Privacy Policy
Effective date: 7 October 2026
This Privacy Policy explains how MPP Financial Services SE processes personal data in connection with Posto+, a social media management service available at posto.plus and app.posto.plus (the “Service”).
1. Controller and contact details
MPP Financial Services SE
Company ID (IČO): 013 83 841
Registered office: Krymská 238/18, Vršovice, 101 00 Prague 10, Czech Republic
Registered in the Commercial Register maintained by the Municipal Court in Prague, file No. H 1088
Email: [email protected]
2. Our role
We act as a data controller for account, billing, support, website and security data that we use to operate Posto+.
When a customer connects a social network and uses Posto+ to create, schedule, publish, analyse or manage content on the customer’s behalf, the customer normally determines the purposes and means of that processing. For such customer-controlled data, the customer is the controller and we act as its processor. Customers are responsible for ensuring that their use of the Service and their instructions to us comply with applicable law.
3. Personal data we process
Depending on how you use the Service, we may process:
- Account and workspace data: name, email address, account identifier, profile image, language, role, workspace membership, settings and authentication records.
- Connected social account data: social network identifiers, account or page names, usernames, profile images, permissions, access and refresh tokens, and connection status.
- Content and communications: posts, captions, drafts, media, schedules, comments, messages or other content you choose to process through the Service, where the relevant feature is enabled and authorised.
- Analytics data: post and account statistics, audience and engagement metrics, and other insights made available by connected social networks.
- Usage and technical data: IP address, browser and device information, timestamps, log data, pages or features used, cookies and similar technical identifiers.
- Billing data: plan, subscription and transaction records. Payment card details may be processed directly by a payment provider and are not necessarily stored by us.
- Support data: messages, attachments and other information you provide when contacting us.
4. Sources of data
We obtain data directly from you, from members of your workspace, automatically when you use the Service, and from social networks or other services that you choose to connect. Posto+ uses the official authorisation processes and APIs of supported services. We do not ask for or store your social network password.
5. Why we process data and our legal bases
- Providing the Service and performing our contract: creating and administering accounts, connecting social profiles, scheduling and publishing content, providing analytics, collaboration and support.
- Legitimate interests: securing and improving the Service, preventing fraud and abuse, troubleshooting, maintaining operational records and communicating important service information, provided those interests are not overridden by your rights.
- Legal obligations: keeping accounting and tax records, responding to lawful requests and meeting other obligations under applicable law.
- Consent: where consent is required, for example for optional cookies or certain marketing communications. You may withdraw consent at any time.
6. Connected social networks and third-party services
The Service may connect to services such as Facebook, Instagram, Threads, LinkedIn, X, TikTok, Pinterest, YouTube and other Google services, Bluesky, Mastodon, Pixelfed and Google Business Profile. We process data received through their APIs only to provide features requested by the user, maintain the connection, publish or retrieve authorised content, and display permitted analytics or interactions.
Your use of a connected service is also governed by that provider’s terms and privacy policy. Providers may change or restrict their APIs at any time. You can revoke Posto+ access in the connected service’s account settings or by disconnecting the account in Posto+.
Data obtained from Google APIs is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
7. Recipients and service providers
We do not sell personal data. We may disclose data only as necessary to:
- hosting, storage, security, content delivery, email, customer support, payment and other technology providers acting on our behalf;
- the social networks and services you instruct Posto+ to connect to or publish to;
- professional advisers, auditors or insurers subject to confidentiality duties;
- public authorities where disclosure is required by law or necessary to protect legal rights; or
- a successor in connection with a merger, restructuring or transfer of the Service, subject to appropriate safeguards.
Service providers may process data only under our instructions and appropriate contractual obligations where required.
8. International transfers
Some social networks and service providers operate outside the European Economic Area. Where we transfer personal data internationally as a controller, we use a lawful transfer mechanism and appropriate safeguards as required by applicable data protection law. Connected social networks may also process data internationally under their own privacy terms.
9. Retention
We retain personal data only for as long as necessary for the purposes described above:
- account, workspace, content and analytics data are generally retained while the account is active and are deleted or anonymised after account closure or a verified deletion request, unless continued retention is required by law or for legal claims;
- social network tokens and connection data are deleted or invalidated without undue delay when the relevant account is disconnected or the Posto+ account is deleted;
- security and technical logs are normally retained for up to 12 months;
- support records are normally retained for up to 3 years after the request is resolved; and
- billing, accounting and tax records are retained for the periods required by Czech law, which may be up to 10 years.
Residual copies may remain temporarily in protected rolling backups and are removed when those backups are overwritten. Backups are used only for security and disaster recovery.
10. Data deletion instructions
You can request deletion of your Posto+ account and personal data at any time:
- Disconnect any social accounts in the Posto+ account settings or revoke Posto+ access directly in the relevant social network’s settings.
- Send a deletion request from your registered email address to [email protected]. Include the email address of your Posto+ account and, if relevant, the workspace and connected account concerned.
- We may ask for information necessary to verify your identity and protect the account. We will confirm the action taken without undue delay and normally within one month.
Disconnecting an account or deleting data from Posto+ does not delete content that has already been published to a social network. Published content must be deleted directly on the relevant social network.
11. Your data protection rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent. You may submit a request to [email protected].
You also have the right to lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, uoou.gov.cz, or with another competent supervisory authority.
12. Cookies
Posto+ uses cookies and similar technologies that are necessary for sign-in, security, session management and user preferences. If we introduce optional analytics or marketing cookies, we will provide appropriate information and request consent where required.
13. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No online service is completely secure, and users are responsible for protecting their login credentials and promptly reporting suspected unauthorised access.
14. Children
The Service is intended for users aged 18 or older and is not directed to children. If you believe a child has provided personal data to us, contact us so that we can take appropriate action.
15. Changes to this Policy
We may update this Privacy Policy to reflect changes to the Service, law or our processing practices. We will publish the updated version on this page, change the effective date and provide additional notice where required.
16. Contact
Questions, requests and complaints concerning privacy or the Service may be sent to [email protected].