Privacy Policy
Last updated: October 26, 2026. If the Romanian and English versions differ, the Romanian version prevails.
In short: we use your data only to publish your posts and show you their statistics. We do not sell it, use it for advertising or use it to train AI models. You connect social accounts through each network's official login, so we never see your passwords. You can disconnect a channel or delete your account at any time.
1. Who we are
Postero (the website postero.ro and the application app.postero.ro) is operated by RANKO HUB SRL, registered office: Bd. Mihai Viteazu 47, Bl. 92, Sc. 2, Et. 3, Ap. 13, Vulcan, Hunedoara County, 336200, Romania, tax ID (CUI) 51588879, Trade Register no. J2025024930001 (EUID ROONRC.J2025024930001) ("we").
We are the controller of your account data under the EU General Data Protection Regulation ("GDPR"). For data you upload on behalf of other people (for example your clients), we act as a processor under our Data Processing Agreement.
Privacy contact: [email protected].
2. Data we process
- Account data: first and last name, email address, password (stored only as a bcrypt hash), optional profile picture and bio, time zone, organization or team name and your role, IP address and browser type at sign-in, last activity date.
- Connected social accounts (Facebook, Instagram, LinkedIn, X, TikTok, Pinterest), received with your consent and only within the permissions you approve: account or page ID, name, username and profile picture; the pages or accounts you choose to use; access tokens issued by the network; account and post statistics (such as impressions, engagement and followers) where the network provides them. We never receive or store your social media passwords.
- Your content: texts, images and videos you upload, scheduling dates and times, post settings, internal team comments, and comments left by your clients on preview links (display name and comment text).
- Team members: name and email address of the people you invite.
- Technical data: server logs (IP address, date and time, page requested, browser type), used for security and troubleshooting.
- Messages to us: the content of emails you send to [email protected].
We do not process payment data during the beta.
3. Purposes and legal bases
- Creating and managing your account, publishing scheduled posts, showing statistics, team collaboration: performance of a contract (Art. 6(1)(b) GDPR).
- Service security, abuse prevention and troubleshooting: legitimate interest (Art. 6(1)(f)).
- Replying to your messages and requests, including beta access requests: pre-contractual steps and legitimate interest (Art. 6(1)(b) and (f)).
- Complying with legal obligations: legal obligation (Art. 6(1)(c)).
We do not sell personal data, do not use it for advertising, and do not make automated decisions with legal effects on you.
4. Data received from social networks
Data received through the APIs of Meta (Facebook and Instagram), LinkedIn, X, TikTok and Pinterest is used solely to provide the features you request: connecting your accounts, publishing the content you choose at the time you choose, and showing statistics in your account. We do not sell this data or share it with ad networks, data brokers or other third parties beyond the providers listed in section 6. We do not use it to build user profiles or to train AI models. We comply with each network's developer terms (Meta Platform Terms, TikTok Developer Terms of Service, LinkedIn API Terms of Use, X Developer Agreement, Pinterest Developer Guidelines). You can revoke Postero's access at any time, from Postero or from the network's settings. See Data deletion.
5. AI features
If you use the AI assistant to generate or rewrite text or images, your request (the instruction and, where relevant, the post content) is sent to OpenAI to generate the result. Under OpenAI's API terms, data sent this way is not used to train their models. If you do not use AI features, nothing is sent to OpenAI.
6. Who we share data with
- Hetzner Online GmbH: server and database hosting, data center in Finland (EU).
- Cloudflare, Inc.: DNS, protection and secure (HTTPS) delivery of the website and app, forwarding of emails sent to [email protected]. Global network, US company.
- OpenAI, L.L.C.: text and image generation, only when you use AI features. USA.
- The social networks you connect, when you ask us to publish. They become independent controllers of the published content under their own policies.
- Your team members and the people you send preview links to.
- Authorities, only where the law requires it.
7. International transfers
Our servers are in the European Union. Cloudflare and OpenAI are US companies. Transfers to them rely on the EU-U.S. Data Privacy Framework, under which they are certified, and/or the European Commission's Standard Contractual Clauses.
8. Retention
- Account and content: while your account is active. After the account is deleted, we erase them within 30 days.
- Social network access tokens: a disconnected channel stops being used immediately and its tokens are permanently erased within 30 days.
- Technical logs: up to 90 days.
- Emails sent to us: as long as needed to reply, and at most 3 years.
- Backups: overwritten on a rolling basis within 12 months. They are used only for incident recovery.
9. Security
All traffic is encrypted (HTTPS/TLS). Passwords are stored only as bcrypt hashes. Databases are not reachable from the internet, only from the server's internal network. Administrative access to servers is restricted and protected against repeated access attempts. Only authorized staff can access data, on a need-to-know basis. We keep our software up to date.
10. Your rights
Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on our legitimate interest. Email [email protected], ideally from your account address, and we will reply within 30 days. You may also lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or with the authority in your EU country of residence.
11. Cookies
The website postero.ro uses no cookies and no analytics or advertising tools. The app app.postero.ro uses only strictly necessary cookies: a session cookie that keeps you signed in, cookies that remember your selected organization and language, and a temporary security cookie used while connecting social accounts. These do not require consent.
12. Children
Postero is intended for people over 16 and for businesses. We do not knowingly collect children's data. If you believe a child has sent us data, contact us and we will delete it.
13. Changes
If we materially change this policy, we will notify you by email or in the app before the changes take effect.
14. Contact
RANKO HUB SRL, Bd. Mihai Viteazu 47, Bl. 92, Sc. 2, Et. 3, Ap. 13, Vulcan, Hunedoara County, 336200, Romania · [email protected]