Privacy Policy

Who we are

eksis is a social media control panel for creators, small businesses, and agencies. The service is operated from eksis.io. For anything to do with your data, write to admin@eksis.io.

What we collect

Account data. Your name, email address, a hashed password, time zone, and language.

Social accounts you connect. Username, platform account ID, profile picture, the permissions you approved, and the access tokens the platform issues. Tokens are stored encrypted and are never sent to the browser, never written to logs, and never appear in error messages.

Content you create. Drafts, captions, schedules, first comments, and the media files you upload.

Comments and messages on the accounts you connect. For the inbox to work, eksis stores the text of comments and direct messages along with the sender’s username, display name, profile picture, and platform ID. These people are usually not eksis users. See Data about people who contact you.

Operational records. Workspace activity history, automation run history, notifications, and the webhook events connected platforms send us.

eksis runs no advertising, sells no data, and uses no third-party advertising trackers.

What we use it for

• Running the service: publishing scheduled posts, showing comments and messages, running the automations you built.
• Showing performance statistics for the accounts you connect.
• Sending necessary email: address verification, password resets, and alerts when publishing fails.
• Keeping things safe: detecting abuse and enforcing the limits of your plan.

We do not use the contents of your comments, messages, or content to train artificial intelligence models.

Who we share it with

eksis uses the providers below to run the service. Each receives only the data its function requires:

• Meta Platforms: the Instagram and Facebook Graph APIs, to publish content and to read and reply to comments and messages.
• Google: the YouTube Data API, to upload the videos you schedule and to read, reply to, and moderate comments on the YouTube channel you connect.
• Other platforms you connect: TikTok, LinkedIn, X, Bluesky, Pinterest, DEV Community, and Google Business Profile each receive the content you schedule to them and the requests eksis makes to read and reply to activity on your own account.
• Railway: where the application runs.
• Neon: the database.
• Cloudflare: media file storage and traffic delivery.
• Resend: transactional email delivery.
• PostHog: product analytics, session replay, error tracking, server logs, and revenue reporting, so we can see which parts of eksis are used, where it breaks, and how plans change. Events travel through our own domain, replays are only recorded for signed-in users with form fields masked, and in the EEA, the United Kingdom, and Switzerland it runs without cookies. For AI features it receives the model, token count, and response time, never the text you write. For revenue reporting it receives copies of your Polar subscriptions and orders (including the name, email, and billing address on them) and plan and usage records from our database, without names, emails, or post content.
• OpenAI: the AI Assistant. When you ask it to write or rewrite a caption, suggest hashtags, suggest a reply in the inbox, or set up an automation, the text you give it is sent to OpenAI. For a reply suggestion, that includes the comment or message you are answering. When you chat with the Assistant, your messages are sent to OpenAI together with the workspace data it reads to answer them: channel names, post captions, analytics numbers, News items, and comments. With Search the web on, its search queries also go through OpenAI's web search. Assistant conversations are kept in eksis until you delete them.

Beyond that, data is shared only where the law requires it. We do not sell personal data to anyone.

AI assistants you connect

eksis can be connected to an AI assistant such as Claude or ChatGPT, or to any other client that speaks the Model Context Protocol. Connecting always goes through a consent screen on eksis where you choose one workspace and what the assistant is allowed to do: read only, or read and write. An assistant never reaches a workspace you did not pick.

Once connected, the assistant can read that workspace’s channels, posts, media, comments, direct messages, and analytics, and with write permission it can also draft, schedule, approve, and publish posts, import media, moderate comments, and reply to comments and direct messages. Whatever it reads travels to the company that runs it, Anthropic for Claude and OpenAI for ChatGPT, and is covered by that company’s privacy policy rather than this one.

In the other direction eksis receives only the requests the assistant makes, such as the caption it drafted for you, not the rest of your conversation with it. About the connection itself eksis stores the assistant’s name, the workspace and permissions you granted, who granted them, when it was last used, and how many requests it has made.

You can disconnect an assistant at any time from the API page inside the workspace. Its access stops immediately, and any post it already scheduled stays yours to edit or delete.

YouTube channels you connect

When you connect a YouTube channel, eksis uses the YouTube Data API on your behalf. It reads the channel’s name, ID, avatar, and public counts so the channel can be shown in eksis; uploads the videos and Shorts you schedule; reads the processing status and the view, like, and comment counts of videos it published; and reads, posts, hides, and deletes comments on your own videos when you ask it to. eksis never touches a channel you have not connected, and it uses YouTube data for nothing other than the features you can see in the app.

YouTube data reaches eksis under the YouTube Terms of Service, and Google’s own handling of your data is described in the Google Privacy Policy. You can revoke eksis’s access to your Google account at any time at myaccount.google.com/permissions, or by disconnecting the channel inside eksis, which revokes the permission with Google and erases the stored tokens. YouTube content already stored in eksis then follows the retention rules below.

Data about people who contact you

When someone comments on or messages an Instagram account or Facebook Page you have connected, eksis stores their message along with their public identity on that platform. That is what lets you read and reply from one place.

In that relationship you decide what the data is used for, and eksis processes it on your behalf. If someone asks for their data to be removed, you can delete the conversation or comment from the inbox, or contact us at admin@eksis.io.

How long we keep it

While your account is active, your content and inbox stay. Beyond that:

• Workspace activity history: 7 days on the free plan, 90 days on paid plans.
• Processed webhook records: 7 days.
• Unfinished media uploads: removed after 24 hours.
• “Currently viewing this conversation” markers: 5 minutes.
• Media you delete: removed from storage at the next scheduled cleanup.

If you close your account, all workspace data is deleted. See the data deletion instructions.

Security

Social account tokens are encrypted with AES-256-GCM before being stored. Passwords are stored as hashes, never as plain text. All traffic runs over HTTPS. Workspace access is limited by role: owner, admin, editor, and viewer each have different powers.

No system is completely safe. If a data breach occurs that puts you at risk, we will tell you by email.

Your rights

You can view and correct your account data from the settings page, export analytics as CSV, disconnect a social account at any time, and delete your account along with everything in it. For anything the app does not cover, email admin@eksis.io; we respond within 30 days.

You can also revoke a connection from the platform’s side: on Facebook and Instagram under Settings → Apps and Websites, and for YouTube at myaccount.google.com/permissions.

Children

eksis is built for business use and is not intended for children under 13. We do not knowingly collect data from children.

Changes to this policy

If this policy changes in a meaningful way, we will tell you by email or with an in-app notice before the change takes effect. The date at the top of this page always shows the current version.