1. Who is responsible for your data
SocialFox (socialfox.pl) is a platform for running social media. It is used by marketing agencies and marketing teams ("Agencies"), each in its own workspace at its own address (e.g. name.socialfox.pl), and by the Agencies' clients in the client portal.
The platform is run by Alfabet Marki sp. z o.o., ul. Strzałowa 13K/1, 87-100 Toruń, Poland, tax ID (NIP) 956 239 91 18, KRS 0001147842 ("we").
Contact for personal data matters: [email protected].
2. Whose data we process and in what role
- SocialFox users: owners and members of Agency teams and persons in the client portal. We process account, sign-in and billing data as a controller.
- People interested in SocialFox: whoever leaves an address on the home page or registers. We process this data as a controller.
- Data inside an Agency's workspace: posts, materials, the Agency's clients' data, connected profiles and the data of people who comment on posts or write messages to those profiles on Facebook, Instagram, LinkedIn, TikTok and YouTube. The controller of this data is the Agency (or its client, under their agreement). We process it on the Agency's behalf as a processor under the Data Processing Agreement (Art. 28 GDPR): socialfox.pl/en/dpa.
- People who connect their pages and accounts to SocialFox (signing in with Facebook, Google, LinkedIn or TikTok) in an Agency's workspace: we process the connection data on the Agency's behalf as a processor.
3. What data we process
SocialFox account
- first and last name, e-mail address, profile picture;
- when signing in with Google, Apple, Facebook or X: the account identifier at that service and the data it passes to us (name, e-mail address, profile picture);
- role in the workspace, interface language, notification settings;
- second-factor data (the authenticator app's identifier; we never see the app's secret) and the security log: sign-ins, password changes, new browsers, emergency access;
- activity log: active time, browser type, presence in the panel and the history of actions (e.g. who created or changed a post).
We do not store passwords in plain text.
Registration and workspace
- data given at registration and registration invitations (e-mail address, who invited, when the invitation was used);
- the workspace's name and address, the Agency's company data (name, tax ID, address, invoice e-mail), the chosen plan, the trial, the subscription state.
Payments
- customer, subscription or transaction identifiers at the payment operator (Stripe, PayPal or Przelewy24), the history of payment events (amount, currency, status). We do not store card numbers or bank login details; the payment operator processes them.
Connected pages and accounts (on the Agency's behalf)
- the page's or account's name, identifier and picture;
- the permissions the connecting person has on it;
- access tokens issued by the platform, stored encrypted with the workspace's key.
Content and the team's work (on the Agency's behalf)
- posts, photos, videos, descriptions, publication plans;
- materials uploaded by the Agency's clients;
- tasks, internal comments and approvals.
Data from social platforms (on the Agency's behalf)
- published posts and their statistics: reactions, comments, shares, reach, views;
- comments and replies under posts, with the author's name, platform identifier and profile picture (we keep a copy of the picture) and whether the comment is hidden;
- private messages in the Inbox module (Messenger, Instagram Direct): text, the sender's name and username, profile picture and attachments; the text is stored encrypted with the workspace's key;
- notifications (webhooks) in which the platform reports new comments, messages and reactions.
AI features
- prompts and content passed to AI models, e.g. a comment's text for a suggested reply, a brief for a publication plan or a question to the help assistant;
- generated texts and graphics;
- the brand description and documents of an Agency's client (the "brand memory");
- information on points used and AI cost.
Help
- tickets and conversations with the SocialFox team, attachments, the diagnostics package (app version, browser, page address in the panel, last console errors), questions to the assistant and ratings of its answers;
- consents to support access to a workspace: who asked, who approved, until when.
Technical data
- server and database logs (IP address, time and kind of request);
- the reCAPTCHA result on the home page and at registration;
- data stored in the browser (sign-in session, preferences, a working copy of the post being edited).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Registration, creating a workspace, running a user account | Art. 6(1)(b) (contract) |
| Sign-up on the home page and the registration invitation | Art. 6(1)(b) (steps before a contract) and (f) (our legitimate interest in offering the service) |
| Plans, trial, payments, invoices | Art. 6(1)(b) and (c) (tax and accounting duties) |
| Planning and publishing content, handling comments and messages, statistics and reports in an Agency's workspace | on the Agency's behalf (Art. 28); the Agency's basis is its contract with its client or its legitimate interest in communicating with its audience (Art. 6(1)(b) or (f)) |
| AI features (suggested content and replies, graphics, plans, the help assistant) | as above; AI acts at the user's request |
| Help: tickets, chat, support access | Art. 6(1)(b) and (f) |
| E-mail and in-panel notifications | Art. 6(1)(b) and (f) |
| Security, the second sign-in factor, abuse prevention, logs | Art. 6(1)(f) |
| Legal obligations | Art. 6(1)(c) |
| Establishing, pursuing and defending claims | Art. 6(1)(f) |
We do not sell data. We do not use data from social platforms for advertising or marketing profiling. We make no automated decisions with legal effects on you. Content passed to AI is not used to train our models.
5. Who receives the data
Service providers process data on our behalf (processors, and towards an Agency's data: sub-processors), only to the extent needed for the platform:
- Supabase Inc.: database, file storage, authentication and server functions. Data is stored in the European Union (Ireland).
- Cloudflare, Inc.: content delivery network, DNS and traffic protection for the socialfox.pl addresses, and video file storage (Cloudflare R2). Video files are stored in the European Union.
- Hosting provider: the server the application is served from.
- Stripe Payments Europe, Ltd.: payments for plans and points.
- PayPal (Europe) S.à r.l. et Cie, S.C.A.: PayPal payments for plans and points, when the Agency chooses this method.
- PayPro S.A. (Przelewy24): Przelewy24 payments for plans and points, when the Agency chooses this method.
- OpenAI: generating texts and graphics, suggested replies, brand memory search.
- Anthropic: Claude models, including the help assistant and features chosen in the settings.
- Google: Gemini models when chosen in the settings; reCAPTCHA on the home page and at registration.
- Canva: designing graphics when a user connects a Canva account.
- Magnific: stock photos (searching photos for posts).
- E-mail provider: sending notifications and system mails.
- Invoicing system: issuing invoices.
The platforms we connect profiles to, i.e. Meta Platforms (Facebook, Instagram), LinkedIn, TikTok and Google (YouTube), receive the published content and replies. They act as separate controllers under their own terms and privacy policies.
If you sign in with a Google, Apple, Facebook (Meta) or X account, that service confirms your identity and passes basic account data to us. It acts as a separate controller under its own terms and privacy policy.
If a user connects an AI assistant to SocialFox themselves (e.g. Claude or ChatGPT through the MCP connector), workspace data reaches that assistant to the extent the user asks it to.
Public authorities may receive data where the law requires it.
6. Transfers outside the European Economic Area
SocialFox's database is in the EU, but some providers (Supabase, Cloudflare, Stripe, PayPal, OpenAI, Anthropic, Google, Canva) are based or have infrastructure outside the EEA, mainly in the USA, and may process data there. This happens under the European Commission's adequacy decision (EU-US Data Privacy Framework) or the standard contractual clauses approved by the Commission.
7. How long we keep the data
- Home page sign-up and invitations: until registration or for 12 months from the sign-up; an invitation expires after 14 days.
- SocialFox account: while the workspace it belongs to exists. After the account or the workspace is deleted we delete or anonymise it within 30 days, unless the law requires longer storage.
- An Agency's workspace: for the term of the agreement. After the trial without a plan the workspace is read-only for 90 days, then marked for deletion. Deletion has a 30-day grace period, after which we delete the data permanently and destroy the workspace's encryption key.
- Access tokens: until the page or account is disconnected or access is revoked. After disconnecting in SocialFox we delete them at once.
- Data from platforms (posts, statistics, comments, messages): as long as the profile is connected and the workspace exists. When a comment is deleted on Facebook or Instagram, SocialFox deletes it automatically: after the platform's notification or at the next comment check.
- Help tickets and questions to the assistant: while the workspace exists, up to 24 months.
- Security logs: 12 months.
- Technical logs and backups: for the short period set by the provider, after which they are overwritten.
- Billing data and data needed for claims: for the period required by law.
8. Your rights
You have the right to:
- access your data and receive a copy;
- rectify the data;
- erase the data;
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).
Write to us at [email protected]. If your data is inside an Agency's workspace (e.g. your comment or message to a brand, your client-portal account), we pass the request to the Agency as the controller and follow its instructions. You may also contact the Agency or the brand directly.
9. Platform connections and revoking access
SocialFox uses platform data only within the permissions approved at sign-in. You can revoke access at any time:
- Facebook and Instagram: Settings & privacy → Settings → Business integrations → SocialFox → Remove;
- Google and YouTube: security.google.com/settings/security/permissions;
- LinkedIn: Settings → Data privacy → Permitted services;
- TikTok: business account settings → manage app permissions.
A team member can also disconnect a page or account in SocialFox (Settings → Integrations). The access tokens are then deleted at once.
For YouTube channels SocialFox uses YouTube API Services. By using these features you accept the YouTube Terms of Service (www.youtube.com/t/terms). How Google processes data is described in the Google Privacy Policy (policies.google.com/privacy).
SocialFox's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
10. Data deletion
The data deletion instructions are at: socialfox.pl/en/data-deletion.
11. Security
We apply technical and organisational measures protecting data from unauthorised access, loss or misuse:
- encrypted connections (HTTPS);
- every workspace has its own encryption key; platform tokens, keys to external services and Inbox message text are encrypted with it;
- data access limited by database rules to the workspace the person belongs to, with regular isolation checks;
- second-factor sign-in (authenticator app), required for workspace administrators and always for our team;
- platform access tokens are read only by server functions and never reach the browser;
- our team does not see a workspace's content without its owner's consent (code-based, time-limited, logged access);
- a security log and an activity log in the panel.
12. Cookies and browser storage
SocialFox uses no advertising or analytics cookies. We store only what the panel needs: the sign-in session (a cookie for the socialfox.pl domain, so one sign-in works across workspaces), preferences (e.g. the selected client) and a working copy of the post being edited. reCAPTCHA on the home page and at registration may set Google's own cookies.
13. Children
SocialFox is a tool for businesses and is not intended for persons under 16.
14. Changes to this policy
We will inform users about material changes in the panel or by e-mail. The current version is always available at socialfox.pl/en/privacy-policy. The Polish version prevails in case of discrepancies.