Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how we process personal data in the Sorto.ai social media publishing service (the “Service”), available at postiz.sorto.ai and related Sorto.ai applications. The Service lets you connect your social media accounts and publish or schedule content on them on your behalf.

1. Data controller

2. What the Service does with your social media accounts

• When you connect a social media account (for example Facebook, Instagram, LinkedIn, TikTok, X or YouTube), the platform gives us an access token. We use it only to publish the content you create or schedule in the Service on that account, and to read basic statistics of those posts and of the account (for example reach, likes, comments, followers) so we can show them to you.
• We publish only content you have created, approved or scheduled. We do not post anything else in your name.
• Access tokens are stored on our servers with access restricted to the Service, and are never shared with third parties other than the platform they belong to.
• We do not sell your data, do not use it for advertising, and do not transfer it to data brokers.
• You can disconnect an account at any time in the Service, or revoke access in the settings of the social platform. On disconnection, or on your request, we delete the related access tokens.

3. Data we process

• Account data: name, e-mail address, password (stored only as a hash), organisation and role.
• Connected account data: platform account or page identifier, name, profile picture, access and refresh tokens, granted permissions.
• Content: texts, images and videos you upload or create, publication dates, publication status and post identifiers returned by the platform.
• Statistics: metrics of your published posts and accounts read from the platforms.
• Technical data: server logs (IP address, date and time, requested address) needed for security and troubleshooting.

4. Purposes and legal basis (GDPR)

• Providing the Service, including publishing, scheduling and showing statistics — Art. 6(1)(b) GDPR (performance of a contract).
• Connecting your social media accounts — your consent given when you authorise the connection on the platform, Art. 6(1)(a) GDPR; you can withdraw it at any time by disconnecting the account.
• Security of the Service, preventing abuse and handling claims — our legitimate interest, Art. 6(1)(f) GDPR.
• Accounting and tax obligations for paid plans — Art. 6(1)(c) GDPR.

5. How long we keep data

• Access tokens — until you disconnect the account, ask us to delete them, or close your account in the Service; then deleted without undue delay, at the latest within 30 days.
• Account data and content — while your account is active; deleted within 30 days after the account is closed, unless you ask us to delete them earlier.
• Server logs — up to 12 months.
• Billing documents — for the period required by tax law (in Poland, 5 years from the end of the year).

6. Who processes the data on our behalf

We use service providers that process data only on our instructions, in particular our hosting provider located in the European Union. Data is sent to a social platform only when you connect an account or publish content on it; from that moment the platform’s own privacy policy also applies. We do not transfer personal data outside the European Economic Area, except when the platform you chose is located outside it.

7. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict its processing, to data portability, to object to processing based on our legitimate interest, and to withdraw consent at any time (without affecting processing before withdrawal). You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa).

8. How to delete your data

1. Disconnect the social media account in the Service — the related access tokens are deleted.
2. Or send an e-mail to kontakt@sorto.ai with the subject “Data deletion”, from the e-mail address of your account, stating which data you want deleted. We will confirm deletion within 30 days.

9. Cookies and tracking

This website does not use tracking scripts, analytics cookies or advertising cookies. The Service uses only the cookies or local storage strictly needed to keep you signed in.

10. Contact and changes

Questions about privacy: kontakt@sorto.ai. We may update this policy; the date at the top shows the latest version. Significant changes will be announced in the Service.