Privacy Policy

Updated 28 September 2026

1. Who is responsible

Amazonia Sp. z o.o., ul. Zawodzie 20, 80-726 Gdańsk, Poland. NIP: 5833522392 · KRS: 0001135445 · REGON: 540039024. Amazonia Sp. z o.o. is the controller for account administration and operation of Karma Posting. For personal data you manage on behalf of your own customers, your organisation may be the controller and Karma Posting may act as processor; those roles require the applicable processing arrangements.

2. Information used by the service

Depending on the features you use, information may include your name, email, account and workspace settings, brand profile, uploaded media and post drafts, publication schedules, connected account identifiers and authorisation credentials, incoming messages and available participant names or avatars, payment references and technical logs. Connected platforms provide only data available under their permissions.

3. Where information comes from

You provide registration details, profile information, prompts, uploads and support correspondence. Connected platforms can supply account details, messages, comments and publication results within granted permissions. Requests to the service can also produce technical records used for delivery, diagnosis and security. Do not submit another person’s private information unless you are authorised to do so.

4. Purposes and legal bases

Account and service data are processed to perform the service contract or take steps you request before entering it. Records required by tax and accounting rules are processed to meet legal obligations. Proportionate security, abuse prevention and handling of claims may rely on legitimate interests. Where consent is required for an optional purpose, that purpose must be explained and consent can be withdrawn without affecting earlier lawful processing.

5. Providers and connected services

Data needed for a requested feature may be processed by hosting, storage, AI, email, payment and social integration providers. Connected social networks receive the content and actions you choose to send. Permissions and data flows depend on the features enabled. You can request information about the providers and processing locations relevant to your use of the service from the controller.

6. International processing

Some service providers may process data outside the European Economic Area. Where this happens, the applicable transfer mechanism and safeguards, such as an adequacy decision or standard contractual clauses, must be identified. Details and copies of relevant safeguards can be requested from the controller.

7. Retention

Service data are retained for the purposes for which they are needed, taking account of account activity, deletion requests, legal record-keeping duties and the handling of claims. Backups and security logs may follow separate deletion cycles. You can request details of the retention and deletion rules applicable to your data from the controller. Disconnecting an account does not delete posts or messages held by the social network.

8. Cookies and local storage

Authentication and interface preferences can use cookies or local storage. Optional analytics or advertising technologies, if enabled, must be described separately and subject to any consent requirements. This notice does not assume that marketing trackers are enabled.

9. Your rights

Depending on the applicable conditions, you may request access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests and withdraw consent. You may lodge a complaint with the Polish data protection authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or another competent supervisory authority.

10. Published content and external links

When you publish content or send a message, its recipients and visibility depend on the selected network and account settings. Other people may keep copies of publicly shared material. External websites and networks apply their own privacy notices; this policy does not control how they process information after receiving it.

11. Security and requests

Keep sign-in credentials private and limit access to your workspace. When handling a data request, the controller may need proportionate information to verify that it concerns your data. Do not send passwords or access tokens with a request. Requests concerning messages processed for another organisation may need to be addressed to that organisation as controller.

12. Providing information and AI features

Account information needed to create and secure an account is necessary to provide those features; without it they cannot operate. Optional profile and integration information depends on your choices. AI suggestions are intended for your review; this notice does not authorise solely automated decisions producing legal or similarly significant effects about individuals.

Contact: write to Amazonia Sp. z o.o. at the postal address above.