Privacy Policy

1. Who is responsible

The controller is Bc. Ing. Petr Bartek, a sole trader registered in the Czech Republic, IČO 01033450, registered seat K Pilíkům 1062/1, Hrabová, 720 00 Ostrava, Czech Republic, operator of Antigravity Publishing at publishing.petrbartek.cz. Contact: petr@petrbartek.cz. We have not appointed a data protection officer; write to the same address.

2. What this policy covers

This policy covers the data of people who create and use an account: account details, sign-in and security records, and our e-mails. For this data we are the controller.

The content of your workspace (your videos, posts, connected Pages and Instagram accounts, and the messages of people who write to them) we process on your behalf as a processor. That is governed by the data processing terms in section 15 of the Terms of Service. If you wrote to a business's Page or Instagram account, that business is responsible for your data; see also Deleting your data.

3. What we process

• Account: your e-mail address; your password only as a scrypt hash; when you confirmed the e-mail address; the version and time of the terms you accepted; when the account was created; failed sign-in attempts and any temporary lock.
• Sessions: a hashed session identifier, your IP address, your browser's user-agent string and the session times.
• One-time links: e-mail confirmation and password reset links, stored only as a hash.
• Security log: the type of event (for example sign-in, password change, account deletion, connecting or disconnecting an account), your account identifier, your IP address and the time.
• Abuse limits: counters of attempts per IP address or per a hash of the e-mail address.
• Facebook connection: the app-scoped Facebook user id of the person who connected Pages, so that Meta's deletion requests can be matched. We do not keep your Facebook login token. Records of Meta deletion requests keep only a confirmation code, keyed hashes and times.
• E-mails: we send confirmation, password reset and security notices to your e-mail address. If you write to us, we keep the correspondence.

We do not use analytics, advertising or tracking tools, and we use no AI on your data. We make no automated decisions about you.

4. Why, and on what legal basis

• To create and run your account, sign you in, send you service e-mails and provide the service: performance of the contract (Article 6(1)(b) GDPR). Without an e-mail address and password we cannot create an account.
• To protect the service and its users, prevent abuse and investigate security incidents (sessions, security log, abuse limits): our legitimate interest in a secure service (Article 6(1)(f) GDPR).
• To show that Meta's deletion requests were handled, and to answer authorities where the law requires: legal obligations and our legitimate interest (Article 6(1)(c) and (f) GDPR).

5. How long we keep it

• Account: until you delete it. After that only an anonymous record remains: an internal identifier, the accepted terms version and the creation and deletion times. It is deleted 3 years after the account was deleted.
• Sessions: until you sign out, or 7 days without use, and 30 days at the latest.
• E-mail confirmation links: 24 hours. Password reset links: 1 hour.
• Security log: 180 days; the IP address in it is removed after 30 days.
• Abuse limit counters: at most 24 hours.
• Facebook user id: until the connection ends (disconnecting, removing the app on Facebook or deleting the account).
• Records of Meta deletion requests: 3 years after the request, so that the status page keeps working until then.
• Backups: nightly, kept for 14 days, then overwritten.

6. Who receives it

• Hetzner Online GmbH, Germany, our hosting provider, which stores the service and its data (see section 15.7 of the Terms of Service).
• Seznam.cz, a.s., Czech Republic (Email Profi service), which delivers our e-mails and hosts our mailbox.
• Meta Platforms Ireland Ltd., only when you connect Facebook or Instagram and only what is needed for that. Meta handles that data under its own privacy policy.
• Public authorities, only where the law requires it.

We do not sell data and do not share it for advertising. We keep the data in the European Union (Hetzner in Germany, Seznam in the Czech Republic) and do not transfer it outside it.

7. Cookies

We use only cookies that the service needs to work, so we do not ask for consent:

• __Host-pub_session: keeps you signed in (at most 30 days).
• __Host-pub_csrf: protects forms before you sign in (until you close the browser).
• __Host-pub_oauth: protects the connection to Facebook while you connect accounts (10 minutes).
• pub_lang: remembers your language choice (1 year).

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on our legitimate interest. You can delete your account yourself at any time; see Deleting your data. For anything else write to petr@petrbartek.cz from the e-mail address of your account. We answer within one month and may ask you to confirm that the account is yours.

You can also complain to the supervisory authority: Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.cz.

9. Changes

When the service's handling of data changes, we update this policy and its version label. We will tell you about important changes by e-mail or in the service before they take effect.

10. Contact

Bc. Ing. Petr Bartek, IČO 01033450, registered seat K Pilíkům 1062/1, Hrabová, 720 00 Ostrava, Czech Republic. E-mail: petr@petrbartek.cz.