Privacy notice
1. Who is responsible
The service Socials Copilot is provided by Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, company number (IČO) 03516652, registered by the Municipal Court in Prague, section C, file 232942 ("we").
We have two roles, and this notice explains which applies when:
- We are the controller of the personal data of the people who use the service (their accounts, roles and activity), of guest approvers, of the people who pay for an organization, of people who write to us or send us a notice, and of the visitors of our pages. This notice describes that processing.
- We are a processor of the personal data contained in our customers' content: the posts, media, campaigns and comments of an organization and the data its connected social media accounts provide. For that data the organization is the controller and decides why it is processed; we process it only on its behalf, under the data processing agreement in Annex 4 of our terms. If your question concerns such data, for example a post that mentions you, please turn to the organization that published it; if you write to us, we pass your request on to it.
2. What we process and why
| Purpose |
Personal data |
Legal basis |
| Your account and signing in |
name, e-mail address, the identifier of your sign-in account, the time of sign-up and of the last sign-in |
the contract (Art. 6(1)(b) GDPR) |
| Working in organizations and brands |
your memberships, roles, approvals, comments and what you did in the service, with its time |
the contract (Art. 6(1)(b)) |
| Your preferences |
theme and language, stored in your account; on your device only after your consent (see section 5) |
the contract; your consent (Art. 6(1)(a)) for storage on your device |
| Where the service and its features are available |
the country of your connection (not your address) |
our legitimate interest in offering the service only where it may be offered (Art. 6(1)(f)) |
| Guest approvals |
the guest's name and e-mail address, their decisions and comments |
the legitimate interest of the organization and ours in recording who approved a post (Art. 6(1)(f)) |
| Ordering, payment and invoices |
the payer's name, company, tax or company number, address, e-mail address, language, the declarations and consents given with their version, time and IP address |
the contract (Art. 6(1)(b)); our legal obligations in tax and accounting law (Art. 6(1)(c)) |
| Terms acceptance, age confirmation, withdrawal |
who accepted which version of the terms and when, the age confirmation, a consumer's withdrawal |
our legal obligations and the defence of legal claims (Art. 6(1)(c) and (f)) |
| Cancelling a contract at /cancel |
your name, the e-mail address for the confirmation, the organization and contract you name, the kind of cancellation and its reason, the end you ask for, the time we received it and whether you were signed in |
the contract (Art. 6(1)(b)); our legal obligation to confirm the cancellation and the defence of legal claims (Art. 6(1)(c) and (f)) |
| E-mails and notifications we send you |
your e-mail address, the message's subject and content |
the contract (Art. 6(1)(b)) |
| Sending no e-mail to an address that cannot receive it |
the e-mail service's report on each message we sent, with its recipient, and, when a message bounced or the service refused it, a one-way hash of the address, never the address itself |
our legitimate interest in e-mail that arrives and in the reputation of our sender (Art. 6(1)(f)) |
| Notices of illegal content, statements of reasons, authorities' orders, complaints |
the notifier's name, e-mail address and explanation; the decision and its reasons |
our legal obligations under the Digital Services Act (Art. 6(1)(c)) |
| Contact and support, through the contact form at /contact or by e-mail to support@7ier.com |
the topic, your name, e-mail address, the organization you name and your message, with its time and language |
the contract, or our legitimate interest in answering you (Art. 6(1)(b) or (f)) |
| Your requests about your data |
what you ask and our answer |
our legal obligation (Art. 6(1)(c)) |
| Cookie consent |
a random consent identifier, the version, your choices, the time and a shortened IP address |
our legal obligation to be able to prove consent (Art. 6(1)(c) and Art. 7(1)) |
| Measuring the service's traffic with Google Analytics (section 5) |
a pseudonymous client identifier stored in the _ga cookies, the pattern of the page's address without any ids, tokens or queries (such as /app/:organizationId/brands), the address of the site you came from, without its path or query, the steps of the first-run guide you completed or skipped, the time, device and browser data, and the approximate location Google derives from the IP address |
your consent (Art. 6(1)(a) GDPR) |
| Security and operation |
technical logs of requests, errors and jobs, which may contain IP addresses |
our legitimate interest in a secure and working service (Art. 6(1)(f)) |
We do not sell personal data, we do not use it for advertising, and we make no decision about you based solely on automated processing that has legal or similarly significant effects on you.
Without the data needed for the account and the contract we cannot provide the service. Giving the other data is voluntary.
3. AI and your data
The service uses AI to propose drafts of posts. What the AI receives is what the people of a brand write or choose for it: the brand's profile, briefs, drafts and the posts approved in the service, the feedback of the brand's people, the text of the brand's website when a profile is drafted from it, and the images of the brand's library that it is asked to describe. If a brief contains personal data or an image shows a person, it reaches the AI provider. The AI provider is Anthropic Ireland, Limited; requests reach it through our own processing service. Anthropic does not receive the comments, messages, results or profile data that Meta's platforms provide.
Anthropic Ireland, Limited uses Anthropic PBC in the United States as its sub-processor, so the data is transferred to the United States. The transfer relies on the safeguards under Chapter V GDPR that Anthropic's data processing terms provide; you can ask us for more information about them and for a copy of them at support@7ier.com. Under its Service Specific Terms (section F), Anthropic may keep inputs and outputs for safety reviews and to combat harmful use, even where data is otherwise not kept. Your content is not used to train AI models.
4. Who receives the data
- Microsoft Ireland Operations Limited hosts the service (Azure App Service, Azure SQL Database, Azure Storage), sends its e-mails (Azure Communication Services), monitors it (Application Insights) and provides the sign-in (Microsoft Entra External ID). The data is stored in the European Union, in Azure's West Europe region (the Netherlands).
- Anthropic Ireland, Limited, with Anthropic PBC as its sub-processor, provides the AI (see above).
- Google Ireland Limited, with Google LLC in the United States, provides Google Analytics 4, only after your consent (see section 5).
- Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, the Netherlands, keeps our support mailbox, where the e-mails written to support@7ier.com, the messages of the contact form, the cancellations we handle by hand and the alerts of notices that report a threat to life or safety arrive and where we read and answer them, as support@7ier.com, in its data centres in the European Union. Its group company Zoho Corporation Pvt. Ltd. in India may access the mailbox as its sub-processor, and India has no adequacy decision. Zoho's data processing addendum, which holds the standard contractual clauses of the European Commission for that access, was requested on 14 October 2026 and is not yet signed; once it is, you can ask us for a copy of the clauses at support@7ier.com.
- Stripe processes payments as an independent controller under its own privacy notice; in some countries Stripe, as merchant of record through its Managed Payments service, collects the payment and issues the invoice on our behalf, while we remain the provider of the service and our terms govern the purchase, including withdrawal, refunds and complaints. Card data is entered only on Stripe's page and never reaches us.
- Meta (Facebook, Instagram) and X receive the content an organization publishes to its connected accounts, at the organization's direction, under their own terms. How to have the data we received from Facebook and Instagram deleted is described at /legal/data-deletion.
- Authorities and courts receive data only where the law requires it.
Our own systems for selling and invoicing are operated by us, Syonic solutions s.r.o.; the data in them is processed by us as described here.
5. Cookies and storage on your device
The service stores on your device only what it needs to work, and preferences and analytics only with your consent. There are no advertising cookies.
| Category |
What it is |
When |
| Necessary |
the session cookie that keeps you signed in, the anti-forgery token that protects your actions, and the record of your cookie choice |
always; the service cannot work without them |
| Preferences |
the memory of your theme, your language, the AI proposal notices you closed and whether the sidebar is collapsed, in your browser's local storage |
only after you accept them |
| Analytics |
the Google Analytics cookies _ga and _ga_<id>, a pseudonymous client identifier and the current session, which expire after two years at most, and in your browser's local storage which steps of each organization's first-run guide were already counted, which never leaves your device |
only after you accept them; deleted when you withdraw the consent |
When you first visit, a banner offers "Accept all", "Reject all" and "Settings" with the same weight, and nothing is pre-selected. You can change your choice at any time with "Cookie settings": signed in, under "Learn more" in your profile menu; otherwise in the footer of the public pages. We log each choice with a random consent identifier, the version of the banner, your choices, the time and your IP address shortened to its first three parts (IPv4) or its first 48 bits (IPv6), so that we can prove your consent.
Google Analytics. With your consent to analytics we measure the service's traffic and where people leave the first-run guide with Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Google receives a pseudonymous client identifier from the _ga cookies, the pattern of each page's address with every id, token and query removed (for example /guest/:token, never the link itself), the page's pattern as its title, the address of the site you came from, without its path or query, which step of the first-run guide was completed or skipped, the time, device and browser data, and the approximate location it derives from your IP address. Google Analytics 4 does not store IP addresses. It receives nothing you type, no names or e-mail addresses, and nothing about the content of an organization; Google signals and advertising features are off. Before you consent and after you refuse, nothing is loaded from Google and nothing is sent. Google keeps the data 14 months. Google LLC in the United States may process it; the transfer relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the standard contractual clauses of Google's data processing terms. You can withdraw the consent at any time in "Cookie settings"; from then on nothing is sent and the cookies are deleted.
6. How long we keep it
| Data |
Kept |
| An organization's content (brands, channels, posts, media, campaigns, AI jobs, approvals, comments) |
while the organization exists; deleted when its deletion takes effect, 30 days after the request |
| Results (insights) |
two years, the longest any plan shows |
| E-mails in the outbox (recipient, subject, body) |
90 days after sending, or after they were written when never sent |
| The one-way hash of an address an e-mail bounced at or the e-mail service refused |
one year after the last such report |
| Notifications |
one year |
| Job runs, webhook deliveries |
90 days, 30 days |
| Invitations, sign-up invitations, guest links |
90 days after they expire or are used |
| Data exports |
30 days after they are built |
| Cookie consent log |
three years after the choice |
| Google Analytics data (events and the client identifier) |
14 months, then deleted by Google |
| Terms acceptances, billing consents, buyer's declarations, withdrawals |
ten years after the organization's deletion (§ 629(2) of the Civil Code) |
| Cancellations made at /cancel |
ten years after we received them (§ 629(2) of the Civil Code) |
| Notices, statements of reasons, authorities' orders, Meta's requests |
three years after their decision (§ 629(1) of the Civil Code) |
| Messages from the contact form and e-mails to support@7ier.com, also in our support mailbox at Zoho |
three years after they are answered, or three years after they arrived when never answered (§ 629(1) of the Civil Code) |
| A person who belongs to no organization |
erased one year after their last membership ended |
| Logs (Application Insights, and the e-mail service's report on each message with its recipient) and database backups |
30 days and 7 days |
| Deleted media files and storage containers |
7 days after their deletion, so that they can be recovered, then erased |
The deletions run automatically every day. Tax documents are kept by our invoicing system for the periods tax and accounting law require.
7. Your rights
You have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where we process data on your consent, you may withdraw it at any time, for cookies through "Cookie settings" (section 5); the withdrawal does not affect what was done before.
To exercise a right, write to us at support@7ier.com, through the contact form at /contact or by letter to the address in section 9. We identify you by your signed-in account or by the e-mail address you write from, and may ask for more if we cannot. We answer within one month; if a request is complex, we may extend this by two more months and tell you why within the first month. Exercising your rights is free of charge.
When we erase a person, their name and e-mail address are anonymised and their memberships end; the records the law requires us to keep, such as an accepted version of the terms, are kept with the anonymised person.
A request about personal data in an organization's content goes to that organization, as its controller; we pass it on.
8. Supervisory authority
You may lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), https://uoou.gov.cz, or with the supervisory authority of the EU country where you live or work. We would be glad if you told us first, so that we can put things right.
Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic. You reach us by e-mail at support@7ier.com, through the contact form at /contact or by letter to this address, in Czech, Slovak or English.
10. Changes
We update this notice when our processing changes; the date at the top shows the last update. We tell the people of organizations about an important change by e-mail and in the service.