Draft of 26 October 2026, before legal review. The version published before the service launches will be binding.
Privacy Policy
What data fanero studio processes, why, for how long and what rights you have. User accounts and data that comes from customers’ profiles are covered separately.
Version of 26 Oct 2026
1. Who is responsible for the data
The controller of the personal data of people who create a fanero studio account, visit fanerostudio.pl or write to us is Grade System sp. z o.o., ul. Alfonsa Flisykowskiego 1/58, 80-180 Gdańsk, Poland, KRS 0000926334, NIP 5833438266. For personal data matters, write to pomoc@fanerostudio.pl with the subject “Personal data”.
We process the data of people who comment, send messages or leave reviews on our customers’ profiles as a processor on the customer’s behalf. The controller of this data is the company that owns the profile. To exercise your rights regarding this data, it is best to contact that company; if you write to us, we will forward your request.
2. What data we process
- Account: full name, email address, password stored as a hash (argon2id), encrypted two-factor authentication secret, language and theme.
- Login and security: IP address, browser and session time, activity log in the workspace.
- Workspace: company name, tax ID, settings, brands, team and roles, invoicing details.
- Platform profiles: profile IDs and names, encrypted access tokens, statistics, posts and their results.
- Inbox: comments, messages and reviews from the customer’s profiles, with the author’s name and picture as provided by the platform, plus the team’s replies, notes and labels.
- Support requests: the request text, the page address, browser, window size and recent application errors.
- Payments: plan, period, payment status and PayU transaction ID. We do not store card numbers.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating an account and providing the fanero studio service | Article 6(1)(b) GDPR (contract) |
| Account security, abuse detection, activity log | Article 6(1)(f) GDPR (legitimate interest) |
| Invoicing and accounting | Article 6(1)(c) GDPR (legal obligation) |
| Handling support requests and complaints | Article 6(1)(b) and (f) GDPR |
| Pursuing and defending legal claims | Article 6(1)(f) GDPR |
| Processing data from customer profiles (inbox, statistics, publishing) | Article 28 GDPR, on the customer’s instructions |
4. Data from Google and YouTube
fanero studio uses YouTube API Services. When you connect a YouTube channel or a Google account, fanero studio receives only the access scopes you approve on Google’s consent screen: channel and video data, YouTube Analytics statistics, comments and the ability to reply to them, and, for a Google Business Profile, reviews and replies to them.
We use this data only for the features you see in fanero studio: dashboard, statistics, reports, inbox and publishing. We do not sell it, do not use it for advertising and do not share it with anyone except the sub-processors on our list of sub-processors who help provide this service. The Provider’s staff do not read this data unless you ask for help or security or the law requires it.
fanero studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We store YouTube video titles and comments for no longer than 30 days: after that we refresh them from YouTube or delete them. Every 30 days we check that access to the channel is still active.
The Google Privacy Policy applies to YouTube data: policies.google.com/privacy. You can revoke fanero studio’s access to your Google account at any time at security.google.com/settings/security/permissions; after revocation we delete that channel’s data from fanero studio within 7 days.
5. Data from Facebook and Instagram
Once a Facebook Page or Instagram account is connected, fanero studio retrieves the statistics, posts, comments and messages of these profiles and carries out the actions you request: replying, hiding, deleting, publishing. We use the data only for fanero studio’s features and do not pass it on for advertising purposes.
The Data deletion page explains how to delete data obtained from Facebook and Instagram: fanerostudio.pl/usuwanie-danych. When you remove the fanero studio app in your Facebook settings, Meta sends us a deletion request, which we carry out automatically; you can check its status on that page using the confirmation code.
6. Data from TikTok
When you connect a TikTok account, fanero studio receives only the access scopes you approve on the TikTok screen: basic account data (name, profile picture, account type, follower count), the list of videos and their statistics, and comments on videos with the option to reply to, hide and delete them.
We use this data only for the features you see in fanero studio: dashboard, statistics, reports and inbox. We do not sell it, do not use it for advertising and do not share it with anyone other than the sub-processors on the sub-processor list. fanero studio does not retrieve private messages from TikTok.
You can revoke fanero studio’s access to your TikTok account at any time in the TikTok app settings, in the section for apps connected to your account, or by disconnecting the profile in fanero studio. After access is revoked, we delete the profile data within 7 days. TikTok’s Privacy Policy applies to data from TikTok: www.tiktok.com/legal/privacy-policy-eea.
7. Data from LinkedIn
When you connect a LinkedIn company page, fanero studio receives only the access scopes approved by the page administrator: page data, page posts and their statistics, and comments on page posts with the option to reply.
We keep the content of comments by people other than your page for no longer than 48 hours. After that, only the comment identifier and a link to it on LinkedIn remain. We do not export LinkedIn members’ data, do not pass it to the AI connector or AI features, do not create leads from it and do not share it further.
We keep page posts for up to 6 months from the last refresh and page statistics for no longer than 12 months. Page profile data is refreshed every week. Disconnecting a LinkedIn page in fanero studio always deletes its data. If a page loses its connection to fanero studio (for example, when access expires) and you do not reconnect it, we keep its posts for no longer than 6 weeks and page data such as its name and logo for no longer than 30 days from the disconnection.
You can revoke fanero studio’s access in your LinkedIn settings, in the partner services section, or by disconnecting the page in fanero studio. LinkedIn’s Privacy Policy applies to data from LinkedIn: www.linkedin.com/legal/privacy-policy.
8. AI features
When you use the AI assistant or sentiment detection is enabled in a workspace, the text of the comment, message or post and the necessary context (brand, language, brand voice) are sent to the language model provider Anthropic. The provider processes them only to generate a response and, under its API terms, does not use them to train models.
AI output is a suggestion. No reply prepared by AI is sent without a human decision.
9. Who we share data with
We share data with sub-processors who help provide the service (hosting, email delivery, AI) under data processing agreements. The current list, with processing locations, is on the Sub-processors page: fanerostudio.pl/podprocesorzy.
On your instructions, data is sent to the platforms (Meta, Google, TikTok, LinkedIn) when you publish a post or reply to a comment. Payments are handled by PayU S.A. as an independent controller of payment data.
We store data on OVHcloud servers in Poland, with backups in another OVHcloud data centre in the European Union. Where a provider processes data outside the European Economic Area (Anthropic in the USA), the transfer is based on standard contractual clauses approved by the European Commission or another mechanism under Chapter V of the GDPR.
10. How long we keep data
| Data | Period |
|---|---|
| User account | until the account is deleted or the agreement ends, then until claims become time-barred |
| Meta, TikTok and Google statistics | until the end of the subscription and for 90 days afterwards |
| LinkedIn page statistics | no longer than 12 months |
| LinkedIn page posts | 6 months from the last refresh |
| Content of comments by LinkedIn members | no longer than 48 hours, then only a link remains |
| YouTube statistics | as above, with a check every 30 days that access is still active |
| YouTube video titles and comments | no longer than 30 days, then refreshed or deleted |
| Comments and messages from other platforms | 24 months, then the author is anonymised (the customer can set a shorter period) |
| Platform access tokens | until the profile is disconnected, then deleted immediately |
| Profile data after access is revoked | deleted from fanero studio within 7 days |
| Activity log | 12 months |
| Invoices | 5 years from the end of the tax year |
| Backups | 30 days; deleted data is removed from backups no later than the end of this period |
11. Your rights
You have the right to access your data, to rectification, erasure and restriction of processing, to data portability, and to object to processing based on legitimate interests. Just write to pomoc@fanerostudio.pl. We reply within one month.
You can exercise some of these rights directly in the application: change your details in “Settings, My profile”, export workspace data and delete the workspace in “Settings, Data and privacy”, and disconnect a profile in “Connected accounts”.
You may lodge a complaint with the President of the Personal Data Protection Office, the Polish supervisory authority (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the supervisory authority in the EU Member State where you live, work or where the infringement took place (Article 77 GDPR).
12. Security
- connections over HTTPS only,
- platform tokens encrypted (AES-256-GCM), decrypted only by the sync and publishing processes, never in the browser or in logs,
- passwords stored as argon2id hashes, two-factor authentication (TOTP),
- customer data separated by row-level security policies in the database (RLS), checked by automated tests,
- daily encrypted backups in another data centre in the EU,
- the Provider’s staff can access the admin panel only with 2FA and from allowlisted IP addresses.
14. Automated decisions
We do not make decisions that produce legal effects concerning you based solely on automated processing, including profiling. Sentiment detection for comments only helps the customer’s team organise the inbox.
15. Changes to this policy
We notify you of significant changes by email and in the application. The date of the current version is shown at the top of the page.