Privacy Policy

This is an English translation provided for convenience. In case of doubt, the German version at /datenschutz is the authoritative one.

This privacy policy explains how personal data is processed in the application "on fleek Social" (www.onfleeksocial.com), the social media management platform that on fleek GmbH operates for the client companies it serves.

1. Controller

on fleek GmbH, Industriestr. 10, 92360 Mühlhausen, Germany · Email: info@agenturonfleek.com · Phone: +49 160 8706068

2. Purpose of the application

on fleek Social is used to plan, coordinate, approve and automatically publish social media content for the client accounts on fleek GmbH looks after, and to evaluate the reach of published content. The application is used by employees of on fleek GmbH and by designated contacts at our client companies — independent businesses outside on fleek GmbH whose accounts and channels are connected. Logins are set up by us; there is no open self-registration.

3. Data processed

• User accounts: name, email address, password (stored as a hash only), optional security features (two-factor authentication, passkeys), role and permission assignment, as well as sign-in and session data.
• Connected social media accounts: when an account we manage is connected (e.g. an Instagram business account, a Facebook Page, a TikTok account, a YouTube channel), we store the account identifier, the display name, the profile picture and the OAuth access tokens issued by the platform in question. Access tokens are stored encrypted (AES-256-GCM), are never logged and are never passed on to browsers or third parties.
• Content: post drafts, copy, images and videos, approval comments, version states and scheduled dates created in the tool by the agency or by the client.
• Insights/analytics: aggregate metrics for the connected accounts and published posts (e.g. reach, impressions, interactions, follower count), which we retrieve through the platforms' official application programming interfaces and store as historical values.
• Log data: technical server logs, a change log of business actions (audit log) and a record of the notification emails sent.

4. Legal bases

Processing takes place in order to perform the contracts with our clients (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in handling social media services efficiently and securely (Art. 6(1)(f) GDPR). Social media accounts are connected on behalf of the client concerned — depending on the platform and what was agreed, either by the account holder themselves or by an on fleek team member authorised to do so. In both cases the connection is only ever established through the platform's own OAuth dialog and only with the consent given there; we do not receive the passwords of client accounts.

5. Disclosure to platforms

When approved posts are published and when analytics are retrieved, we transmit content and account identifiers to the platform concerned (Meta Platforms Ireland Ltd. for Instagram/Facebook, TikTok Technology Ltd., Google Ireland Ltd. for YouTube). The platforms' own privacy policies apply to the processing they carry out. For media retrieval by Meta we make files available through short-lived signed addresses that expire after a few minutes. Apart from the platforms named here and the AI provider described under section 6, we do not pass this data on.

6. AI-assisted text features

The application includes features that produce text suggestions: captions from a brief, adapting a text to a particular channel, optimisation suggestions, and the analysis of a client's brand voice. For these features we transmit the content needed for the respective task to Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA, the provider of the language model we use.

What is transmitted is limited to the content of the task at hand: the brief that was entered, the caption of the post, the tone of voice stored for the client and — when a caption is generated — the images of the post. For the brand voice analysis, the texts of posts already published on the client's connected Instagram accounts and Facebook Pages are included as well. User accounts, credentials, access tokens and metrics are not transmitted.

The legal basis is our legitimate interest in producing content efficiently (Art. 6(1)(f) GDPR) and the performance of the contract with the client concerned (Art. 6(1)(b) GDPR). The transfer to the United States takes place on the basis of the European Commission's standard contractual clauses. Under the terms of the interface we use, the transmitted content is not used to train the models. Suggestions made by the AI are never published automatically: every post is decided on by people in the approval process.

7. Cookies and third-party content

The application sets only the session cookies that are technically necessary for signing in. No tracking takes place; fonts and all other content are served from our own servers, so that no connections to third-party providers are established when the site is opened.

8. Retention periods

We store content and account connections for the duration of our work with the client concerned. OAuth tokens are deleted immediately when an account is disconnected. Email and error logs are cleared automatically after 90 days at the latest. Statutory retention obligations remain unaffected.

9. Your rights

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA) in Ansbach. Please address requests to info@agenturonfleek.com.

10. Deletion of connected platform data

If the application's authorisation for a connected account is withdrawn (for example through the Meta account settings), the stored access tokens are deleted automatically and the connection is severed. Beyond that, the deletion of all data stored for an account can be requested at any time at info@agenturonfleek.com.

11. YouTube API Services

To publish videos to connected YouTube channels, on fleek Social uses the YouTube API Services. By using this feature you agree to the YouTube Terms of Service. The Google Privacy Policy applies in addition.

Through the YouTube Data API we process data belonging to the connected channel only: the channel identifier, the channel name and the channel image in order to display the connection, the videos we upload together with their title, description and video identifier, and the OAuth token issued for this purpose (stored encrypted, never logged, never passed on to browsers or third parties). Scopes used: youtube.upload to upload approved videos and youtube.readonly to read the channel and video metadata. No access to any other channel takes place.

Access can be revoked at any time — either in the security settings of the Google account (third-party apps), or by disconnecting the channel inside on fleek Social or sending an informal message to info@agenturonfleek.com. On revocation or disconnection the stored tokens are deleted immediately; channel and video data retrieved through the API is removed in full on request.

Last updated: 20 August 2026