Privacy policy
Last updated: October 25, 2026
This page is a translation of the French original. In the event of any discrepancy, the French version prevails.
This policy explains which personal data Marklls HK processes when you use the SprintPost website and application (https://www.sprintpost.app), why, on what legal basis, for how long, with whom it is shared and how to exercise your rights. It applies in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi « Informatique et Libertés » No. 78-17 of 6 January 1978).
1.Data controller
Marklls HK, SAS, RCS Lyon 908821580, whose registered office is located at 12 rue de la Part Dieu 69003 Lyon, France. For any question about your data: contact@sprintpost.app.
2.Controller or processor
We are the controller for your account data, billing, the security of the service, the measurement of its use and our communications with you.
For the data that you place in a workspace or that the service retrieves for you (posts, media, members, social accounts, analytics, comments received), the customer that holds the workspace is the controller and we act as processor, under the terms of the data processing agreement.
3.Data processed
- Account: name, email address, one-time sign-in codes sent by email (valid for 10 minutes; only an irreversible hash is kept), profile picture if you sign in with Google, language, two-factor authentication factors and codes. SprintPost doesn’t use passwords.
- Workspaces and team: workspace name, time zone, members, roles, invitations, subscribed plan and usage of its limits.
- Connected social accounts (Facebook, Instagram, Threads, LinkedIn, TikTok, YouTube, Pinterest, X): identifiers and names of the accounts, Pages or channels selected, profile picture, permissions granted and access tokens.
- Content: photos, videos, edits, texts, tags, mentions, internal notes, publication dates, comments and approval history.
- Publishing data: links and identifiers of posts, analytics (views, reactions, comments, shares, saves), comments received and replies, with the public name, identifier and picture of their authors.
- Google imports: only the files that you select yourself in the Google Drive or Google Photos picker.
- AI assistant: the texts, images and instructions that you submit, and the generated suggestion; a usage log (date, type, provider) is used to track quotas.
- Technical data: IP address, browser, login dates, error logs and logs of calls rejected by the social networks.
- Referrals: your referral link and its number of visits, the account that referred you if any, your referrals and the status of their rewards. Your referrer sees your first name, the initial of your last name, your sign-up date and whether you subscribe; never your email or your content.
- Billing and communications: company name, address, VAT number, invoices, subscription status, plan history and correspondence with support. Bank details are entered on the pages of our payment provider Stripe, which keeps them: we have no access to them.
4.Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; providing the service (import, editing, writing, approval, scheduling, publishing, analytics, comment inbox) | Performance of the contract (Art. 6(1)(b) GDPR) |
| Enforcing plan limits and administering the platform | Performance of the contract |
| Securing the service, preventing fraud and abuse, diagnosing social network errors | Legitimate interest (Art. 6(1)(f)): ensuring the security and reliability of the service |
| Informing you about the service (incidents, changes, amendments to the terms) and assisting you | Performance of the contract; legitimate interest |
| Improving the service on the basis of aggregated usage statistics | Legitimate interest: developing the product |
| Running the referral program (the referral’s offer, the referrer’s credit, preventing abuse) | Performance of the contract (program terms) |
| Collecting payments, managing the subscription (renewal, plan changes, cancellation) and making invoices available | Performance of the contract |
| Invoicing, keeping the accounts, responding to requests from the authorities | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending our rights | Legitimate interest |
5.People who interact with posts
When a brand uses the comment inbox, SprintPost retrieves, through the networks’ official APIs, the comments published under its posts: text, date, public name, identifier and picture of their author, number of “likes”. This data is used solely to enable the brand to read, reply to, react to and moderate them. It is not used for profiling or for advertising, nor shared with other customers.
The brand concerned is the controller of this data; we act on its behalf. This data is deleted together with the post, the social account or the workspace. If you have commented on a post and wish to exercise your rights, contact the brand or write to us at contact@sprintpost.app; your comment otherwise remains visible on the social network until you delete it there.
6.Recipients and processors
Your data is never sold. It is accessible only to the members of our team who need it, and to the following service providers, which are bound by contract and subject to confidentiality obligations:
| Provider | Role | Location |
|---|---|---|
| Clever Cloud SAS | Hosting of the application, the database and the files | France |
| Stripe Payments Europe, Ltd. | Subscription payments and invoicing | Ireland (EU) |
| Anthropic PBC | AI assistant, if this provider is chosen for the workspace | United States |
| OpenAI, L.L.C. | AI assistant, if this provider is chosen for the workspace | United States |
| Mistral AI SAS | AI assistant, if this provider is chosen for the workspace | France |
| X.AI LLC (xAI) | AI assistant, if this provider is chosen for the workspace | United States |
| Google LLC | Sign-in with Google; import from Google Drive and Google Photos, at your request | United States |
AI providers receive only what the request needs (texts, images, instructions). With SprintPost AI, we use their business offerings and do not authorize them to use this data to train their models. If a workspace switches to “My AI”, its requests are sent to the account it connected (OpenAI, Anthropic, Mistral AI, xAI or OpenRouter, which passes them on to the provider of the chosen model): that provider’s contract and privacy policy then apply, and we keep only the access key, encrypted.
For payments, Stripe also acts as an independent controller for its own obligations (fraud and money-laundering prevention, financial regulations): see its privacy policy.
Social networks receive the content that you decide to publish or send to them (posts, replies, reactions, hidden comments). They then act as independent controllers, under their own policies: Meta, LinkedIn, TikTok, Google, Pinterest and X.
Finally, we may disclose data to administrative or judicial authorities where required by law.
7.Transfers outside the European Union
Where data is processed by a service provider established outside the European Union (Anthropic, OpenAI, xAI, Google, and Stripe for some payment-related processing), the transfer is governed by the European Commission’s adequacy decision on the EU–US Data Privacy Framework for certified companies and, failing that or in addition, by the standard contractual clauses adopted by the Commission (Decision 2021/914). A copy of these safeguards may be obtained on request.
8.Retention periods
| Data | Period |
|---|---|
| Account and profile | For the lifetime of the account, then deletion within 30 days of its closure |
| Workspace content (posts, media, tags, history) | For the lifetime of the workspace, then deletion within 30 days of its deletion or the end of the subscription |
| Social network access tokens | Until the social account is disconnected or the authorization is revoked: immediate deletion |
| Analytics and comments received | For as long as the post is tracked and the account is connected; deletion together with the post, the social account or the workspace |
| Social network error log | 90 days |
| Technical and security logs | 12 months maximum |
| Communications with support | 3 years after the last communication |
| Invoices and accounting records | 10 years (Article L123-22 of the French Commercial Code) |
| Backups | 30 days maximum, on a rolling basis |
9.Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest, the right to withdraw your consent where it is the basis for processing, and the right to set out directives regarding what happens to your data after your death.
To exercise these rights, write to contact@sprintpost.app from your account’s email address. We respond within one month, which may be extended by two months if the request is complex; proof of identity may be requested if there is reasonable doubt as to your identity. For the data of a workspace, please contact its holder first: we help them respond to you. The deletion procedure is detailed on the Data deletion page.
You may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
10.Security
- Encryption of communications (HTTPS/TLS);
- social network access tokens and API keys encrypted at rest (AES-256-GCM);
- passwords stored as irreversible hashes; two-factor authentication available;
- segregation of data by workspace, roles and access restricted account by account;
- our team’s access restricted to what is strictly necessary and logged;
- regular backups, security updates and hosting in France.
In the event of a data breach presenting a risk, we notify the CNIL within 72 hours and inform the data subjects where the risk is high; customers are notified within the time limits set out in the data processing agreement.
12.Data from Google services
SprintPost accesses Google services only with your authorization: sign-in with Google (name, email, picture), import of the files that you select in Google Drive or Google Photos and, if you connect a channel, YouTube (video uploads, channel name and statistics, comments).
SprintPost’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. In particular, this data is used only for the features that you use, is neither sold nor used for advertising, is read by a human only with your consent or for security or legal reasons, and is not used to train general-purpose artificial intelligence models.
SprintPost uses YouTube API Services: by connecting a channel, you agree to the YouTube Terms of Service; the data concerned is also processed in accordance with the Google Privacy Policy. You may revoke this access at any time from the security page of your Google Account. Stored YouTube data is refreshed or deleted at least every 30 days, and deleted within 7 days of the channel being disconnected.
13.Data from social networks
Access to social networks is exclusively through their official APIs, with the permissions that you grant and that you may revoke at any time, from SprintPost or from the network concerned. We request only the permissions necessary for the features offered and comply with the platforms’ terms (Meta Platform Terms, developer terms of TikTok, LinkedIn, Pinterest and X). The revocation of access from Facebook, Instagram or Threads is notified to us and results in the automatic deletion of the access concerned.
14.Minors
The service is intended for professionals and reserved for adults. It is not directed at children and we do not knowingly collect data concerning them.
15.Changes
We may change this policy. The date of the last update appears at the top of the page; in the event of a significant change, you will be informed by email or in the application before it takes effect.