Privacy Policy

1. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Email: info@kongglo.com

We have not appointed a data protection officer, as the legal requirements for doing so are not met. Please send any questions about data protection to the email address above.

2. Overview

RombiPost is a web app that businesses use to create social media posts with the help of AI, schedule them and publish them on connected networks. We process personal data only as far as necessary for the website, your account and the features you use. We do not sell data and do not use advertising or analytics trackers.

3. Hosting and server log files

We run the website, the app and the database on our own server at netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The server is located in a data centre in Nuremberg, Germany; netcup processes the data on our behalf (Art. 28 GDPR). When you visit the website, technically necessary data is processed: IP address, date and time, page requested, browser and operating system. This is necessary to deliver the pages and to keep the service secure (Art. 6(1)(f) GDPR). Log data is stored only as long as required for this purpose.

Fonts (Bricolage Grotesque, Instrument Sans) are hosted locally. No connections are made to Google Fonts or other font providers.

To protect accounts against automated attacks, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, when you log in, sign up, reset or change your password. Code from Cloudflare is loaded only on these pages; Turnstile checks technical characteristics of your browser and your IP address to determine whether the request comes from a human. The legal basis is our legitimate interest in the security of accounts (Art. 6(1)(f) GDPR).

4. Account and registration

To use the app, you create an account. We process your name, email address, an encrypted password, your acceptance of the Terms of Service and this Privacy Policy (with date and version) and technical login data (time, IP address). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Your account, the database and file storage (e.g. your images) are kept on our server at netcup in Nuremberg (section 3). We use the open-source software Supabase for this, which we operate ourselves; no data is transferred to Supabase Inc.

Every night we back up the database and files at Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France (data centre in Paris). The backups are encrypted before transfer so that only we can read them. Scaleway processes them on our behalf (Art. 28 GDPR). The legal basis is our legitimate interest in preventing data loss (Art. 6(1)(f) GDPR).

5. Content you create in the app

We process the content you enter or have generated: texts, keywords, uploaded photos, AI images, information about your business and brand (e.g. logo, colours, industry), scheduled publication times and the status of your posts. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Please only enter personal data of third parties in posts (e.g. photos of guests or employees) if you are entitled to do so.

6. AI features

To generate texts, images, translations and alt texts, we transmit your input (e.g. keywords, industry, tone of voice, brand information, images for the image description) to OpenAI (OpenAI Ireland Ltd., Dublin, Ireland, or OpenAI, L.L.C., San Francisco, USA). OpenAI processes the data on our behalf and, under its terms, does not use API data to train its models.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Avoid entering personal data in AI prompts that is not needed for the post. AI results can be wrong; check them before publishing.

7. Connected social networks

When you connect an account (e.g. Bluesky, Mastodon, Telegram, Facebook, Instagram, LinkedIn, Pinterest, TikTok), we store the access data required for this (access token, account ID, channel or page name) and, on your instruction, transmit texts and images to the respective network. We also retrieve metrics on your published posts (e.g. reach, interactions) where the network provides them. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

The networks themselves are responsible for processing on their platforms, e.g. Meta Platforms Ireland Ltd. (Facebook, Instagram), LinkedIn Ireland Unlimited Company (LinkedIn), Pinterest Europe Ltd. (Pinterest), TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited as joint controllers (TikTok), Bluesky Social PBC, the operator of your Mastodon instance, Telegram. Their privacy notices apply. For Facebook and Instagram, we only redirect you to log in with Meta when you actively click "Mit Facebook verbinden" (Connect with Facebook); no code from Meta is loaded on our pages for this. Meta then issues us an access key for the Facebook Page or Instagram account you selected.

For LinkedIn, we only redirect you to log in with LinkedIn when you actively click "Mit LinkedIn verbinden" (Connect with LinkedIn). LinkedIn then issues us an access key. With it, we read the LinkedIn company pages you administer (page name and ID) and, on your instruction, publish posts on the page you connected in RombiPost. We do not retrieve comments or data of other LinkedIn members.

For Pinterest, we only redirect you to log in with Pinterest when you actively click "Mit Pinterest verbinden" (Connect with Pinterest); no code from Pinterest is loaded on our pages for this (including no Pinterest Tag). Pinterest then issues us an access key. With it, we read your Pinterest profile (username, ID, profile picture and account type) and your own boards (name and ID) so that you can choose a board, and, on your instruction, create Pins (image, title, description, destination link, alt text) on the board you selected. If you create a new board in RombiPost, we create it in your Pinterest account on your instruction. We do not retrieve Pins or boards of other Pinterest users.

For TikTok, we only redirect you to log in with TikTok when you actively click "Mit TikTok verbinden" (Connect with TikTok); no code from TikTok is loaded on our pages for this (including no TikTok Pixel). TikTok then issues us an access key. With it, we read your TikTok profile (ID, display name, username and profile picture) and, each time you prepare a TikTok post, your posting settings on TikTok (which visibility options you can choose and whether comments are allowed). On your instruction, we publish photo posts in your TikTok account (images, title, description and the settings you chose for the post: visibility, comments and promotional content disclosure; images created with AI are labelled as AI-generated) and then check the publishing status. TikTok downloads the images for this from our server. We do not retrieve your other TikTok content or data of other TikTok users.

You can disconnect a connection in the app at any time; the stored access data is then deleted. You can also revoke access in the settings of the respective network. Information on data deletion can be found under Data deletion.

8. Payments

Paid plans are billed via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe processes payment data (e.g. card or account details) itself; we only receive information such as name, email address, chosen plan, payment status and invoice data. The legal bases are the performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR).

9. Email and support

If you email us, we process your information to answer your request (Art. 6(1)(b) or (f) GDPR). Our mailbox is operated by Zoho (data centre in the EU). System emails (e.g. confirmation of registration, password reset, confirmation of support requests) and internal notifications are sent via Resend, Inc., San Francisco, USA (sending via the EU region). Resend processes your email address and the content of the message on our behalf (Art. 28 GDPR).

10. Cookies and local storage

We do not use analytics, marketing or tracking cookies. In your browser's local storage we only store what is technically necessary for operation, e.g. your login (session) and settings in the app. The legal basis is Section 25(2) No. 2 of the German TDDDG in conjunction with Art. 6(1)(b) GDPR. Consent is not required for this.

11. Transfers to third countries

Some of the service providers named above are based in the USA or process data there. Data is only transferred if an adequate level of data protection is ensured, in particular on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, or on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We conclude data processing agreements under Art. 28 GDPR with our service providers who process data on our behalf (hosting, backup, AI, email delivery).

12. Storage period

We store your data as long as your account exists. If you delete your account, we remove your data within 30 days unless statutory retention obligations apply (e.g. invoices: 8 to 10 years under German commercial and tax law). We block such data until the retention period expires. In our encrypted backups (section 4), deleted data remains until the retention period of the respective backup expires (at most 13 months) and is then removed automatically.

13. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).

To do so, write to info@kongglo.com. You can also lodge a complaint with a data protection supervisory authority, e.g. the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. Obligation to provide data, no automated decision-making

The information requested at registration is required for the contract; without it we cannot create an account. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

15. Changes

We update this Privacy Policy when the app or the services we use change. The version published here applies.