Skip to content
Sign inTry it free

Privacy policy

As of October 2026

Controller

DIGITALPASSION Ltd., Tassou Papadopoulou 16, House 2, 8270 Tremithousa, Cyprus, represented by Kevin Damiani. Email: info@kontiqo.io.

In brief

kontiqo schedules your posts and publishes them at send time to LinkedIn, Facebook and Instagram. We store the text and media of a post only until it is sent; exceptions and what remains afterwards are listed under "How long we keep data". We use no cookies, no analytics and no tracking. No AI runs on our servers.

Hosting and logs

Our servers run at Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, in the Frankfurt am Main data centre. For app.kontiqo.io and server.kontiqo.io we keep no access log with IP addresses.

Our services log errors and events without IP addresses, for account events with the account ID. The logs are overwritten continuously once they reach a fixed size. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Account and sign-in

For your account we store your email address, your settings and the status of your subscription. You sign in with a code we send you by email. For each session, the IP address and browser identifier are stored until you sign out or delete your account.

Database, sign-in and file storage are operated by Supabase (contracting party: Supabase Pte. Ltd., Singapore) in the Frankfurt am Main region. Access from third countries, such as support and operations from the USA and Singapore, is covered by the European Commission's standard contractual clauses. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Channels and publishing

When you connect a channel, the platform gives us an access key, the IDs of the account or page and the display name. We store the key encrypted. At send time we transfer the post's text and media to the platform and afterwards keep only whether and when it was published and its platform ID.

Media are kept in our file storage until sending; Meta fetches them from there via an address valid only for that post. Statistics on your posts are fetched from the platform on demand, never stored in the database and kept in memory for at most five minutes.

Platforms: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Their privacy policies govern what happens to your posts there. If you remove kontiqo in your Facebook settings, we are notified and stop using the connection. If you request deletion of your data there, we immediately delete the connection, channels, posts and media; the confirmation is shown at app.kontiqo.io/meta-deletion. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

AI applications via MCP (optional)

You can connect ChatGPT, Claude or another AI application to kontiqo via MCP. This only happens if you agree on our consent page. kontiqo then gives the application your channels and posts on your instruction and accepts posts from it. The provider of the AI application is responsible for its own processing. You can disconnect it at any time in your account under "AI applications"; the application then receives no more data within an hour at the latest. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Payment

You buy the subscription through Stripe Managed Payments. The seller towards you is Sold Through Link, LLC ("Link"), a Stripe subsidiary; for the EU, payments are processed by Stripe Technology Europe, Limited. Stripe and we are each independent controllers. We send Stripe your email address and your account ID and receive the status and term of your subscription. We never see your payment details. You can also manage purchases at link.com. The legal bases are the performance of the contract and statutory retention obligations (Art. 6(1)(b) and (c) GDPR).

Emails

We send sign-in codes and notices about posts that were not confirmed as published through Resend, Inc., 2261 Market Street #4103, San Francisco, CA 94114, USA. Resend is certified under the EU-US Data Privacy Framework; standard contractual clauses also apply. We do not send you advertising. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Contact form and email to us

If you write to us through the contact form, we send your name, email address, message and the page language via Resend to our mailbox; we store none of it in our database. Our mailbox is hosted by Fastmail Pty Ltd, Level 2, 114 William Street, Melbourne, Victoria 3000, Australia. Fastmail stores emails in the EU or the USA and always keeps a copy, backups and logs in the USA. Transfers to Australia and the USA are covered by the European Commission's standard contractual clauses.

We use your details only to reply to you and delete the message once the request is settled and no statutory retention obligation applies. The legal basis is our legitimate interest in answering requests (Art. 6(1)(f) GDPR) or, where a contract is concerned, Art. 6(1)(b) GDPR.

Storage in the browser

The web app keeps your sign-in in your browser's local storage so that you stay signed in. This is strictly necessary for the service and therefore needs no consent (Art. 5(3) of Directive 2002/58/EC, in Germany Section 25(2) no. 2 TDDDG). Fonts are loaded from our own server.

How long we keep data

Our database and file storage delete automatically according to these rules:

  • Text of a scheduled post: until sending, discarding, disconnecting the channel or deleting the account.
  • Images and videos of a scheduled post: until sending, discarding, disconnecting the channel or deleting the account.
  • Uploaded media not attached to any post: at most 1 day after creation, earlier on deleting the account.
  • Text and media of a failed or unclear post: at most 30 days after the failure, earlier on sending, discarding, disconnecting the channel or deleting the account.
  • Record of a published post (status, time, platform ID, the name of the AI app that scheduled it, if any; without text and media): at most 730 days after sending, earlier on deletion by you, disconnecting the channel or deleting the account.
  • Record of a discarded post (without text and media): at most 30 days after discarding, earlier on disconnecting the channel or deleting the account.
  • First comment or reshare by another account: text and time until it runs, afterwards status, time, platform ID and address, and the error reason if any: at most 730 days after creation, earlier on discarding, deletion by you, disconnecting the channel or deleting the account.
  • Connected channel (type, platform IDs, display name): until disconnecting the channel or deleting the account.
  • Platform access keys, encrypted: until disconnecting the channel or deleting the account.
  • Backup of drafts and history that only you can decrypt: until turning off the backup or deleting the account.
  • Uploaded backup until it is confirmed, and turned-off or replaced backup until it is removed (encrypted): at most 2 days after creation, earlier on deleting the account.
  • ID of a deleted account, and files that arrived after the deletion, until the second deletion pass: at most 2 days after creation.
  • Process of connecting a channel: at most 1 day after creation, earlier on deleting the account.
  • Account: email address, settings, subscription status: until deleting the account.
  • ID and type of a payment notification (against double processing): at most 30 days after creation.
  • Heartbeat of our background services (no user data): at most 7 days after the last change.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future. You can delete your account with all data yourself in the app. For anything else, write to info@kontiqo.io.

Right to object (Art. 21 GDPR): where we process data based on our legitimate interest, you can object at any time on grounds relating to your particular situation.

You can lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work (Art. 77 GDPR). Our lead authority is the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, www.gov.cy/dataprotection.

Obligation to provide data and automated decisions

You are under no statutory or contractual obligation to give us data. Without an email address, however, we cannot create an account, and without a connected channel we cannot publish anything. There is no solely automated decision within the meaning of Art. 22 GDPR.

Security

All connections are encrypted with TLS. Platform access keys are additionally stored encrypted.