Last updated: 2026-10-14
This policy explains what personal data ForgeForSocials (the "Service") processes, for what purpose, on what legal basis, and who we share it with. It is written to comply with Regulation (EU) 2016/679 (GDPR).
The controller of your personal data is 21 Mateusz Matejko (owner: Mateusz Matejko), NIP 5833512979, REGON 529056732, ul. Tadeusza Bramińskiego 12/39, 80-180 Gdańsk, Poland.
For any data protection matter, contact: office@forgeforsocials.com.
You connect a social account yourself, through that platform's official sign-in (OAuth). Once connected we store:
What we store per platform:
openid, profile), an access token valid for 60 days; LinkedIn does not issue us a refresh token, so you reconnect after that. We publish on your personal profile (scope w_member_social).business.manage).Disconnecting an account under Accounts immediately deletes its stored access and refresh tokens; only a record of the account itself remains, needed for the history of posts already published.
We do not retrieve or store your friend list, private messages, comments, or any personal data about the people who follow your Page. We request only the permissions technically required to publish content and read Page-level aggregate insights.
In addition to the items below: for X, a shorter version of a post (up to 280 characters, no links), prepared from your text with AI when the original doesn't fit or contains a link.
| Purpose | Legal basis |
|---|---|
| Providing the service — planning, generating and publishing content | Art. 6(1)(b) GDPR (performance of a contract) |
| Account management, login, password reset | Art. 6(1)(b) GDPR (performance of a contract) |
| Notifications about new post proposals and publishing failures | Art. 6(1)(b) GDPR (performance of a contract) |
| Marketing newsletter | Art. 6(1)(a) GDPR (consent — optional, withdrawable at any time) |
| Billing and tax obligations | Art. 6(1)(c) GDPR (legal obligation) |
| Service security and defence of legal claims | Art. 6(1)(f) GDPR (legitimate interest) |
We share data only with processors necessary to operate the Service:
| Processor | Data shared | Purpose |
|---|---|---|
| Meta Platforms Ireland Ltd. | post content, images, access tokens | publishing to Facebook and Instagram, reading Page insights |
| Google Ireland Ltd. | post content, images, access tokens | listing your Business Profiles and publishing posts to them (coming soon) — only after you connect it |
| Google Ireland Limited (Google Analytics) | IP address, device and browser data, traffic source — only with your consent given in the cookie banner | traffic analysis on the Service's public pages (home, login, register, legal documents). Not active on pages behind login |
| X Corp. (for EU users: Twitter International Unlimited Company) | post content, images, access tokens | publishing to X — only after you connect your account |
| LinkedIn Ireland Unlimited Company | post content, images, access tokens | publishing to your LinkedIn profile — only after you connect your account |
| OpenAI, L.L.C. | business profile, post topics and drafts, and photos you add to your photo library | generating and editing post text and images, and describing library photos so the right one can be suggested. We never send your email address or any access token to OpenAI |
| Resend, Inc. | email address and message content | transactional email and newsletter delivery |
| Stripe Payments Europe, Ltd. | email address, plan and billing details; card details are entered directly with Stripe and never reach us | subscription payments and invoices |
| UW-TEAM.ORG Jakub Mrugalski (Mikrus) | all Service data | application and database hosting — servers in a Hetzner data centre in Helsinki, Finland (European Union) |
| Cloudflare, Inc. (R2) | database backups (all Service data) | off-site backup storage, kept for at most 14 days |
Some of these processors are established outside the European Economic Area. Such transfers rely on Standard Contractual Clauses approved by the European Commission. We do not sell your data and we do not share it with data brokers or advertising networks.
Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Business Profile data is used only to show your listings and publish the posts you ask for; we do not sell it, use it for advertising, or use it to train AI models.
You have the right to:
You can delete your account yourself at any time: Settings → Delete account. The operation is immediate and irreversible — it erases the account, all businesses, posts, content proposals, generated images, statistics, and every stored access token for connected social platforms. Database backups are kept for at most 14 days, so data deleted from the Service disappears from them within 14 days at the latest; backups are used only to restore the Service after a failure, never to bring back a deleted account.
Full instructions, including the procedure for people who no longer have access to their account, are on the Data Deletion page.
The Service uses a single strictly necessary session cookie (sync_session) that keeps you
logged in — this cookie is always active and requires no consent.
On the public pages (home, login, register, legal documents) we also use, only after you consent via
the banner shown on your first visit, Google Analytics to analyze traffic. Once you consent, Google's
own cookies (e.g. _ga, _ga_<id>) are set in your browser. You can change
or withdraw your consent at any time by clearing this site's data in your browser settings — declining
or withdrawing it never limits your ability to use the Service. Google Analytics is never active on
pages behind login. We use no advertising cookies and do not profile users for marketing purposes.
All traffic is served over HTTPS. Passwords are stored as bcrypt hashes. Access tokens for social platforms are stored solely to publish on your behalf, are never shared with third parties, and are never displayed in the interface.
We will notify you of material changes by email to the address on your account at least 14 days in advance. The date of the last update is shown at the top of this page.