Privacy Policy
Last updated: March 21, 2026
This Privacy Policy (the «Policy») describes how PublPost (publpost.ru) collects, uses, stores, and protects the personal data of users of the service.
1. General provisions
1.1. The data controller is ИП Попов Иван Петрович, ИНН 521600320843 (the «Controller»), which operates the PublPost internet service available at publpost.ru (the «Service»).
1.2. This Policy is based on Russian Federal Law No. 152-FZ of July 27, 2006 «On Personal Data», EU Regulation 2016/679 (GDPR) where applicable to processing of users from EU/EEA countries, and other Russian legal acts on the protection of personal data.
1.3. By registering with the Service and/or using its functionality, the User gives unconditional consent to this Policy and the personal data processing terms set out in it. If the User disagrees with the Policy, they must stop using the Service.
1.4. PublPost is a social media management platform providing tools for scheduling, creating, automatically publishing content, and analytics.
2. What data we collect
2.1. Data provided at registration
- Email address
- First name and last name (if provided)
- Password hash — we do not store passwords in plain text, only a cryptographic hash (bcrypt)
2.2. Data received via OAuth authorisation
When you authorise via third-party services (Google, VKontakte, Telegram, Odnoklassniki, Pinterest) we receive only public profile information:
- User identifier in the corresponding system
- First name and last name (public)
- Email address (if provided)
- Avatar URL (if available)
2.3. Social network account data
To perform the core function of the Service — publishing content to social networks — we obtain and store:
- Access tokens for social network APIs (VK, Telegram, OK, YouTube, Pinterest)
- Identifiers of connected pages, groups, and channels
- Account metadata (name, avatar, follower count)
Tokens are stored in encrypted form and used solely to perform actions requested by the User (publishing posts, retrieving statistics).
2.3a. Pinterest integration
When you connect a Pinterest account to PublPost, Pinterest issues us an OAuth access token that grants limited access to your boards and pins. The token is used exclusively for actions you initiate:
- creating, scheduling, editing, and deleting pins;
- reading engagement analytics (impressions, saves, pin clicks, outbound clicks) for pins published through PublPost;
- reading the list of your boards so the composer can let you choose where to publish.
PublPost does not share Pinterest data with third parties, does not use it for advertising, and revokes our access immediately when you disconnect the account. Our use of Pinterest data complies with the Pinterest API Terms of Service and Developer Guidelines.
2.4. User content
- Post text (posts, descriptions)
- Uploaded images and video files
- Publication schedules
- Drafts and templates
2.5. Automatically collected data
- IP address
- Browser type and version (User-Agent)
- Operating system
- Date and time of access to the Service
- Cookies (see section 8)
- Analytics data (Yandex.Metrica)
2.6. Payment data
Service payments are processed by a certified payment provider. We do not store payment card data (card number, CVV, expiration date). The payment provider processes data in accordance with PCI DSS. We retain only: transaction ID, payment date and amount, subscription status.
3. Purposes of data processing
We process personal data for the following purposes:
- Service provision — registration and authentication, content publishing to social networks, post scheduling, publication analytics
- Communication — sending notifications about publication status, technical updates, terms of service changes
- Service improvement — usage analysis to identify bugs, optimise performance, and develop new features
- Security — preventing unauthorised access, detecting fraud and abuse
- Legal obligations — payment processing, reporting, compliance with applicable law
- AI content generation — passing text data (prompts, account context) to AI providers to generate content at the User's request
4. Legal basis for processing
Personal data processing is carried out on the following legal grounds (Article 6 of FZ-152, Article 6 of GDPR):
- Consent of the data subject (Article 6.1.1 FZ-152, Article 6(1)(a) GDPR) — at registration, newsletter subscription, use of analytics cookies
- Performance of a contract (Article 6.1.5 FZ-152, Article 6(1)(b) GDPR) — to provide Service features, process payments, publish content to social networks
- Legitimate interest of the Controller (Article 6(1)(f) GDPR) — to ensure Service security, prevent abuse, improve service quality
- Legal obligation (Article 6.1.2 FZ-152, Article 6(1)(c) GDPR) — to comply with tax and other legislation
5. Data storage
5.1. User personal data is stored on servers located within the territory of the Russian Federation, in accordance with Article 18 part 5 of FZ-152.
5.2. Personal data retention periods:
| Data type | Retention period |
|---|---|
| Account data | Until the User deletes the account |
| Content (posts, media) | Until deleted by the User or until account deletion |
| Social network access tokens | Until the social account is disconnected or until account deletion |
| Payment records | 5 years from transaction (RF Tax Code requirement) |
| Logs (IP, User-Agent) | 12 months |
| Analytics data | 26 months (Yandex.Metrica) |
5.3. Data is transmitted over the secure HTTPS protocol (TLS 1.2+). Passwords are stored as cryptographic hashes (bcrypt). Social network access tokens are stored in encrypted form.
5.4. After account deletion, personal data is erased within 30 days, except for data retained as required by law.
6. Sharing with third parties
6.1. We do not sell User personal data to third parties. Data is shared only in the cases described below, and only to the extent necessary for the stated purposes.
6.2. Social networks
To publish content, we share data via official social network APIs: VKontakte, Telegram, Odnoklassniki, YouTube. Data shared: post text, media files, publication parameters. Processing of data by social networks is governed by their own privacy policies.
6.3. Payment providers
For payment processing, data is shared with a PCI DSS certified payment provider. We share: User email, payment amount and description.
6.4. Analytics
We use Yandex.Metrica to analyse use of the Service. Yandex.Metrica automatically collects de-identified visit data. Yandex.Metrica's processing of data is governed by Yandex's Privacy Policy.
6.5. AI providers
To generate content at the User's request, we share text data (prompts, brand context) with OpenAI. Data is used solely to generate the response and is not retained by the provider for model training (when accessed via API). Media files and personal User data are not shared with AI providers.
6.6. Other cases
We may disclose personal data upon request by authorised state bodies in cases provided for by Russian Federation law.
7. User rights
Pursuant to Article 14 of FZ-152 and Chapter III of the GDPR, you have the following rights:
- Right of access — you may request information about which of your personal data we process, for what purposes, and to whom it has been disclosed
- Right of rectification — you may update or correct your personal data in your profile settings or by contacting us via email
- Right to erasure — you may delete your account and all associated data in the Service settings. After deletion, the data will be permanently erased within 30 days
- Right to withdraw consent — you may withdraw consent for personal data processing at any time by sending a request to support@publpost.ru. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal
- Right to data portability — you may request a copy of your data in a machine-readable format
- Right to restriction of processing — you may demand restriction of processing of your data in cases provided for in Article 18 GDPR
- Right to lodge a complaint — you may lodge a complaint with Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media): rkn.gov.ru
To exercise any of these rights, send a request to support@publpost.ru. We will respond within 30 days.
9. Data security
9.1. We take all necessary organisational and technical measures to protect personal data from unauthorised access, destruction, modification, blocking, copying, distribution, or other unlawful actions by third parties.
9.2. Security measures applied:
- Data transmission over the secure HTTPS protocol (TLS 1.2+)
- Password hashing using bcrypt (with individual salts)
- Encryption of social network access tokens
- Access control within the Service
- Regular data backups
- Suspicious activity monitoring
- CSRF, XSS, and SQL injection protection at the application level
9.3. Despite the measures taken, we cannot guarantee absolute security of data transmitted over the internet. In the event of a data breach, we will notify affected Users and the relevant authorities within the timelines established by law.
10. Age restrictions
10.1. The Service is not intended for persons under 16 years old. We knowingly do not collect personal data of minors.
10.2. If we become aware that we have received personal data of a person under 16 years old without parental or legal guardian consent, we will take steps to delete such data as soon as possible.
10.3. If you are a parent or legal guardian and believe that your child has provided us with personal data, please contact us at support@publpost.ru.
11. Changes to this policy
11.1. We reserve the right to make changes to this Policy. The current version is always available at publpost.ru/privacy.
11.2. In the event of material changes, we will notify Users by email at least 14 days before the changes take effect.
11.3. Continued use of the Service after the changes take effect constitutes the User's acceptance of the updated Policy.
12. Contact information
For all questions related to personal data processing, you can contact the Controller:
- Controller: ИП Попов Иван Петрович, ИНН 521600320843
- Service: PublPost
- Website: publpost.ru
- Email: support@publpost.ru
Response time: within 30 days of receiving the request.
Publication date: March 21, 2026
ИП Попов Иван Петрович, ИНН 521600320843 | PublPost | publpost.ru