Fabria · Wersja polska

PostFabria app privacy policy

This is an English translation. If the two versions differ, the Polish version prevails.

Effective from: 6 November 2026

1. Who is responsible for the data

The controller of the data processed in the PostFabria app is:

Emanuel Maciołek Fabria

ul. Józefa Sawy-Calińskiego 102A, 31-999 Kraków, Poland

Tax ID (NIP) 6782631030

email: kontakt@fabria.pl

2. What PostFabria is

PostFabria is Fabria's internal tool for preparing and publishing posts on the social media accounts of the company and its clients (Facebook, Instagram, LinkedIn, YouTube). The app is used only by people for whom the company has created an account. It is not intended for the public and does not collect data about profile visitors or follower lists.

3. What data we process

a) Data from connected Meta accounts (Facebook and Instagram), when a person with access to a business Page connects it to the app:

• the access token for the Facebook Page and the linked Instagram account (business or creator),
• the Page ID and name and the Instagram account ID,
• IDs and URLs of posts and comments published by the app.

b) Data from LinkedIn, when a person connects their profile:

• the access token and its expiry date,
• the profile identifier (the "sub" field from LinkedIn's OpenID service),
• IDs and URLs of posts and comments published by the app.

c) YouTube data, when a person who manages a channel connects it to the app through a Google account:

• access token and refresh token,
• channel ID and name,
• IDs and URLs of videos published by the app,
• aggregate statistics for those videos and the channel (e.g. views, likes, comments, watch time).

d) Data of people who log in to the app's dashboard:

• login, password hash (we do not store passwords in plain text), second-factor login data,
• IP address, browser information, and the time of logins and login attempts.

e) Post content, graphics and recordings prepared in the app.

f) Comments under our posts on Facebook and Instagram. We read them together with the author's name to show them to the person who replies. In the app we store only the comment text, the time it was posted and whether we replied, without the author's name.

We do not collect friend, follower or subscriber lists or private messages. The statistics we collect are aggregate (numbers for a post, video or account), with no data about specific individuals.

4. Purpose and legal basis

• Publishing posts and the first comment on the selected Pages and profiles at the times approved in the dashboard (Art. 6(1)(b) GDPR, performance of the service; for clients' Pages, Art. 6(1)(f), the legitimate interest of running their communication on their behalf).
• Statistics of published content: aggregate numbers of views and reactions, so the account owner can see in the dashboard what works (Art. 6(1)(f) GDPR, legitimate interest).
• Dashboard security: detecting unauthorised login attempts (Art. 6(1)(f) GDPR).

We use data from Meta, LinkedIn and Google (YouTube) only to publish the content indicated by the user, show its statistics and reply to comments. We do not sell it, use it for advertising or profiling, or share it with anyone other than the parties listed below.

5. Who the data is shared with

• Meta Platforms and LinkedIn: only to the extent needed to publish (we send the post content and the access token).
• Google (YouTube): only to the extent needed to publish videos and read their statistics.
• The provider of the server the app runs on: OVHcloud (server in the European Union).
• Providers of services used to create content (for example a language model for text drafts, speech synthesis for voice-overs in recordings) receive the content of the material and, when handling comments, the comment text, with no tokens and no data from social media accounts.

6. How long we keep the data

• Tokens and account IDs: until the account is disconnected in the dashboard, access is revoked in Facebook or LinkedIn settings, or deletion is requested. LinkedIn tokens expire on their own after about 60 days.
• YouTube tokens and channel IDs: until the channel is disconnected in the dashboard, access is revoked in the Google account settings, or deletion is requested. After disconnection or revocation we delete the tokens and data obtained from YouTube within 7 days.
• Statistics: refreshed at least every 30 days and kept for the duration of the cooperation.
• Data about published posts: for the duration of the cooperation, and then up to 12 months for billing and any complaints.
• Login log: up to 12 months.

7. Rights of data subjects

You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object. You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland). For these matters, write to kontakt@fabria.pl.

8. Deleting data

How to delete data from the app is described here: https://fabria.pl/en/postfabria/data-deletion/

9. Changes to this policy

We announce changes on this page, with a new effective date.

10. YouTube

PostFabria uses YouTube API Services to publish videos on connected YouTube channels and to read their statistics. By connecting a channel you agree to the YouTube Terms of Service. Data processed by Google within these services is described in the Google Privacy Policy. You can revoke the app's access to your Google account at any time at https://myaccount.google.com/connections (or https://security.google.com/settings/security/permissions), or by disconnecting the channel in the dashboard.