Imbition Social Manager

Privacy Policy

How Imbition Social Manager processes personal data.

Effective 10 November 2026

Who operates the service

Rok Terziev s.p., Cesta Jaka Platise 21, 4000 Kranj, Slovenia, operates this self-hosted Postiz instance and is the controller for personal data it uses to administer, provide, and secure the service. For privacy inquiries or requests, contact rok.terziev@gmail.com. If you use an organization’s workspace, that organization may separately determine how personal data in its content and connected channels is used.

Information we handle

• Workspace data. Your name and email where provided, login and session information, workspace membership and roles, preferences, and correspondence you send us.
• Content and publishing data. Drafts, captions, uploaded images and videos, schedules, selected destinations, and publishing results such as post IDs, links, status, and errors.
• Meta API data. When you connect Facebook or Instagram, Meta may return account or Page identifiers, names, handles and profile images, information about Pages you can manage and associated Instagram professional accounts, and post or insights data where the integration has permission to access it.
• TikTok API data. When you connect TikTok, TikTok may return account identifiers, username, display name and avatar, available publishing settings and account capabilities, and publishing identifiers and status.
• Connection credentials. We exchange OAuth authorization codes with the platform and keep access tokens, refresh tokens where issued, and related expiration or permission information as needed to operate the connection. Sign-in for a connected platform takes place on that platform.
• Technical data. IP addresses, request timestamps, browser details and error information may appear in service or hosting logs. The signed-in workspace uses session cookies. The public legal pages set no cookies and include no analytics or advertising scripts.

We receive this information from you, your workspace administrator, the social platform you authorize, or the systems that operate the service. Platform permissions, account eligibility, and enabled features determine what data the integration can access.

Purposes and legal bases

• Provide the requested service. We use workspace and connection data to authenticate users, link channels, prepare and publish content, display supported results, and provide support. Where you are a party to the service agreement and processing is necessary to perform it, we rely on Article 6(1)(b) GDPR. For authorized users of organizational workspaces, we rely where appropriate on our and the organization’s legitimate interests in operating the workspace under Article 6(1)(f).
• Operate and secure the service. We use limited account, support, and technical information to diagnose faults, prevent misuse, and protect the service under our legitimate interests in reliable and secure operation (Article 6(1)(f)).
• Comply with law. We process information as required for applicable legal obligations, including responding to data protection requests (Article 6(1)(c)).

Connecting a social account is optional. Without the necessary permissions, we cannot perform the corresponding actions on that account. We use platform data for the authorized integration features and related support, security, and compliance. We do not sell Meta or TikTok API data or use it for targeted advertising.

Sharing and international processing

Authorized workspace members can see channel and publishing information according to their access. We send the required credentials, content, media and publishing instructions to the social platform you select. Meta and TikTok process information under their own policies. Public posts can be viewed and shared according to platform settings. If you email us, our email provider handles the message and reply.

Railway hosts this Postiz deployment and its attached media storage. The Postiz application and upload volume are deployed in the Netherlands. Hosting providers and social platforms may also process data in other countries, including the United States. Where GDPR transfer rules apply, transfers require a valid mechanism such as an adequacy decision or applicable standard contractual clauses. See the Railway Data Processing Addendum for Railway’s transfer terms, and contact rok.terziev@gmail.com for information on applicable safeguards. We may disclose information where required by law.

Retention and deletion

We keep account and workspace data for as long as needed to provide the service and handle closure or deletion. We keep drafts, uploads, and publishing history while they are needed for the workspace and subject to deletion requests and platform requirements. We use tokens only for active authorized connections. Disconnecting a channel stops new activity through that connection. To remove platform-derived data that is still stored by the service, follow the data deletion instructions.

We keep technical and support records only as long as needed for troubleshooting, security, support, or legal obligations. Any residual copies in backups are restricted to recovery and expire as backups rotate. Platform-specific deletion deadlines apply where they require earlier deletion.

Your rights

Where the GDPR applies, you can request access, correction, erasure, restriction, or portability where the relevant conditions are met. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time. You can also revoke social platform permissions through the platform. To exercise your rights, email rok.terziev@gmail.com. You can lodge a complaint with your local supervisory authority, including the Information Commissioner of Slovenia.