This policy explains what Repost (“the Service”) does with your data. Repost is a social media scheduling tool for marketing teams: you upload photos and videos, write captions, and Repost publishes them to the social accounts you have connected, at the times you choose.
1. Who is responsible
The controller for data processed by Repost is:
- SNS Software Solutions GmbH
- Schrötlgasse 8a, 1220 Vienna, Austria
- Represented by: Samuel Winch, Samson Adefris Belachew
- Commercial register (Firmenbuch): FN 683051, Handelsgericht Wien
- Email: office@sns-austria.com
- Phone: +43 670 1922538
For any question about this policy or your data, contact us at the address above.
2. What we store, and why
Repost is a working tool, not an advertising product. We store what is needed to operate it and nothing beyond that.
| Data | Why we hold it |
|---|---|
| Your name, email address and password | To create your account and sign you in. Passwords are stored only as a bcrypt hash — we never hold your password itself and cannot recover it. |
| Your organisation, your role in it, and invitations sent | So a marketing team shares one library and one set of connected accounts, and so we know who may act on them. |
| Access and refresh tokens for the social accounts you connect | To publish the posts you schedule. These are encrypted at rest with AES-256-GCM. See section 3. |
| The display name of each connected account (e.g. your Page name or channel title) | So the app can show you which account a post will go out from. |
| Photos and videos you upload, with their file name, type, size, dimensions and duration | They are the content you schedule. We also generate thumbnails so the library loads quickly. |
| Your scheduled posts — captions, target platforms, send times and status | To publish them when you asked, and to show you the result. |
We do not sell your data, we do not use it to build advertising profiles, and we do not use your uploaded content or your connected accounts for any purpose other than running the Service for you.
3. The social accounts you connect
Repost connects to Facebook, Instagram, LinkedIn, TikTok and YouTube. When you connect one, that platform sends us a token that authorises Repost to act on your behalf.
- What we do with it. We use the token only to publish the content you schedule, and to read the account’s display name so the app can label it.
- How it is protected. Tokens are encrypted with AES-256-GCM before they are written to the database. They are never shown in the interface and never sent to your browser.
- Who can use it. A connection belongs to your organisation, so members of your organisation can schedule posts through it. Nobody outside your organisation can.
- How to revoke it. Disconnect the account on the Accounts page. This permanently deletes the stored token from our database. You can also revoke Repost’s access from within the platform’s own settings at any time.
4. Legal basis (GDPR)
We process your data to perform our contract with you — providing the Service you signed up for (Art. 6(1)(b) GDPR). Where we process data to keep the Service secure and working correctly, we do so on the basis of our legitimate interests (Art. 6(1)(f) GDPR).
5. Who else processes your data
We use a small number of providers to run the Service. They act as our processors and may only handle your data on our instructions:
- Supabase — the database and file storage holding your account, library and scheduled posts. Hosted in the EU (Stockholm).
- Vercel — hosting and delivery of the application itself.
- Upstash — the queue that runs scheduled posts at their send time.
- Meta, LinkedIn, TikTok and Google/YouTube — when you schedule a post, its content is sent to the platform you targeted, so it can be published. Their own privacy policies then apply to it.
6. How long we keep it
- Platform tokens — until you disconnect the account, at which point they are deleted immediately.
- Media and scheduled posts — until you delete them, or until your organisation’s account is closed.
- Account data — for as long as your account exists. Closing it removes your account and the content attached to it.
7. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15)
- have inaccurate data corrected (Art. 16)
- have your data erased (Art. 17)
- restrict processing (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on legitimate interests (Art. 21)
To exercise any of these, email office@sns-austria.com. You also have the right to complain to a supervisory authority — in Austria, the Datenschutzbehörde (dsb.gv.at).
8. Deleting your data
You can delete individual media files, scheduled posts and platform connections yourself from within the app at any time. To have your account and all associated data removed entirely, email office@sns-austria.com and we will action it.
9. Changes to this policy
If we change how the Service handles data, we will update this page and move the “last updated” date at the top. Material changes will be communicated to account holders directly.