Versión en español resumida. Esta página presenta la política de privacidad de MarbSocial. La versión legalmente vinculante es la edición en inglés que aparece a continuación; estamos preparando una traducción jurada al español. Si tienes preguntas sobre tus derechos bajo el RGPD/CCPA o quieres ejercer cualquiera de ellos, escríbenos a privacy@marbsocial.com en español y te responderemos en español.
Resumen de tres líneas: recopilamos solo los datos necesarios para operar la plataforma (cuenta, tokens de redes sociales que conectas, contenido que publicas), no vendemos datos personales, y puedes pedir acceso, rectificación, supresión o portabilidad en cualquier momento.
1. Introduction
MarbSocial is a social media management and AI content generation platform (the “Service”, “we”, “our”). This Privacy Policy describes what personal data we collect when you use marbsocial.com and the application, how we use it, who we share it with, and your rights.
By using the Service, you agree to this Policy. If you do not agree, please stop using the Service.
Data Controller: the MarbSocial team. Privacy contact: privacy@marbsocial.com.
2. What data we collect
2.1 Registration data
- First and last name
- Email address
- Organization name
- Password hash (we do not store passwords in plain text)
- IP address and user-agent at sign-up and login
2.2 Profile data
- Avatar (if uploaded)
- Time zone and UI language
- Organization role (owner / admin / editor / viewer)
- Notification preferences
2.3 Connected social account data
See section 4 below — covered separately.
2.4 Content you create
- Posts and drafts
- Uploaded images, videos, files
- AI prompts and generated results
- Schedules, tags, categories
- Inbox replies and comments
2.5 Technical data
- IP address
- Device, browser, OS type
- Action logs (which endpoints, when, outcome)
- Session ID and cookies
- Performance metrics
2.6 Payment data
If you subscribe — card details are processed by our payment provider (NOWPayments / Stripe depending on region). We do not store full card numbers, CVV, or PIN. We see: last 4 digits, expiry, country of issuance, transaction status.
3. How we use data
We use your data strictly for the following purposes:
- Providing and supporting the Service (account, authentication, publishing)
- Performing actions you initiated (posting, AI generation, sending emails)
- Billing and subscription management
- Security: fraud prevention, brute-force protection, abuse detection
- Legal compliance (taxes, regulatory requests)
- Product improvement (anonymized usage analytics, A/B testing)
- Notifying about material Service changes (mandatory notices)
- Marketing emails — only with explicit consent; you can opt out anytime
GDPR Art. 6 legal bases: contract performance, legitimate interests (security, improvement), consent (marketing, optional cookies), legal obligations (tax records).
6. AI content processing
MarbSocial uses generative models for AI features: assistant, post generation, images, video, translations, comment replies.
Who processes
- Google Gemini (Google Cloud, EU region) — text, images
- Anthropic Claude (Anthropic API) — text
- Moonshot Kimi — alternative text model
What is sent to AI
- The prompt you enter
- Context of the current post or thread (if “use context” is enabled)
- Your language and basic tone preferences
What is NOT sent to AI
- Your email, password, payment data
- Social tokens
- Content of others' accounts beyond what you explicitly paste in the prompt
All AI providers we work with have signed DPAs and respect zero-retention — they do not use your prompts to fine-tune models.
8. Data retention
| Data type | Retention period |
|---|---|
| User account | Until account deletion |
| Post content | Until deleted by you or account removal |
| Social tokens | Until disconnect, or token expiry |
| Security logs | 90 days |
| Audit log | 180 days |
| DB backups | 30-day rolling |
| Payment records | 7 years (tax law requirement) |
After account deletion, we erase your data within 30 days, except records we are required by law to retain (payment history).
9. Security
- HTTPS with TLS 1.2+ for all traffic
- Authenticated Origin Pulls — origin reachable only via Cloudflare
- Encrypted social tokens at rest (AES-256)
- Password hashing with bcrypt
- Two-factor authentication (2FA) available to all users
- Rate limiting and WAF at CDN level (Cloudflare)
- Regular security audits and dependency scanning
- Principle of least privilege across components
No system is 100% secure. In case of a breach, we will notify affected users within 72 hours per GDPR Art. 33–34.
10. Your rights (GDPR / CCPA)
If you are in the EU, EEA, UK, Switzerland, or California, you have the following rights:
- Access — find out what data we hold about you
- Rectification — correct inaccurate data
- Erasure (right to be forgotten) — delete your account and related data
- Restriction — pause processing
- Portability — receive your data in machine-readable form (JSON / CSV)
- Object — opt out of legitimate-interest processing
- Withdraw consent — for marketing and optional cookies
- Lodge a complaint — with your local supervisory authority (e.g., UODO in Poland)
Most requests can be fulfilled in Settings → Privacy & Data. For others, email privacy@marbsocial.com — we respond within 30 days.
11. International data transfers
Service servers are in Frankfurt, Germany (AWS eu-central-1). Some third parties may process data outside the EEA:
- Anthropic, OpenAI — USA (Standard Contractual Clauses, EU-US Data Privacy Framework)
- Cloudflare — global (SCCs, Data Privacy Framework)
- Social networks — each per their own policy
12. Children
The Service is not intended for users under 16. We do not knowingly collect data from children. If you are a parent and learn that your child has signed up — please contact us, we will delete the account and related data.
13. Changes to this policy
We may update this Policy. For material changes, we will notify by email and an in-app banner at least 14 days before they take effect. Minor edits (typos, wording) are published without notice, fixed by the date at the top of the document.
14. Contact
Privacy inquiries: privacy@marbsocial.com
General inquiries: contact@marbsocial.com
Operating address: Warsaw, Poland
4. Social media access & content
When you connect a social account (Instagram, VK, TikTok, Telegram, YouTube, LinkedIn, Threads, Facebook), we receive an access token from the platform — a key allowing us to post on your behalf and read data per the scopes you approved.
What we store
What we do with this data
What we DO NOT do
You can revoke access at any time via Settings → Connected Accounts → Disconnect, or directly in the social network settings. After revocation, tokens are deleted within 24 hours.