1. Who is responsible for your data
Lisek (lisek.alfabetmarki.pl) is a social media management panel. It is used by the team of the Alfabet Marki agency and by the agency's clients (in the client portal, e.g. to approve posts).
Lisek is run by Alfabet Marki sp. z o.o., ul. Strzałowa 13K/1, 87-100 Toruń, Poland, NIP (tax ID) 956 239 91 18, KRS 0001147842 ("Alfabet Marki", "we").
Contact for personal data matters: ks@alfabetmarki.pl.
2. Whose data we process and in what role
- Lisek users: members of the agency team and people using the client portal. We process their data as the controller.
- People who connect their pages and accounts to Lisek (by signing in with Facebook, Google, LinkedIn or TikTok). We process their data as the controller, as far as the connection needs it to work.
- People who comment on posts or send messages to our clients' profiles on Facebook, Instagram, LinkedIn, TikTok and YouTube. The controller of this data is the client (brand) that owns the profile. Alfabet Marki processes it on the client's behalf as a processor, under a data processing agreement (Art. 28 GDPR).
3. What data we process
Lisek account
- name, e-mail address, profile picture;
- team role, interface language, notification settings;
- activity log: sign-ins, active time, browser type, presence in the panel and a history of actions (e.g. who created or changed a post).
We do not store passwords in plain text.
Connected pages and accounts
- name, ID and picture of the page or account;
- the permissions the connecting person has on it;
- access tokens issued by the platform.
Content and team work
- posts, photos, videos, captions, publishing plans;
- materials sent by the client;
- tasks, internal comments and approvals.
Data from social platforms
- published posts and their statistics: reactions, comments, shares, reach, views;
- comments and replies under clients' posts, with the author's name, platform ID and profile picture (we store a copy of the picture), and whether the comment is hidden;
- private messages in the Inbox module (Messenger, Instagram Direct): content, the sender's name and username, profile picture and attachments (copies are kept in private file storage);
- notifications (webhooks) in which the platform tells us about new comments, messages and reactions.
AI features
- prompts and content sent to AI models, e.g. the text of a comment when suggesting a reply, or a brief when creating a publishing plan;
- generated texts and images;
- the client's brand description and documents (the "brand memory");
- information about AI usage and cost.
Technical data
- server and database logs (IP address, time and type of request);
- data stored in the browser (sign-in session, preferences, a working copy of the post being edited).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the panel and running user accounts | Art. 6(1)(b) (contract with the client or cooperation) and Art. 6(1)(f) (our legitimate interest in giving the team a working tool) |
| Planning and publishing content, handling comments and messages, statistics and reports for the client | performance of the contract with the client (Art. 6(1)(b)); for the data of people who comment or write: on behalf of the client (Art. 28), whose basis is its legitimate interest in communicating with its audience (Art. 6(1)(f)) |
| AI features (content and reply suggestions, images, plans) | as above; AI runs at the user's request |
| E-mail and in-app notifications | Art. 6(1)(b) and (f) |
| Security, abuse prevention, activity log | Art. 6(1)(f) |
| Legal obligations, e.g. tax and accounting | Art. 6(1)(c) |
| Establishing, pursuing and defending claims | Art. 6(1)(f) |
We do not sell data. We do not use data from social platforms for advertising or marketing profiling. We do not make automated decisions that have legal effects on you.
5. Who receives the data
Service providers (processors) process data on our behalf, only as far as needed to run the panel:
- Supabase Inc.: database, file storage and server functions. Data is stored in the European Union (Ireland).
- [hosting company]: the server that delivers the application.
- OpenAI: generating texts and images, reply suggestions, search in the brand memory.
- Anthropic: Claude models, when selected in the settings.
- Google: Gemini models, when selected in the settings, and Google Drive as an optional place to save files (Lisek can only access files it saved there itself).
- Canva: designing graphics, when the user connects a Canva account.
- Magnific: stock photo library (searching photos for posts).
- E-mail provider: sending notifications.
The platforms we connect profiles with, Meta Platforms (Facebook, Instagram), LinkedIn, TikTok and Google (YouTube), receive the content and replies we publish. They act as separate controllers under their own terms and privacy policies.
If users connect an AI assistant (e.g. Claude or ChatGPT) to Lisek themselves, data from the panel reaches that assistant as far as they ask it to.
Public authorities may also receive data where the law requires it.
6. Transfers outside the European Economic Area
Lisek's database is in the EU, but some providers (Supabase, OpenAI, Anthropic, Google, Canva) are based or operate outside the EEA, mainly in the USA, and may process data there. These transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses approved by the Commission.
7. How long we keep data
- Lisek account: for the duration of the cooperation. After it ends, we delete or anonymise it within 30 days unless the law requires longer storage.
- Access tokens: until the page or account is disconnected or access is revoked. When an account is disconnected in Lisek, its tokens are deleted immediately.
- Platform data (posts, statistics, comments, messages): as long as the profile is connected to Lisek and the client uses the service. At the client's request we delete it earlier, and no later than 30 days after the cooperation ends. When a comment is deleted on Facebook or Instagram, Lisek deletes it automatically: after the platform's notification or at the next check of the comments.
- Technical logs and backups: for a short period set by the provider, after which they are overwritten.
- Data needed for accounting and claims: for the period required by law.
8. Your rights
You have the right to:
- access your data and receive a copy;
- have your data corrected;
- have your data erased;
- restrict processing;
- data portability;
- object to processing based on legitimate interest;
- lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, Poland).
Write to us at ks@alfabetmarki.pl. If your data comes from our client's profile (e.g. your comment or message to a brand), we pass the request to the client as the controller and follow its instructions. You can also contact the brand directly.
9. Platform connections and revoking access
Lisek uses platform data only within the permissions approved when signing in. You can revoke access at any time:
- Facebook and Instagram: Settings & privacy → Settings → Business integrations → Lisek → Remove;
- Google and YouTube: security.google.com/settings/security/permissions;
- LinkedIn: Settings & Privacy → Data privacy → Permitted services;
- TikTok: business account settings → app permissions.
A team member can also disconnect a page or account in Lisek (Settings → Integrations). Its access tokens are then deleted immediately.
Lisek uses YouTube API Services to manage YouTube channels. By using these features you agree to be bound by the YouTube Terms of Service (www.youtube.com/t/terms). How Google processes data is described in the Google Privacy Policy (policies.google.com/privacy).
Lisek's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
10. Deleting data
Instructions for deleting your data: alfabetmarki.pl/lisek-usuwanie-danych.
11. Security
We use technical and organisational measures to protect data against unauthorised access, loss or misuse:
- encrypted connections (HTTPS);
- database rules that limit access to data to the people who need it;
- platform access tokens are read only by server functions and never reach the browser;
- keys to external services (e.g. AI, Canva, Google Drive) are stored encrypted;
- a log of actions in the panel.
12. Cookies and browser storage
Lisek does not use advertising or analytics cookies. In the browser we store only what the panel needs to work: the sign-in session, preferences (e.g. the selected client) and a working copy of the post being edited.
13. Children
Lisek is a business tool and is not intended for people under 16.
14. Changes to this policy
We will inform users of material changes in the panel or by e-mail. The current version is always available at alfabetmarki.pl/lisek-polityka-prywatnosci. If the Polish and English versions differ, the Polish version prevails.