Privacy Policy

Mycompose (mycompose.ch) is a social-media planning and publishing application operated by Mycomp IT-Services GmbH ("we", "us"). It lets brands, agencies and their teams draft, approve, schedule and publish content to the social media accounts they connect (Facebook, Instagram, LinkedIn, Google Business Profile and TikTok). The controller responsible for the processing of personal data described in this policy is:

Mycomp IT-Services GmbH
Brühl 2, 8580 Sommeri TG, Switzerland
Email: socialmedia@mycomp.ch

This policy applies to the Mycompose application and covers the personal data of its users (members of customer workspaces and their clients) and data received from third-party social media platforms that users connect to the service. Mycompose is a business service for organizations; it is not directed at children and we do not knowingly process data of minors.

• Account data— name, business email address and authentication identifiers. If you sign in with Microsoft, we receive your name and email address from your organization's Microsoft Entra ID account. Passwords, where used, are stored only as cryptographic hashes by our authentication provider.
• Content data — the posts, captions, images and other media that users create, upload or submit for publication, together with scheduling, approval and publication metadata.
• Connected social account data — when a user connects a social media account via OAuth, we store the access tokens granted by the platform and basic metadata such as the page or organization name and identifier (for example a Facebook Page, an Instagram professional account, a LinkedIn organization page, a Google Business Profile location or a TikTok account). We only request the permissions needed to list manageable pages and to publish and read the content posted through Mycompose.
• Technical data — server logs (IP address, browser user agent, timestamps) generated by our hosting infrastructure for security and operations, and strictly necessary session cookies used to keep you signed in. We do not use advertising or tracking cookies and we do not run analytics profiles on our users.

We process personal data to:

• provide the service: authentication, drafting, approval workflows, scheduling and publishing of social media content on behalf of the connected accounts;
• send operational email notifications (e.g. invitations, password resets, approval requests, publication results);
• maintain security, prevent abuse and keep audit records of publishing activity;
• comply with legal obligations.

We process data in accordance with the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, our legal bases are performance of a contract (Art. 6(1)(b)), legitimate interests in operating and securing the service (Art. 6(1)(f)) and compliance with legal obligations (Art. 6(1)(c)).

Data received from social media platforms through their APIs (including page lists, page metadata and access tokens) is used exclusively to provide the publishing functionality the connecting user requested. We do not sell platform data, do not use it for advertising and do not share it with third parties other than the processors listed below. Tokens are deleted when a social account is disconnected or the associated workspace is removed. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TikTok.When a user connects a TikTok account (TikTok Login Kit), we receive and store the account's open ID, display name, username and avatar, and the access and refresh tokens TikTok issues. Before each post we read the account's current posting options (creator info: allowed visibility levels, whether comments, Duet and Stitch are enabled, maximum video length) and show them in the editor. Through the Content Posting API we publish only the videos and photos, captions and settings (visibility, interaction and commercial-content disclosure) that the user chose and approved in Mycompose, and we check the publishing status. We do not read other content from the TikTok account, do not add watermarks or promotional material, and do not use TikTok data for advertising or any other purpose. TikTok tokens and account data are deleted when the TikTok account is disconnected in Settings > Social Accounts or the workspace is removed.

We use a small number of service providers that process data on our behalf under data-processing agreements:

• Supabase — database, authentication and file storage; our project is hosted in Zurich, Switzerland.
• Vercel — application hosting and content delivery (EU/US infrastructure).
• Resend — transactional email delivery.
• Microsoft — single sign-on via Microsoft Entra ID for organization accounts.
• Meta Platforms, LinkedIn, Google and TikTok — when publishing, the content you schedule is transmitted to the respective platform; their own privacy policies apply to the processing on their side.

Where data is transferred outside Switzerland or the EU/EEA, we rely on adequacy decisions or standard contractual clauses.

Account data is kept for as long as the account exists. Content and publication records are kept for as long as the workspace they belong to exists. OAuth tokens are kept until the connected account is disconnected or the token expires. Server logs are retained for a short period by our hosting providers for security purposes. Upon account deletion, associated personal data is deleted or anonymized within 30 days, unless a legal obligation requires longer retention.

You have the right to request access to, rectification of, or deletion of your personal data, the right to restrict or object to its processing and the right to data portability. To exercise these rights, contact us at socialmedia@mycomp.ch. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with your local supervisory authority. Instructions for requesting deletion of your data are on our data deletion page.

Each workspace is accessible only to its own members. Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Access to connected social accounts is limited by role-based permissions inside the application.

We may update this policy from time to time. The current version is always available at this address; material changes will be communicated to users within the application or by email.