Privacy Policy

Revision: 1.1 · in force from: 11 September 2026

1. Who is responsible, and for what

Modus Altos Mikhail Kushnir, NIP 9452325283, REGON 543982920, ul. Partyzantów 8/2, 31-435 Kraków, Poland. Questions about data: mikhail@agenticos.agency.

There are two different roles here, and mixing them up is what makes policies confusing:

• We are the controller for data about you as our client — your account, your payments, our server logs.
• We are the processor for data about your audience that you put into the service — the people who comment on your posts or write to you. There, you decide what happens; we only carry it out. The data processing agreement under Article 28 GDPR applies automatically.

We have not appointed a Data Protection Officer. We are not required to: we are a small company, our core activity is not large-scale monitoring of people, and we do not process special categories of data.

2. What we process, why, and on what legal basis

Each purpose has its own basis. Where the basis is our legitimate interest, the interest itself is named — a policy that says only "legitimate interest" says nothing.

Running your account

Data: name, email, password stored only as a hash, your language and theme, the organisation and brands you belong to.
Basis: performance of the contract (Art. 6(1)(b) GDPR).
Required? Yes — without an email address we cannot create an account or let you back into it.

Doing the work you asked for

Data: what you upload — business description, products, images, video, content plan — plus access tokens for the social accounts you connect, and the comments, messages and post metrics we fetch for you.
Basis: performance of the contract. For personal data belonging to your audience we act on your instructions as processor.
Required? Yes for the features you use; you decide which ones.

Payment and accounting

Data: plan, invoices, what was spent and when. Card details never reach us and are never stored in our system — they go straight to the payment provider.
Basis: contract, and legal obligation for the tax records (Art. 6(1)(c)).

Keeping the service working and safe

Data: error and request logs, sign-in attempts, spend records.
Basis: legitimate interest (Art. 6(1)(f)) — the interest is keeping the service running, finding faults, billing correctly and detecting abuse of accounts. We keep these logs short and do not use them to build a profile of you.

Support requests

Data: the text of your request, the files you attach (screenshots, short videos), the email address of your account and, only if you leave the box ticked, technical details: which part of the app you were in, the app version, browser type, window size, language and the last error messages from the browser console. We strip EXIF metadata from images and never include passwords or access tokens.
Basis: performance of the contract (Art. 6(1)(b)) — we need it to answer you. Kept while your account exists and deleted together with it; you can also ask us to erase a single request earlier.

Improving the product from usage statistics

Data: which sections and buttons of the app are opened, which formats (video, carousel, photo, text) and networks are chosen, and whether errors occurred. Only identifiers from our fixed list, the date and the name of your plan. We do not store texts, the content of posts or messages, page addresses, IP addresses or browser data, and we write nothing to your device: no cookies, no local identifiers. A single user cannot be recovered from these counters, and the daily identifier we use to count distinct people is not kept longer than a day. Counters are kept for up to 400 days.
Basis: legitimate interest (Art. 6(1)(f)) — the interest is seeing what the product is really used for and improving it. We do not pass this data to third parties and do not build a profile of a person from it.
Clients' post results. We do not combine the results of different clients' posts obtained through platform APIs (Meta, LinkedIn, TikTok) into shared statistics: the platforms' terms allow that data to be used only for the client it belongs to. Recommendations are built on your own results.
Your control: you can object (Art. 21 GDPR) by writing to mikhail@agenticos.agency; we will switch the counting off for your account.

Showing your work as an example

Data: the material you made, and your brand name next to it.
Basis: your consent (Art. 6(1)(a)) — off by default, given by a switch in Settings, and withdrawable at any time with the same switch. Withdrawing does not affect what was lawful before.

Emails we send

Data: your email address.
Basis: contract for service emails (verification, password reset, receipts, notices about changes) — these you cannot switch off while you have an account. Anything promotional goes only with your consent and has an unsubscribe link.

3. Automated decisions

The service acts on its own: it plans content and, in autopilot mode, prepares posts and replies. Those decisions are about content, not about people — nothing here decides whether someone gets a service, a price or a job.

We do not carry out automated decision-making producing legal or similarly significant effects on a person in the sense of Article 22 GDPR, and we do not profile the people in your audience.

Autopilot never publishes without approval unless you switch that on yourself, and you can switch it back at any moment.

4. Separation between brands

Each brand's data is stored separately rather than in one shared pile: library, posts, inbox, leads, analytics and media belong to a specific brand. A team member sees only the brands they have been given access to.

5. Who the data goes to

To carry out your task, data is passed to service providers:

• Model providers — the task text and the images needed to generate.
• Social platforms — what you publish or send.
• Object storage — media files.
• Payment provider — payment details, which do not pass through us.
• Email delivery — your address and the message.

Every one of them is named, with what they receive and where they sit, on the sub-processors page. We do not sell data and we do not share it for anyone else's advertising.

We also disclose data where the law requires it — a lawful request from an authority — and we tell you when we are allowed to.

Requests from public authorities

A demand from a government body is not a reason to hand over everything. Whenever we receive one — a court order, a police request, a national security demand — we follow the same four steps, and we follow them before anything leaves our servers:

1. We check that the request is lawful. We verify who is asking, under which provision, and whether they have authority over us. A request that does not establish its own legal basis is not answered on its merits. Where the demand is significant or unclear we take legal advice before responding.
2. We challenge requests we consider unlawful. If a request is outside the authority's competence, unsupported by law, or broader than the law allows, we object to it and, where the procedure exists, appeal it or seek to have it narrowed, rather than complying to be safe.
3. We disclose the minimum necessary. We hand over only the specific data the request actually covers, for the accounts and the period named in it. We do not widen the scope for convenience, and we do not include data about other customers or other people caught in the same records.
4. We write it down. Every request is recorded: who asked, when, what they demanded, the legal basis they relied on, what we decided and why, what we disclosed, and who inside our organisation handled it. That record is kept so that the decision can be reviewed afterwards.

We notify the affected customer whenever the law permits it. If we are forbidden from telling you, we say so as soon as the prohibition ends.

6. Transfers outside the EU

The servers holding your data are in Germany. Some providers process data in the United States — the page above says which. For those, transfers rely on the European Commission's standard contractual clauses, or on the provider's certification under the EU-US Data Privacy Framework where it has one. You can ask us for a copy of the safeguards for any particular provider.

7. How long we keep it

• Account and brand data — while the account exists, then erased from the live system when the account is deleted, except what we must keep by law. Encrypted off-site backups are overwritten on a rolling basis, so deleted data can remain in them for up to about 180 days (roughly six months) before it disappears.
• Generated media — 90 days by default, then deleted automatically.
• Temporary publishing files — 1 day.
• Access tokens — until you disconnect the account, and they are encrypted at rest.
• Invoices and tax records — 5 years from the end of the tax year, because Polish law requires it.
• Server and error logs — up to 90 days.
• Record of a deletion request — kept as a line in a log, so that we can prove the deletion happened.

8. Your rights

You may ask for access to your data, its rectification, erasure, restriction of processing, portability in a machine-readable form, and you may object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time — the switches in Settings do exactly that, and withdrawal does not make what happened before unlawful.

Write to mikhail@agenticos.agency. We answer within one month; if a request is complex we may extend that by two months and will tell you why.

Account deletion is also self-service: Settings → Delete account. It asks you to type a confirmation phrase and to confirm your password (or sign in again with Google), tells you beforehand exactly what will be removed, and, where the platform allows it (Instagram, Facebook, TikTok), revokes the tokens at the platform before deleting our copy. For LinkedIn we delete our copy of the token, and you can withdraw the access yourself in your LinkedIn settings.

If you think we handle your data wrongly, you can complain to the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or to the authority where you live.

9. Client links

Approvals and reports can be opened by someone without an account through a link. Such a link is tied to one brand, has an expiry date and can be revoked. It is not indexed by search engines. Whoever holds the link sees the data, so treat it like a password.

10. Security

Connections are encrypted. The session cookie is not readable by JavaScript and is sent only over a secure connection. Passwords are stored as hashes. Sign-in attempts are rate-limited. Access tokens for your social accounts are encrypted at rest. Share-link tokens are stored only as hashes and cannot be recovered from storage. Backups are kept in object storage separate from the server, sent over an encrypted connection and encrypted at rest by that provider — we do not add a second layer of our own on top, and we would rather say so than imply more than we do.

If a breach ever puts your rights at risk, we notify the supervisory authority within 72 hours and tell you directly where the law requires it.

11. Cookies

Technical only: the session and your theme choice. There are no advertising cookies, no tracking pixels and no third-party analytics. We therefore do not ask for cookie consent — there is nothing to consent to. Usage statistics of the app (section 2) are counted without cookies and without writing anything to your device.

12. Children

The service is for businesses and is not directed at children. We do not knowingly create accounts for people under 16.

13. Changes

If we change this policy materially, we give notice by email and in the app at least 14 days before it takes effect. The revision number and date at the top of this page always say which version is in force.