This policy explains what personal data is processed by the social media publishing service available at post.andmark.net (the “Service”) and by the website andmark.net, why it is processed, and what rights you have.
1. Who is responsible
The Service is operated by Mark Andriienko, a private individual who is the controller of the personal data described in this policy. Contact: privacy@andmark.net.
2. Who uses the Service
The operator provides the Service to his clients as part of his marketing services. Each client receives access from the operator; there is no public registration. Clients, the people they authorize and the operator use the Service to publish content to social media accounts that the client owns or is authorized to manage. Where a client asks the operator to prepare or publish content on its behalf, the operator works in that client’s workspace.
3. Data we process
Data from connected platforms
When an account is connected through a platform’s own authorization screen, the Service receives and stores:
- identifiers of the connected account, page or channel, its name or username and its profile picture;
- the list of pages, accounts or channels you manage, so you can choose which ones to connect;
- access tokens and refresh tokens issued by the platform;
- publishing results, such as post identifiers, links and status;
- statistics for published content and connected accounts, where the platform provides them, such as views, reactions and follower counts.
Content you create
Text, images, video, drafts and scheduling settings that you prepare in the Service.
Sign-in data
The name, email address and login credentials of each client and other authorized user of the Service.
Technical data
When you visit andmark.net or the Service, the web server may record your IP address, the date and time of the request, the requested address and your browser’s user agent in its logs. The Service uses cookies that are strictly necessary to keep you signed in. The website andmark.net sets no cookies and loads no resources from third parties.
We do not sell personal data, use it for advertising, or use it to build profiles of people.
4. Purposes and legal bases
- Providing the Service to clients, including publishing content and showing its results: performance of the agreement with the client (Article 6(1)(b) GDPR) and legitimate interests in managing social media accounts (Article 6(1)(f) GDPR), together with your consent given on the platform’s authorization screen (Article 6(1)(a) GDPR), which you can withdraw at any time as described in section 5.
- Signing in and protecting the Service against misuse: legitimate interests in operating a secure service (Article 6(1)(f) GDPR).
- Complying with legal obligations, where applicable (Article 6(1)(c) GDPR).
5. Connected platforms
Each platform also processes data under its own privacy policy. The sections below describe how the Service uses each platform and how you can revoke its access.
Meta: Facebook, Instagram and Threads
The Service uses Meta’s APIs with permissions that allow it to list the Facebook Pages, Instagram accounts and Threads profiles you manage, publish content you choose to them, and read engagement and statistics for that content. Meta’s privacy policy: facebook.com/privacy/policy.
To revoke access, remove the app in your Facebook settings under Business integrations, or in the app and website permissions of your Instagram or Threads settings. See also Data deletion.
YouTube and Google
The Service uses YouTube API Services. By using the YouTube features of the Service, you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy: www.google.com/policies/privacy.
The Service requests the following Google OAuth scopes:
https://www.googleapis.com/auth/userinfo.profileto read the identifier, name and picture of the Google account that connects the channel;https://www.googleapis.com/auth/youtube.uploadto upload videos that you choose, and their thumbnails, to your channel;https://www.googleapis.com/auth/youtube.readonlyto read the details of your channel and of the videos uploaded through the Service;https://www.googleapis.com/auth/yt-analytics.readonlyto show statistics for your channel and videos.
Data obtained through YouTube API Services is used only to provide these functions to you and is not shared with anyone else. Channel statistics and YouTube Analytics data are kept while the channel stays connected, and the Service checks at least every 30 days that its access has not been revoked. Other data obtained through YouTube API Services, such as channel and video details, is refreshed or deleted within 30 days. The Service’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can stop the Service’s access to your YouTube data in two ways:
- Disconnect the channel in the Service or ask for deletion as described on the Data deletion page. The access token is revoked and the YouTube data stored for that channel is deleted within 7 calendar days.
- In addition to that, you can revoke the Service’s access at any time on the Google security settings page: security.google.com/settings/security/permissions. The YouTube data stored for that channel is then deleted within 30 calendar days.
Deleting data stored by the Service does not delete anything on YouTube. To delete videos or other content from YouTube, use YouTube itself.
TikTok
The Service uses TikTok Login Kit and the Content Posting API. It requests the following scopes:
user.info.basicto read the identifier, display name and avatar of your TikTok account;user.info.profileto read the username of your account, so that you can see which account you are posting to;user.info.statsto read the follower, following, like and video counts of your account and show them as account statistics;video.uploadto send the videos and photos you choose to your TikTok account as drafts, which you finish and post in the TikTok app;video.publishto publish the videos and photos you choose directly to your TikTok profile.
Before each direct post, the Service asks TikTok which privacy levels and interaction settings are available for your account and shows your account name. Each post is published only with the privacy level and the comment, Duet and Stitch settings that you select for it. TikTok’s privacy policy: tiktok.com/legal/privacy-policy.
To revoke access, remove the app in the app permissions section of your TikTok settings.
Telegram
The Service publishes to Telegram channels through a bot controlled by the operator, which must be added as an administrator of the channel. It does not use Telegram to collect personal data about channel subscribers. Telegram’s privacy policy: telegram.org/privacy.
The Service uses the Pinterest API to read your profile and boards and to create Pins on the boards you choose. It receives your Pinterest account identifier, username and profile picture, and the names of your boards. Pinterest’s privacy policy: policy.pinterest.com/en/privacy-policy.
To revoke access, remove the app in the apps section of your Pinterest settings.
X
The Service uses the X API to publish posts, including images and video, that you choose to your X account. It receives your X account identifier, name, username and profile picture. X’s privacy policy: x.com/en/privacy.
To revoke access, remove the app in the connected apps section of your X settings.
The Service uses the LinkedIn products Sign In with LinkedIn using OpenID Connect and Share on LinkedIn. It requests the following permissions:
openidandprofileto read the identifier, name and profile picture of your LinkedIn account;w_member_socialto publish posts, including images, video and documents, that you choose to your LinkedIn profile.
LinkedIn’s privacy policy: linkedin.com/legal/privacy-policy.
To revoke access, remove the app under Permitted services in the Data privacy section of your LinkedIn settings.
6. Sharing
Content and the data needed to publish it are sent only to the platform you choose to publish to. The data of one client is not shown to other clients. The servers that run the Service are rented from Hetzner Online GmbH, which processes data on the operator’s behalf as a hosting provider. Personal data is not disclosed to anyone else, except where required by law.
The platforms listed in section 5 may process data outside the European Economic Area under their own terms and privacy policies.
7. Retention
- Account data and tokens from a platform are kept until the account is disconnected from the Service, deletion is requested or the client’s access to the Service ends, and are then deleted.
- Content, drafts and media are kept until they are deleted in the Service. Content already published stays on the platform and is governed by that platform’s terms; delete it there if you want it removed.
- Data obtained through YouTube API Services is kept and deleted in line with the YouTube API Services Developer Policies.
- Server logs are kept for a limited period for security and troubleshooting, and are then deleted.
8. Security
Access to the servers that run the Service is restricted to the operator. Each client and authorized user signs in with their own account. Connections to the Service use HTTPS.
9. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw consent at any time without affecting processing that took place before. To exercise these rights, write to privacy@andmark.net. Requests are answered within one month; requests to delete data obtained through YouTube API Services are completed within 7 calendar days.
You also have the right to lodge a complaint with a data protection supervisory authority.
10. Children
The Service is not intended for children and is not used to process data about children.
11. Changes
If this policy changes, the new version is published on this page with a new effective date.
12. Contact
Mark Andriienko. Email: privacy@andmark.net.