Privacy Policy
Last updated: October 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:
No data protection officer has been appointed by law. For data protection inquiries, please contact the address above directly.
2. General Information on Data Processing
We process personal data only to the extent necessary to provide our services (data minimization principle, Art. 5(1)(c) GDPR). Personal data is generally processed only after the user's consent, except where prior consent is not feasible and processing is permitted by law.
We engage external service providers as data processors pursuant to Art. 28 GDPR. They are contractually obligated to process personal data exclusively according to our instructions and in compliance with the GDPR.
No automated decision-making including profiling pursuant to Art. 22 GDPR takes place.
3. Legal Bases for Data Processing
Where we obtain consent, Art. 6(1)(a) GDPR serves as the legal basis.
Where processing is necessary for the performance of a contract, Art. 6(1)(b) GDPR serves as the legal basis.
Where processing is necessary to fulfill a legal obligation, Art. 6(1)(c) GDPR serves as the legal basis.
Where processing is necessary for the purposes of legitimate interests, Art. 6(1)(f) GDPR serves as the legal basis, provided the interests or fundamental rights of the data subject do not override those interests.
4. Data Deletion and Storage Duration
Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Storage may continue if required by European or national legislation. Data will be blocked or deleted when a storage period prescribed by law expires, unless further storage is necessary for the conclusion or performance of a contract.
5. Cookies and Similar Technologies
Our website uses cookies and similar storage technologies such as the browser's localStorage. We distinguish between technically necessary and optional technologies.
Technically necessary cookies (§ 25(2) TTDSG)
These technologies are essential for the operation of the platform and are set without consent. They include:
- JWT authentication token — stored in the browser's localStorage; used solely for session management; legal basis: Art. 6(1)(b) GDPR
- Consent setting (
cd_consent) — stores your cookie consent; legal basis: Art. 6(1)(c) GDPR in conjunction with § 25(2) TTDSG
Optional cookies (with consent)
Functional cookies enable extended features such as saved UI preferences. Legal basis: Art. 6(1)(a) GDPR.
Consent and withdrawal
On your first visit, a cookie banner will be displayed. You may withdraw your consent at any time by clicking "Cookie Settings" in the website footer.
6. Website Provision and Log Files
Each time our website is accessed, our system automatically collects data from the requesting computer system, including:
- Browser type and version
- Operating system
- Internet service provider
- IP address
- Date and time of access
- Referring website
- Pages visited via our website
Log data is deleted after 7 days at the latest. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security).
7. Registration and User Account
Registration requires the following personal data:
- First and last name
- Email address
- Password (stored encrypted, never in plain text)
Legal basis: Art. 6(1)(b) GDPR. Data is stored for as long as the account exists. Billing-related data is retained for up to 10 years pursuant to commercial and tax law (Art. 6(1)(c) GDPR).
After login, a JWT token is stored in the browser's localStorage solely for authentication purposes. Legal basis: Art. 6(1)(b) GDPR.
8. Google OAuth (Sign in with Google)
We offer the option to sign in via Google OAuth. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
With your consent, Google transmits the following data: name, email address, profile picture (optional). We use this data exclusively for creating and managing your user account. Legal basis: Art. 6(1)(a) and Art. 6(1)(b) GDPR.
Data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We additionally rely on Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
Further information: https://policies.google.com/privacy
9. Social Media Integrations and Automatic Publishing
Users may connect accounts on third-party platforms such as Meta (Instagram, Facebook), TikTok, YouTube, and LinkedIn to ContentDeck. Depending on the permissions granted, we may receive access to profile and account information, content, analytics data, and scheduling information, as well as the ability to publish posts on the user's behalf. The permissions we request per platform and their purposes are listed in section 9.4.
9.1 Scheduled Automatic Publishing
In ContentDeck, users can plan posts — such as images, videos, reels, and stories — and choose the connected accounts on which they should appear. At the scheduled time, or immediately if the user chooses, ContentDeck transmits the media files, the caption, and the platform settings chosen by the user to the selected account via the platform's official API. These settings include, for example, visibility, comment, duet, and stitch settings and the commercial content disclosure on TikTok, and the title, visibility, and "made for kids" setting on YouTube.
The transmission takes place on the user's behalf and only after the user's explicit action, i.e. scheduling a post or choosing to publish it immediately. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
9.2 Stored Data
For planning and publishing, we store:
- Uploaded media files and media files imported from connected cloud storage (Google Drive, Dropbox, Frame.io)
- Technical file metadata (file name, size, dimensions, duration)
- Captions and optional alternative texts (image descriptions) for images
- Scheduled time and time zone
- The selected platform settings
- Publishing status and error messages
- ID and link of the published post
Media files are stored on servers operated for ContentDeck. Where a platform retrieves media files itself via a link — for example images for Instagram and TikTok — ContentDeck generates temporary, signed, non-guessable download links for this purpose that are valid for no more than 24 hours. The files are not publicly listed or indexed.
To maintain connected accounts, we store OAuth access tokens and refresh tokens encrypted (AES-256-GCM) on our servers. Legal basis: Art. 6(1)(b) GDPR.
9.3 Retention
Media files are deleted when the user deletes them, when the associated connection or the user account is deleted, and automatically 90 days after they were last used if no planned post uses them. Incomplete upload fragments are deleted after 24 hours. Post records (status, link to the published post) are kept until the user deletes the post or the user account is deleted.
Deleting a post in ContentDeck does not remove content that has already been published on a platform. Such content can be deleted directly on the platform.
9.4 Permissions per Platform
Depending on the platform, ContentDeck requests the following permissions:
Instagram (via Instagram Login or Facebook Login)
instagram_business_basic/instagram_basic— retrieving basic profile informationinstagram_business_content_publish/instagram_content_publish— publishing posts, reels, stories, and carouselsinstagram_business_manage_insights/instagram_manage_insights— retrieving analytics datapages_show_list,pages_read_engagement,business_management— identifying the Facebook Page linked to the Instagram professional account (Facebook Login only)
The first permission of each pair applies when signing in via Instagram Login, the second when signing in via Facebook Login.
Facebook Pages
pages_show_list,pages_read_engagement,business_management— displaying and selecting the Facebook Pages the user manages and retrieving Page content and engagement data for analyticspages_manage_posts— publishing posts, photos, videos, and reels to Pages the user manages
TikTok
user.info.basic,user.info.profile,user.info.stats— retrieving profile information and statisticsvideo.list— retrieving the video list for analyticsvideo.publish— direct posting with the privacy level selected by the uservideo.upload— sending content as a draft to the user's TikTok inbox
Before posting to TikTok, ContentDeck displays the name of the TikTok account. Visibility is never preselected, and content is only posted after the user's explicit consent.
YouTube (Google)
youtube.readonly,yt-analytics.readonly— retrieving channel information and analytics datayoutube.upload— uploading the videos scheduled by the user with the title, description, visibility, and "made for kids" setting chosen by the user
Google Drive
drive.file— used only for files the user explicitly selects in Google's file picker (Google Picker) to import them into ContentDeck for publishing. ContentDeck has no access to any other files in the user's Google Drive; selected files are only read, never modified.
r_basicprofile— retrieving the profilew_member_social— publishing on the member's behalfr_member_postAnalytics,r_member_profileAnalytics— retrieving analytics dataw_organization_social— publishing on behalf of company pages the member administersr_organization_social,rw_organization_admin,r_organization_followers— retrieving analytics data for company pages
Dropbox and Frame.io (Adobe)
- Read access to let the user browse their files and import selected files
- Frame.io: signing in with Adobe additionally transmits basic profile information (name, e-mail address, account role) (scopes openid, profile, email, additional_info.roles, offline_access); ContentDeck only uses the account name to display the connection
9.5 YouTube API Services and Google User Data
ContentDeck uses YouTube API Services. By using the YouTube features of ContentDeck you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms).
Google's Privacy Policy applies: https://policies.google.com/privacy
You can revoke ContentDeck's access to your Google account (YouTube and Google Drive) at any time via Google's security settings: https://security.google.com/settings/security/permissions. If you remove the connection in ContentDeck or revoke access, ContentDeck deletes the stored YouTube API data, at the latest within 7 days after the revocation becomes known to us. YouTube analytics data is retrieved live via the API and is not stored permanently.
ContentDeck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
In particular, Google user data is not used for advertising, is not sold, and is not used to train generalized AI or machine learning models. Humans only read this data with your consent, where necessary for security purposes or to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.
9.6 Disconnecting Accounts and Revoking Access
Connected accounts can be disconnected at any time in ContentDeck under "Einstellungen → Social Media Integrationen" (Settings → Social Media Integrations) or "Einstellungen → Cloud-Integrationen" (Settings → Cloud Integrations). ContentDeck deletes the stored tokens immediately and, where the platform supports it (Google, TikTok, LinkedIn, Dropbox, Adobe/Frame.io), also revokes access at the platform. Planned posts for a disconnected account are not published.
You can also revoke access directly at the respective platform: for Google via the link in section 9.5, for TikTok and LinkedIn in the app settings of your respective account, and for Facebook or Instagram as described in section 9.7.
9.7 Data Deletion for Meta (Facebook and Instagram)
You can remove ContentDeck at any time in the settings of your Facebook or Instagram account under "Apps and Websites". Meta then automatically notifies ContentDeck (data deletion callback), and ContentDeck deletes your stored Meta connections and access tokens; planned posts for the affected Meta accounts are no longer published. You receive a confirmation code and a link where you can check the status of the deletion.
Alternatively, you can disconnect the account in ContentDeck under "Einstellungen → Social Media Integrationen" (Settings → Social Media Integrations) or request deletion by email to info@contentdeck.io. Step-by-step instructions are available on our Data Deletion page.
9.8 Third-Country Transfers and Responsibility of the Platforms
Data may be transferred to third countries as part of the API communication. The platform providers process the data under their own responsibility, in particular content once it has been published on the respective platform. The providers are Meta Platforms Ireland Ltd. / Meta Platforms, Inc. (Instagram, Facebook), Google Ireland Ltd. / Google LLC (YouTube, Google Drive), TikTok Technology Ltd. / TikTok Pte. Ltd. (TikTok), LinkedIn Ireland Unlimited Company (LinkedIn), Dropbox, Inc. (Dropbox), and Adobe Inc. (Frame.io). For more information, see the privacy policies of each provider:
10. Cloud Storage Integrations
ContentDeck enables connections to the cloud storage services Google Drive, Dropbox, and Frame.io (Adobe). Users can import selected files into ContentDeck for publishing: for Dropbox and Frame.io they browse their folders within ContentDeck; for Google Drive they select the files in Google's file picker. ContentDeck only has read access; files in the cloud storage are not modified. Imported files are stored and deleted in the same way as uploaded media files (see sections 9.2 and 9.3). The requested permissions and the providers are listed in sections 9.4 and 9.8; for Google Drive, section 9.5 also applies.
To maintain connections, we store OAuth access tokens and refresh tokens encrypted (AES-256-GCM) on our servers. Legal basis: Art. 6(1)(b) GDPR. Users may disconnect cloud storage accounts at any time under "Einstellungen → Cloud-Integrationen" (Settings → Cloud Integrations). The stored tokens are deleted immediately; for Google, access is also revoked.
11. AI-Powered Features
To provide AI-powered features, user content may be transmitted to external AI service providers:
OpenAI (ChatGPT)
OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA
Data transfer to USA: Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
Anthropic (Claude)
Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA
Data transfer to USA: Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.
Google Gemini
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Data transfer to USA: certified under EU-US Data Privacy Framework; additionally SCCs pursuant to Art. 46(2)(c) GDPR.
Processing by AI services is conducted solely to carry out the function requested by the user. Legal basis: Art. 6(1)(b) GDPR.
12. Email Contact and Email Delivery
If you contact us by email (e.g. at info@contentdeck.io), we process your email address, your name if provided, and the content of your message in order to handle your request. Legal basis: Art. 6(1)(b) GDPR where the request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR. The data is deleted once it is no longer required, at the latest after 3 years, unless statutory retention obligations apply.
Emails sent to addresses of the domain contentdeck.io are received via Cloudflare Email Routing (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) and forwarded to our mailbox hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Cloudflare is certified under the EU-US Data Privacy Framework; additionally SCCs pursuant to Art. 46(2)(c) GDPR apply. We have concluded a data processing agreement pursuant to Art. 28 GDPR with STRATO. https://www.cloudflare.com/privacypolicy/
System emails (e.g. email address confirmation, password reset, notifications) are sent via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany). Your email address and the content of the respective email are transmitted to Brevo. Legal basis: Art. 6(1)(b) GDPR. We have concluded a data processing agreement pursuant to Art. 28 GDPR with Brevo. https://www.brevo.com/legal/privacypolicy/
Waitlist: If you sign up for the waitlist on our website, we process your email address, the selected language, the page on which you signed up, and the time of signup and confirmation in order to inform you by email about the launch of ContentDeck. Signup uses a double opt-in procedure: you receive an email with a confirmation link and are only added to the waitlist after confirming. Unconfirmed signups are deleted after 7 days. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future – via the unsubscribe link on the confirmation page or by email to info@contentdeck.io; your address will then be deleted. Otherwise, we store the data until the waitlist is no longer needed following the launch of ContentDeck. The data is stored on our servers in Germany (see Hosting); emails are sent via Brevo (see above).
13. Payment Processing via Stripe
For paid subscriptions we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Required data is transmitted to Stripe. We do not store complete payment data ourselves.
Legal basis: Art. 6(1)(b) GDPR. Billing data is retained for up to 10 years pursuant to commercial law. Stripe LLC is certified under the EU-US Data Privacy Framework; additionally SCCs pursuant to Art. 46(2)(c) GDPR. https://stripe.com/privacy
14. Hosting
This website and the ContentDeck application (including the database and uploaded media) are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in data centers in Germany. We have concluded a data processing agreement (DPA) with Hetzner pursuant to Art. 28 GDPR.
15. Data Deletion Upon Request
Users may request the deletion of their account and all stored personal data at any time. To request complete data deletion, contact: info@contentdeck.io. We process deletion requests within 30 days, subject to statutory retention obligations.
Instructions, including how to disconnect connected accounts and how to request deletion via Facebook or Instagram, are available on our Data Deletion page.
16. Rights of Data Subjects
If your personal data is processed, you have the following rights against the controller:
Right of access (Art. 15 GDPR)
You may request confirmation as to whether personal data concerning you is being processed.
Right to rectification (Art. 16 GDPR)
You have the right to request correction and/or completion if processed data is inaccurate or incomplete.
Right to erasure (Art. 17 GDPR)
You may request the immediate deletion of personal data concerning you, provided one of the legally specified grounds applies.
Right to restriction of processing (Art. 18 GDPR)
You have the right to request restriction of processing where one of the legal conditions is met.
Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR)
You have the right to object at any time to processing based on Art. 6(1)(e) or (f) GDPR. You may send your objection by email to info@contentdeck.io.
Right to withdraw consent (Art. 7(3) GDPR)
You have the right to withdraw your data protection consent at any time. Cookie consent may be withdrawn via the "Cookie Settings" link in the footer.
Right to lodge a complaint (Art. 77 GDPR)
You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or place of the alleged infringement.
To exercise your rights: info@contentdeck.io
17. Updates to this Privacy Policy
This privacy policy is current as of October 2026. As our platform evolves or legal requirements change, it may be necessary to update this policy. The current version is always available on this page.