly necessary cookies: the sign-in session, protection of forms against forgery (CSRF) and your language choice. The panel also stores your appearance settings (e.g. light or dark theme) in browser storage. We don’t use analytics or advertising cookies and have no third-party tracking tools on the site. These necessary files don’t require consent (Art. 399(3) of the Polish Electronic Communications Law). You can delete them in your browser settings — you’ll then be signed out.
6. Your rights
You have the right to: access your data and get a copy, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. If processing is based on consent, you can withdraw it at any time without affecting earlier processing. We reply within one month. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in your country.
7. Changes to this policy
We’ll announce material changes on this page, and notify panel users by email too. The date of the current version is always shown at the top.