Integritetspolicy

1. Data controller

The data controller for the processing of your personal data is:

If you have questions about how we handle your personal data, please contact us at the address above.

2. What data we collect

• Account data: name and email address you provide when registering.
• Login data: encrypted password (we can never see your password in plaintext).
• Social accounts: access tokens for the social media platforms you connect to PostNinja (e.g. Instagram, LinkedIn, X). Tokens are stored encrypted.
• Content: text, images and other media you create or upload in the service.
• Technical data: session ID (stored as a necessary cookie) and log data for errors.

We do not collect tracking cookies, advertising cookies, third-party analytics cookies or fingerprint data.

3. Legal basis for processing

• Contract (GDPR art. 6.1 b): processing necessary to provide the service you have ordered — e.g. storing your post schedules and publishing to your social accounts.
• Legitimate interest (GDPR art. 6.1 f): technical logging to troubleshoot and maintain service security.
• Consent (GDPR art. 6.1 a): for any marketing emails — you can withdraw your consent at any time.

4. How we use your data

• Provide and improve the PostNinja service.
• Publish scheduled posts to your social media platforms via their official APIs.
• Send transactional emails (welcome email, password reset, billing receipts).
• Troubleshoot and maintain security.

We never sell your data to third parties.

5. Third-party recipients

We share data with the following categories of recipients, only to the extent required to operate the service:

• Social media platforms (Meta, LinkedIn, X and others): your content and identity are shared with the platform you choose to publish to.
• AI providers (OpenAI, Anthropic, Google and others): if you enable AI features, the content you submit is processed by the provider you have configured. These providers have their own privacy policies.
• Hosting provider: server infrastructure within the EU/EEA.

6. Retention period

• Your account and associated data are kept as long as the account is active.
• Published and scheduled posts are kept until you manually delete them.
• On account deletion, all personal data processing ceases within 30 days.
• Invoice records are kept for 7 years per the Swedish Accounting Act.

7. Cookies

PostNinja uses only necessary cookies:

• session — keeps you logged in during a session (cleared when the browser closes).
• XSRF-TOKEN — protects against CSRF attacks.
• cookie_consent — stores your cookie preferences for one year.

No tracking, analytics or advertising cookies are used.

8. Your rights

Under GDPR you have the right to:

• Access (art. 15): request an extract of the personal data we process about you.
• Rectification (art. 16): request that incorrect data be corrected.
• Erasure (art. 17): request that your data be deleted ("the right to be forgotten").
• Restriction (art. 18): request that processing be restricted in certain situations.
• Data portability (art. 20): request to receive your data in a machine-readable format.
• Objection (art. 21): object to processing based on legitimate interest.

Send your requests to hello@postninja.se. We respond within 30 days.

9. Complaints to the supervisory authority

If you believe we are processing your personal data incorrectly you have the right to lodge a complaint with the Swedish data protection authority (Integritetsskyddsmyndigheten, IMY):

10. Changes to this policy

For material changes you will be informed by email or via a message in the service. The latest version is always available at postninja.se/privacy.