Socials Copilot: terms of service, version 7
1. Who we are and the contract
1.1 The service Socials Copilot is provided by Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, company number (IČO) 03516652, registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 232942 ("we", "us"). You reach us by e-mail at support@7ier.com or by telephone on +420 702 187 473; the other ways to reach us are in clause 18.
1.2 These terms are the contract between us and the customer who uses the service ("you"). The customer is the organization created in the service; the person who creates it or orders for it confirms that they may act for it. An organization has brands, and a brand has channels, each channel being one connected social media account.
1.3 You are a consumer if you are a natural person who uses the service outside your trade, business or profession. Otherwise you are a business. Some clauses apply only to consumers (clauses 6 and 13 and Annex 1) or only to businesses (clauses 12.2 and 16); the rest applies to everyone. A consumer never loses a right that the law gives consumers and that cannot be taken away by a contract.
1.4 Accounts are for adults only. You may create an account or join an organization only if you are at least 18 years old, and you confirm your age when you sign up.
1.5 You accept these terms when you sign up, and we record the version you accepted, who accepted it and when. A purchase is a separate contract under these terms, concluded when you pay for it (clause 4).
1.6 The contract is concluded in Czech or in English, the language you use when you accept it. Both language versions say the same. Each version of these terms is kept as a PDF, and we send you the version you accepted on request.
1.7 Four annexes are part of these terms: Annex 1, the withdrawal instruction and model form; Annex 2, the acceptable use policy; Annex 3, the client terms for Meta's platforms; Annex 4, the data processing agreement with its technical and organisational measures.
2. The service
2.1 Socials Copilot helps you plan and publish posts on social media for your brands. It lets you plan campaigns and recurring series, has AI propose drafts of posts, lets the people of a brand approve them according to the brand's approval mode, and publishes the approved posts to the brand's connected accounts at their scheduled time.
2.2 The service publishes only to accounts you connect and own or are allowed to manage: Instagram (professional accounts only), Facebook pages and, with the add-on of clause 3.5, X. Connecting an account requires the platform's permission, which you give on the platform's own page. The platforms decide what they accept; when a platform changes or limits its interface, what the service can do on it may change too. Every attempt to publish is recorded with the platform's answer; a failed attempt is retried and, if it keeps failing, the brand's people are told why.
2.3 A manager or an approver of a brand may send posts that are waiting for approval to a guest approver: a person outside your organization, named with their e-mail address. The guest gets a link that is valid for 14 days and that you may revoke at any time. Through it the guest sees the posts, and may approve, reject or comment on each of them. A guest's decision is recorded like any approval, with the guest's name and e-mail address. A guest is never a person of your organization, does not take up a seat, and acts on your behalf: you are responsible for whom you send a link to.
2.4 On plans that include it, your organization may create API clients for its own systems. They reach the service through our versioned HTTP API with credentials issued to your organization. You keep the credentials secret and are responsible for what is done with them. Everything these terms say about using the service applies to use through the API too; in particular, no API call publishes a post without a person's approval or removes its AI disclosure (clause 9).
2.5 The service may not be used to prepare, schedule or publish political advertising within the meaning of Regulation (EU) 2024/900 on the transparency and targeting of political advertising.
2.6 To use the service you need a device with a current version of a major web browser (Chrome, Edge, Firefox or Safari), a connection to the internet and, for each network you publish to, an account of the kind clause 2.2 names.
2.7 We may change the service for a good reason: a change of a platform's interface or terms, the security of the service, a change of the law or of a decision of an authority, or a new or improved feature. A change costs you nothing extra, and we tell you about a change that affects how you use the service in the service or by e-mail before it takes effect. If a change limits your access to the service or its use more than insignificantly, we notify it to a consumer by e-mail at least 30 days before it takes effect, saying what changes and when, and the consumer may end the contract free of charge within 30 days of the notice or of the change, whichever is later; the prepaid part of a plan for the time after the end, counted by days, is refunded within 14 days of the end, on every payment channel, Managed Payments (clause 4.4) included. The consumer has no such right where we let them keep the service unchanged at no extra cost.
3. Plans, add-ons and credits
3.1 The service has a free plan and paid plans: Free, Solo, Team and Business. What each plan includes (the number of brands, channels and people, scheduled posts, AI credits a month, approval features, how long results are kept, the networks, export and API access) is shown on the plan page and in the summary of your order. On every plan, every post is approved by a person before it is published.
3.2 A new organization gets 14 days of the Team plan free of charge, without a card. When the trial ends, the organization moves to the Free plan unless a plan has been paid. A trial never turns into a paid plan by itself.
3.3 A paid plan is paid monthly or yearly. A yearly plan is paid once a year, for the whole year.
3.4 AI work is counted in AI credits. A task uses credits only when it succeeds. The credits of a plan are given each month, for the organization, and do not carry over to the next month.
3.5 You may add add-ons to a paid plan: an extra brand with its channels and credits, an extra person on Team, and an X account. An X account add-on includes a monthly number of posts to X, some of which may contain a link, as shown at its purchase; when they are used up, publishing to X pauses until the next month and nothing more is charged.
3.6 You may buy credit packs. A pack is valid for the period shown at its purchase, and its credits are used after the month's credits of your plan. Credits have no cash value, cannot be transferred to another organization and are not paid out.
4. Ordering, prices and payment
4.1 You order on the order page. Before you place the order you see a summary of what you buy, its price, its duration, whether and how it renews and how to end it, and you can review and change the order. You place the order with the payment provider's button, which binds you to pay, and pay on the payment provider's page. A purchase on a card you saved with us is the one exception: you place it with our own button "Order with obligation to pay", and the saved card is charged without the provider's page. A purchase is concluded when it is paid.
4.2 Prices are shown before you order, in the currency you choose of those offered for your country. For consumers the price is final and includes all taxes. For businesses the order states whether value added tax is added or whether you account for it yourself (clause 16.3).
4.3 We accept payment by the methods the order page offers for your country; any restriction is shown at the start of the order. Payments are processed by Stripe. Card data is entered only on the payment provider's page and never reaches us.
4.4 In some countries Stripe, as merchant of record through its service Managed Payments, collects the payment for your purchase and issues its invoice on our behalf; the order tells you before you pay. We remain the provider of the service, and these terms, including withdrawal, refunds and complaints, govern your purchase and your use of the service.
4.5 Tax documents (invoices and corrective documents) are electronic. They are sent by e-mail and listed on the billing page. By giving your billing details you consent to receiving tax documents in electronic form; the consent is recorded with its version and time.
5. Renewal and cancellation
5.1 Automatic renewal: a paid plan renews automatically for the same period, a month or a year, at the end of each period until you cancel it, and the price of the new period is charged to the payment method of the plan.
5.2 We remind you before each renewal, and we announce a change of price at least 30 days before it applies. You may cancel before the new price applies.
5.3 You cancel at any time: on the billing page in one step, without signing in on the page /cancel ("Cancel contracts here" in the footer), or by any statement in text form sent to us under clause 18.2. A monthly plan then runs to the end of its period and does not renew.
5.4 A yearly plan paid on the payment provider's page ends at once when you cancel it, and its unused part is refunded. A consumer in Germany who cancels it after its first year keeps it for one more month, and the part after that month is refunded.
5.5 A yearly plan paid through Managed Payments (clause 4.4) runs to the end of its period when you cancel it, and nothing is refunded, unless you end it over a change of the service (clause 2.7) or of these terms (clause 15.3), which refunds its unused part.
5.6 When a paid plan ends, your organization moves to the Free plan. Your data is kept.
6. Withdrawal for consumers
6.1 As a consumer you may withdraw from a purchase within 14 days of its payment, without giving a reason. The period ends at the end of the 14th day after the day of the payment.
6.2 You withdraw with the button "Withdraw from the contract" on the billing page or in the e-mails about your order, the e-mails' button opening the withdrawal page /withdraw, and send the withdrawal with the button "Confirm withdrawal"; or by any clear statement sent to us, for which you may use the model form of Annex 1. We confirm your withdrawal by e-mail, with its content and time.
6.3 If you asked us to start providing the service at once, before the withdrawal period ended, the part already provided is kept and the rest is refunded; for a credit pack, the credits not used are refunded. Otherwise the whole payment is refunded.
6.4 The withdrawal instruction is in Annex 1.
7. Refunds of plans and credits
7.1 A payment is refunded only as these terms say: after a consumer's withdrawal (clause 6), when a consumer ends the contract over a change of the service (clause 2.7), when a plan ends because you reject a change of these terms (clause 15.3), when a yearly plan is cancelled (clauses 5.4 and 5.5), or when the law requires it, for example after a justified complaint (clause 13).
7.2 A refund goes back to the payment method used for the payment. A tax document is corrected for every refund made on a purchase from us.
7.3 The monthly credits of a plan are not refunded. Credits of a pack that expire unused at the end of its validity are not refunded. Credits of a pack withdrawn under clause 6 are refunded as clause 6.3 says, and the unused credits of a pack are refunded when a plan ends because you reject a change of these terms (clause 15.3).
7.4 When a refund depends on how many credits were used, it is made once the unused credits have been counted, and in full if they have not been counted within 3 days.
8. A failed payment
8.1 If a renewal cannot be charged, the payment is retried and you are told by e-mail each time.
8.2 During the grace period everything runs. After it, AI and autopilot are paused until the payment succeeds. If the payment still does not succeed, the organization moves to the Free plan.
8.3 Your data is kept throughout. Paying the open amount restores the plan.
9. AI output and your approval
9.1 The service uses artificial intelligence to propose ideas, drafts and texts. AI output is a proposal, not a finished post.
9.2 Every post is approved by a person of the brand, or by a guest approver the brand chose (clause 2.3), before it is published. No plan, setting, guest link or API call publishes a post without that approval. An approval is recorded with a fingerprint of the approved content; if the content changes after approval, the post returns to review, and only content that is still exactly as approved is published.
9.3 Every post containing text generated by AI is published with a disclosure that AI was used: a closing line such as "Created with the help of AI." You cannot remove this disclosure.
9.4 AI accuracy notice: AI can be wrong. It may state facts, names, prices or dates that are not true, or produce text that is incomplete or inappropriate. Check every fact before you approve a post. The service shows this notice under every AI output. You are responsible for the content you approve and publish.
9.5 AI tasks are carried out by our AI provider through our own processing service (Annex 4). Your content is not used to train AI models.
10. Your content and our role
10.1 Your content remains yours: the texts, images and other material you upload, the posts and their versions, and the output the AI produces for you. You give us the right to store, process, adapt for each platform and publish your content only to the extent needed to provide the service to you.
10.2 You are responsible for having the rights to your content, and for your content complying with the law, with Annex 2 and with the rules of the platforms you publish to.
10.3 For the personal data contained in your content and in the data your connected accounts provide, you are the controller and we are your processor under Annex 4. For the personal data of the people who use the service and of the people who pay, we are the controller; our privacy notice at /legal/privacy describes that processing.
10.4 When you connect an account of a Meta platform (Facebook, Instagram), the client terms of Annex 3 apply to you too.
11. Moderation, notices and suspension
11.1 We store content on your behalf as a hosting service under Regulation (EU) 2022/2065 (the Digital Services Act). This clause describes what we may restrict, why and how.
11.2 We may restrict content or an organization only because the content is illegal, because it breaches Annex 2, or because a competent authority orders it. We do not review content before it is published, and we do not decide about content by automated means: every decision under this clause is taken by a person. Automated checks in the service may hold an AI draft until a person of the brand reviews it; they do not delete content or restrict an organization.
11.3 Anyone may notify us of content they consider illegal or in breach of Annex 2 through the form at /report. The form asks for the address or a description of the content, an explanation of why it is illegal or in breach, the name and e-mail address of the person notifying, and a statement of good faith. We confirm the receipt of a notice by e-mail, decide on it without undue delay, and tell the person who notified us our decision.
11.4 Our decisions are: no action; disabling a media file (its public address stops working and it is never published); disabling a draft (its post is cancelled and kept); or suspending the organization. A suspension is used for a serious or repeated breach of Annex 2 or when an authority orders it.
11.5 While an organization is suspended, its data is kept. Its people can reach only the page with its notices and the export of its data (clause 14); nothing is published, no AI task or autopilot runs, and its API credentials are refused. When the suspension is lifted, everything is restored. If a serious breach is not remedied, we may end the contract by notice by e-mail; your data then remains available for export for at least 30 days.
11.6 For every decision affecting your content or your organization we send your organization's owners and administrators a statement of reasons, by e-mail and on the notices page: what we decided, the facts and the grounds, whether the decision followed a notice or an authority's order, and how you can challenge it.
11.7 You may complain against our decision, free of charge, within six months of the statement of reasons, through the contact form at /contact, by e-mail to support@7ier.com or by letter to the address in clause 18.1. A person reviews it and answers without undue delay. You keep the right to turn to a court or an out-of-court body.
11.8 If we learn of content suggesting a criminal offence that threatens a person's life or safety, we inform the competent authorities at once.
12. Liability
12.1 We provide the service with professional care. We are not liable for the content you approve and publish, or for the decisions of the platforms you publish to (for example a removed post, a restricted account or a change or limit of their interface). We are not liable for an interruption caused by force majeure, an extraordinary, unforeseeable and insurmountable obstacle that arose independently of our will (section 2913(2) of the Civil Code); towards consumers, an outage of our own providers is not force majeure.
12.2 For businesses: we are also not liable for an interruption caused by an outage of our providers that we cannot control. Our total liability arising from the contract and in connection with it is limited to the fees you paid us in the 12 months before the claim arose. The limit does not apply to harm caused intentionally or by gross negligence, to harm to a person's natural rights, or where the law does not allow liability to be limited.
12.3 Consumers keep all their statutory rights, including the rights from a defective service; clause 12.2 does not apply to them.
13. Complaints and out-of-court resolution
13.1 If the service does not work as these terms and the plan page describe, you may complain (make a claim from a defect) through the contact form at /contact, by e-mail to support@7ier.com or by letter to the address in clause 18.1. Describe what does not work and since when.
13.2 We confirm the receipt of a complaint in writing, by e-mail, with its date and content. We decide on a consumer's complaint without delay, in complex cases within 3 working days, and settle it, including the remedy, within 30 days of its receipt unless we agree on a longer period with you. We then confirm in writing how the complaint was settled, or, if we reject it, why.
13.3 A consumer has the rights from a defective digital service under sections 2389a and following of the Civil Code: to have the defect remedied, and if it is not remedied in a reasonable time or is serious, to a reasonable price reduction or to withdraw from the contract. This clause is our complaints procedure under sections 13 and 19 of Act No. 634/1992 Coll., on consumer protection.
13.4 A consumer may resolve a dispute with us out of court. The competent body is the Czech Trade Inspection Authority (Česká obchodní inspekce, ČOI), whose procedure and form are at https://adr.coi.cz. The Czech Trade Inspection Authority also supervises our compliance with consumer protection law.
13.5 The European Commission's online dispute resolution (ODR) platform was closed on 20 July 2025. A consumer from another EU country may ask the European Consumer Centre of their country for help with a cross-border dispute.
14. Your data, export and switching
14.1 Your organization's data is yours. An owner or administrator may export everything the organization has at /app/<organization>/data, on every plan, at any time and free of charge: a ZIP file of machine-readable JSON files, one for each kind of data, with the media files and a description. Only two kinds of data are left out, as data specific to how the service works that must stay secret: the access tokens of connected accounts and the hashes of API credentials. The export is kept for download for 30 days. The same export is open to your own systems and to the provider you switch to through an export client, on every plan and free of charge: an owner or administrator creates it on the organization's API page, /app/<organization>/api, and it may request, list and download the export and nothing else, as described at /legal/data-formats.
14.2 The full list of exportable data and its structures and formats is the public register at /legal/data-formats. How switching to another provider or to your own systems works, and the information required by the Data Act (Regulation (EU) 2023/2854), is at /legal/data-act.
14.3 Switching: you may switch to another provider or to your own systems at any time; you export your data (clause 14.1), cancel your plan (clause 5) and, if you wish, delete your organization (clause 14.4). You need give no notice; if you give us a switching notice, its notice period is at most two months, and the switch then takes a transitional period of at most 30 days after it. During the switch we keep providing the service under the contract, give you reasonable assistance, act with due care to keep your work running, tell you of any known risk to the continuity of the service, and keep a high level of security throughout. Once the switch you asked for in a notice is completed, the contract ends and we confirm it to you. Switching and exporting are free of charge; we charge no switching or data extraction fees.
14.4 Deletion: an owner may delete the organization on its Data page, /app/<organization>/data, while no paid plan runs. The deletion takes effect 30 days after the request; during those 30 days the export works and the request can be cancelled. Then all of the organization's data and files are deleted, except the records the law requires us to keep, such as tax documents and records of accepted terms, which are kept for the periods stated in our privacy notice.
14.5 When a paid plan ends, the organization continues on the Free plan with its data (clause 5.6), so you always have at least 30 days to retrieve your data before anything is deleted.
15. Changes to the terms
15.1 We may change these terms for a good reason: a change of the law or of a decision of an authority, a change of the platforms' or our providers' terms, a new or changed feature of the service, or the security of the service. A change of price is announced under clause 5.2.
15.2 We notify each change by e-mail to your organization's owners and administrators and in the service at least 30 days before it takes effect, with a summary of what changes and the new version.
15.3 A change that makes your position worse applies to a yearly plan paid in advance only from the plan's first renewal on or after the change's date; only a change the law or the security of the service requires applies to it earlier, from its date. The notice and the service give the day from which the change applies to your organization. If you do not agree with a change that would apply within a period of your plan that is already paid, an owner of your organization may reject it before that day with the button "Reject and end the plan" in the service's notice of the change; a consumer may also reject it within 30 days of the notice or of the change, whichever is later. The plan then ends at once, your organization moves to the Free plan (clause 5.6), and you may delete it; the unused part of the plan's period, counted by days, is refunded, together with the unused part of every running add-on and the unused credits of your packs, on every payment channel, Managed Payments (clause 4.4) included, to a consumer within 14 days. Otherwise, if you do not agree with a change, you may end the contract before it applies by cancelling your plan (clause 5.3) and, if you wish, deleting your organization. Ending the contract for this reason is free of any penalty. If you do not end the contract, the new version applies from the day the change applies to you. These rules apply to businesses and to consumers alike, except where a rule names consumers.
16. Business customers
16.1 This clause applies to businesses in addition to the rest of these terms.
16.2 Between us and a business, the provisions of sections 2389a to 2389f of the Civil Code apply only where these terms do not provide otherwise; the description of the service in clauses 2 and 3, the support in clause 18, and the liability and remedies in clauses 12 and 13 replace them. Sections 1799 and 1800 of the Civil Code do not apply.
16.3 You account for any tax due in your country, for example under the reverse charge or by self-assessment. Prices do not include any withholding tax. If the law of your country requires you to withhold a tax from a payment to us, you increase the payment so that we receive the full price, or you give us an official certificate of the tax withheld.
16.4 When you buy as a business, you declare that you buy in the course of your business, with the details your country requires (a tax or company number), and that your business is not majority-owned or controlled, directly or indirectly, from a country outside the regions our AI provider supports. The declaration is recorded with its version and time. When we ask, you confirm the current version of the declaration on the billing page by the date we give; if you do not, your plan ends at the end of its period.
16.5 Under section 1753 of the Civil Code, you expressly accept clause 5 (automatic renewal), clause 12 (liability) and clause 15 (changes to the terms) each with a separate tick when you sign up; each acceptance is recorded with its version, the person and the time.
17. Governing law and courts
17.1 The contract is governed by Czech law. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
17.2 If you are a consumer with your habitual residence in another country, you keep the protection that the mandatory provisions of the law of that country give you.
17.3 The Czech courts decide disputes with businesses; the court is the one competent according to our registered office. A consumer may also bring a claim before the courts of the country of their habitual residence where the law allows it.
18.1 Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, IČO 03516652.
18.2 You reach us by e-mail at support@7ier.com, through the contact form at /contact or by letter to the address in clause 18.1. The same details are on the contact page /legal/contact, linked from the footer of the public pages and, when you are signed in, from "Learn more" in your profile menu, and in the footer of every e-mail we send. We answer in Czech or in English.
18.3 Notices to you go by e-mail to your organization's owners and administrators and appear in the service.
This annex applies to consumers. It follows the model of Government Regulation No. 29/2023 Coll., as amended by Government Regulation No. 66/2026 Coll.
Right of withdrawal
You have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period ends at the end of the 14th day after the day the contract was concluded, which is the day of the payment of your purchase.
To exercise the right of withdrawal, you must inform us, Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, e-mail: support@7ier.com, telephone: +420 702 187 473, contact form: /contact, of your decision to withdraw from this contract by a clear statement. The simplest way is the button "Withdraw from the contract" on the billing page of the service or in the e-mails about your order, the e-mails' button opening the withdrawal page /withdraw; you confirm or fill in your name, the contract and the e-mail address for the confirmation and send the withdrawal with the button "Confirm withdrawal". You may also send a letter, an e-mail or a message through the contact form, and you may use the model withdrawal form below, but it is not obligatory. When you withdraw through the button, we send you a confirmation of the withdrawal, with its content and time, by e-mail without delay.
To meet the withdrawal deadline, it is sufficient for you to send your communication concerning your exercise of the right of withdrawal before the withdrawal period has expired.
Effects of withdrawal
If you withdraw from this contract, we shall reimburse to you all payments received from you without undue delay and in any event not later than 14 days from the day on which we are informed about your decision to withdraw. We will carry out such reimbursement using the same means of payment as you used for the initial transaction, unless you have expressly agreed otherwise; in any event, you will not incur any fees as a result of such reimbursement.
If you requested to begin the performance of the service during the withdrawal period, you shall pay us an amount which is in proportion to what has been provided until you have communicated to us your withdrawal from this contract, in comparison with the full coverage of the contract; we deduct it from the refund. For a credit pack, the credits you have used are that part, and the credits not used are refunded.
Model withdrawal form
(Complete and return this form only if you wish to withdraw from the contract.)
To: Syonic solutions s.r.o., Rybná 716/24, Staré Město, 110 00 Praha 1, Czech Republic, e-mail: support@7ier.com, contact form of the service: /contact.
I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract for the provision of the following service: ________
Ordered on (*) / paid on (*): ________
Name of the consumer(s): ________
Address of the consumer(s): ________
E-mail address for the confirmation: ________
Signature of the consumer(s) (only if this form is notified on paper): ________
Date: ________
(*) Delete as appropriate.
Annex 2: Acceptable use policy
This policy says what the service may not be used for. It applies to every person of your organization, to guest approvers and to your API clients. A breach of it may lead to the measures of clause 11, including the suspension of your organization.
Our AI provider's Usage Policy, published at https://www.anthropic.com/legal/aup, is part of this policy: you may not use the service in a way that breaches it. Its universal standards that matter most for social media are listed below; the Usage Policy itself governs in full.
You may not use the service:
- to send spam or to automate spammy behaviour, such as mass unsolicited messages or posts, or artificially inflated engagement;
- to present AI output as written by a person in order to make people believe a person wrote it; the AI disclosure of clause 9.3 stays on every post;
- to impersonate a real person, company or organization without their consent or a legal right, or to create fake personas or fake accounts;
- to write fake reviews, fake comments or fake testimonials;
- to circumvent the terms or rules of another platform, in particular of Instagram, Facebook and X; a breach of a platform's terms is also a breach of this policy;
- to create deceptive political content, to run artificial political movements or campaigns, or for political advertising (clause 2.5);
- for multi-level marketing schemes.
You may not publish, store or prepare with the service content that is illegal under the law of the European Union, of the Czech Republic or of the country where it is published, such as content that infringes another person's rights (copyright, trademarks, privacy, personality rights), defames someone, incites hatred or violence, sexually exploits children, deceives consumers, or promotes illegal goods or services.
You must keep the rules of every platform you publish to, including their rules on branded content, automated posting and AI-generated content.
You may not attack or overload the service, try to reach another organization's data, test the service's security without our written permission, or resell the service or access to its AI to third parties.
This annex applies to every organization that connects an account of a Meta platform (Facebook, Instagram) to the service. Connecting such an account requires the acceptance of these terms in version 1 or later.
When you connect such an account, we act as a Tech Provider on your behalf under the Meta Platform Terms: we access and process the data that Meta's platforms provide about your accounts (such as posts, comments, messages, results and profile data, "Platform Data") only on your behalf and at your direction, to provide the service to you, and never for our own purposes or for any other customer. Each organization's Platform Data is kept separate from every other organization's.
You may not process Platform Data that you receive through the service in a way that breaches the Meta Platform Terms or Meta's other terms and policies that apply to you. You are responsible for having the rights and the legal basis to process the Platform Data of your accounts.
Meta may ask us to end your access to its platforms through the service. We then disconnect your organization's Meta accounts, delete their access tokens and do not allow them to be connected again until the matter is resolved. We tell you when this happens.
If Meta passes us a request of a person whose data is in your Platform Data, for example a request for deletion, we pass it on to your organization's owners and administrators without undue delay, and you handle it as the controller.
We do not send Platform Data to our AI provider. The AI receives only what the people of your brands give the service: the brand's profile, briefs, drafts and the posts approved in the service, the feedback of the brand's people, the text of the brand's website when a profile is drafted from it, and the images of the brand's library that it is asked to describe.
Annex 4: Data processing agreement
Parties and roles. This agreement is concluded between you as the controller and us as the processor under Article 28 of Regulation (EU) 2016/679 (GDPR). It applies to the personal data we process on your behalf when we provide the service. For the personal data of the people who use the service and of the people who pay, we are the controller (clause 10.3).
Subject and duration. The subject is the processing of personal data contained in your organization's content and in the data your connected accounts provide, in order to provide the service. The processing lasts for the duration of the contract and until your organization's data is deleted under clause 14.4.
Nature and purpose. We store, organize, display, adapt and transmit the data, use AI to propose drafts at your direction, publish to the platforms you choose, export it at your request and delete it. The only purpose is providing the service to you.
Categories of data subjects: the people of your organization and your guest approvers as far as they appear in your content; people mentioned or shown in your content; people who react to your posts or write to your accounts on the platforms (their names, profile identifiers, comments and messages as the platform provides them).
Categories of personal data: names, e-mail addresses and profile identifiers; texts, images and videos of posts; comments and messages; results of posts as the platforms provide them. The service is not meant for special categories of personal data (Article 9 GDPR), and you do not put them into it unless the law allows you to.
Our obligations. We process the data only on your documented instructions, which are these terms and what you do in the service, including transfers to a third country, unless the law requires otherwise, in which case we tell you first unless the law forbids it. We tell you without delay if we believe an instruction infringes the law. Everyone who processes the data for us is bound to confidentiality. We take the measures of Article 32 GDPR described in the appendix of this annex.
Sub-processors. You give us a general authorisation to engage sub-processors. The current sub-processors are:
- Anthropic Ireland, Limited (Ireland), which provides the AI that proposes drafts; it uses Anthropic PBC (United States) as its own sub-processor. Requests reach it through our own AI processing service, which is part of our systems.
- Microsoft Ireland Operations Limited (Ireland), which provides the hosting (Azure App Service, Azure SQL Database, Azure Storage), the sending of e-mail (Azure Communication Services), application monitoring (Application Insights) and the sign-in (Microsoft Entra External ID).
- Zoho Corporation B.V. (the Netherlands), which keeps our support mailbox, with the e-mails written to support@7ier.com and the messages of the contact form, in its data centres in the European Union; its group company Zoho Corporation Pvt. Ltd. (India) may access the mailbox as its own sub-processor.
Meta and X receive your content because you direct us to publish it to them, and Stripe processes payments as an independent controller; none of them is our sub-processor. We notify a new or replaced sub-processor by e-mail to your organization's owners and administrators at least 10 days in advance. If you object for a reasonable reason, you may end the contract before the change takes effect. We bind every sub-processor by a written contract to the same data protection obligations, and we are responsible to you for its performance.
Transfers outside the EU. Anthropic Ireland, Limited passes data to Anthropic PBC in the United States. The transfer relies on the safeguards under Chapter V GDPR that Anthropic's data processing terms provide. Anthropic may keep inputs and outputs for safety reviews and to combat harmful use under its Service Specific Terms (section F), even where data is otherwise not kept. Our AI provider receives no Meta Platform Data (Annex 3, point 6). Zoho Corporation Pvt. Ltd. in India may access the support mailbox; that transfer relies on the standard contractual clauses of the European Commission in Zoho's data processing addendum, since India has no adequacy decision.
Assistance. Taking into account the nature of the processing, we help you to answer the requests of data subjects (the export and the deletion in the service do most of it, and we pass on to you any request we receive about your content), and to meet your obligations under Articles 32 to 36 GDPR.
Personal data breach. We notify you of a personal data breach affecting your data without undue delay and in any case within 72 hours of becoming aware of it, with what we know of its nature, its likely consequences and the measures taken, and we complete the information as we learn more.
End of processing. At the end of the contract you may export your data (clause 14.1); then we delete it under clause 14.4, unless the law requires us to keep it. Backups are overwritten within 7 days, deleted media files and storage containers are kept for 7 days so that they can be recovered and are then erased, and logs are deleted within 30 days.
Audits. We make available to you the information needed to show that we meet this agreement, and we allow and contribute to audits, including inspections, by you or an auditor you appoint, announced reasonably in advance and bound to confidentiality.
Annex 4, appendix: Technical and organisational measures (security policy)
These are the measures we take to protect the data we process, under Article 32 GDPR. They are our security policy.
Location. The service and its data are hosted in the European Union, in Microsoft Azure's West Europe region (the Netherlands).
Encryption. All connections to the service and between its parts are encrypted in transit (TLS). The database, the file storage and the backups are encrypted at rest. The access tokens of connected social media accounts are additionally encrypted by the application; they are never logged and never returned by the API. The service's own secrets are kept in a key vault.
Separation of customers. Every record that belongs to an organization carries that organization, and the separation is enforced in the database layer: a query that does not name the organization fails instead of returning another organization's data. Automated tests prove that one organization cannot read another's data.
Access control. People sign in through Microsoft Entra External ID. What a person may do is decided by their role in the organization (owner, administrator, member) and in each brand (manager, editor, approver, viewer). Guest links are limited to the posts sent, expire after 14 days and can be revoked. API credentials are issued per organization and can be revoked. Our own staff have access only as far as their work requires.
Availability and backups. The database is backed up automatically, and a backup can be restored for 7 days. Deleted media files and storage containers are kept for 7 days so that they can be recovered, and are then erased.
Logging. Operational logs are kept for 30 days and do not contain access tokens or other secrets.
Incidents. A security incident is handled by our incident procedure; a breach of personal data is notified as point 10 of this annex says.
Review. We review these measures when the service or the risks change.