Privacy Policy

Ned is a content planning, creation, distribution, and measurement platform operated by Rezio, MB, company code 307540087, registered address Vėtrungių 101-284, 06334 Vilnius, Lithuania. Ned is intended for business users (companies, sole proprietors, and their authorized team members).

This policy applies to information processed by Ned through our website, web application, and any integrations we offer with third-party platforms such as Meta (Facebook, Instagram), Google, LinkedIn, X, and TikTok.

If you connect a third-party account to Ned, that platform's own privacy policy also governs information it shares with us. We encourage you to read those policies alongside this one.

Controller status. Rezio, MB is the data controller for your account, billing, and platform-usage information. For content you author and instruct Ned to publish, and for third-party platform data you instruct Ned to access (Meta Pages, Instagram accounts, etc.), Rezio, MB acts as your processor under your instructions.

Information you provide

• Account data — name, email address, password (stored hashed), workspace name, billing details.
• Billing data — legal billing name, billing address, and VAT or other tax identifiers where supplied. Where a business or professional registration identifier is collected, an identifier belonging to an individual entrepreneur is personal data and is protected by the same security, purpose-limitation, retention, and deletion rules as any other personal data.
• Content — drafts, posts, captions, media, comments, schedules, and other material you create or upload to the Service.
• Communications — messages you send to our support team or via in-app feedback.

Information from connected platforms

• Authentication identifiers — when you sign in with Facebook, Google, or another provider, we receive your name, email address if granted, profile photo if provided, provider name, and a stable provider user identifier.
• Publishing data — page IDs, Instagram Business or Creator account IDs, channel names, audience metadata available through the platform API, access tokens, token expiry information, and the permissions you grant so Ned can publish on your behalf.
• Insights — engagement metrics (impressions, reach, clicks, reactions) on content you have published through Ned.

Information collected automatically

• Device & log data — browser type, OS, IP address, referring URL, timestamps, and pages visited.
• Cookies & similar technologies — used to keep you signed in, remember preferences, and, after consent, distinguish measurement sessions. See our Cookie Policy.
• Website measurement — Google Analytics receives sanitized route templates, hostname, locale, consent state, event type, referral origin, approved campaign tags, and browser/device signals. When Analytics storage is denied, Google receives limited cookieless pings without an Analytics cookie. When you grant Measurement consent, Google may set pseudonymous Analytics cookies. Microsoft Clarity loads only after Measurement consent on the landing and pricing pages and records masked interaction data; Ned does not send names, email addresses, account IDs, content, resource IDs, or arbitrary URL parameters to either service.

When you connect a Meta (Facebook or Instagram) or Google account, we request only the permissions needed for the features you use. We do not request permissions for features that are not available in the Service.

Meta (Facebook & Instagram)

We do not request, store, or use any Meta permissions beyond what is listed above. The exact set requested at sign-in is the subset of this table needed for the features you actively use.

Google

Ned uses basic Google authentication scopes only. We do not access Gmail, Google Contacts, Google Drive, Google Calendar, or any other Google account content. If our use of Google user data changes in the future, we will update this policy and ask for consent before using that data for a new purpose.

Ned's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Ned uses Meta platform data in accordance with the permissions you grant and the Meta Platform Terms and Developer Policies. We use Meta platform data only for the user-facing authentication, account connection, publishing, scheduling, and insights features you request.

You can revoke Ned's access at any time from your Meta account's Business Integrations page, your Google account's Third-party apps & services page, or from the Integrations panel inside Ned.

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Authenticate you and protect your account.
• Publish content to the channels you have connected, on your instruction.
• Report insights and analytics for content you have published.
• Store and refresh third-party access tokens needed to maintain integrations you have connected.
• Communicate about your account, security, billing, and product changes.
• Detect, investigate, and prevent fraud, abuse, or violations of our Terms.
• Comply with legal obligations.

Legal basis (EU / UK users)

Under the GDPR (Article 6), we rely on:

• Performance of a contract — to provide the Service you have signed up for, including authentication, publishing, integrations, and billing.
• Consent — for Google Analytics storage, Microsoft Clarity recording, and optional marketing technologies. You may withdraw consent at any time without affecting the lawfulness of earlier processing.
• Legitimate interests — to keep the Service secure, prevent abuse and fraud, improve features in ways you would reasonably expect, and, where permitted by applicable law following our documented assessment, obtain limited service-audience measurements without Analytics storage. These interests are balanced against your rights and interests.
• Legal obligation — to retain billing records, respond to lawful requests, and meet other applicable legal requirements.

We share information only in the limited circumstances below:

• Service providers / sub-processors — vetted vendors who host our infrastructure, process payments, deliver email, or store files, under written confidentiality and data protection terms (see the table below).
• Connected platforms — when you publish or measure, we transmit the relevant content and metadata to that platform's API.
• Legal & safety — when required by law, court order, or to protect rights, safety, and integrity of our users or the Service.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to continued protection of your information.

We do not sell personal information. We do not transfer Google user data or Meta platform data to third parties except as needed to provide or improve the Service, comply with law, maintain security, or as part of a business transfer subject to continued protection of your information.

Sub-processors

We aim to keep primary application data in the European Economic Area where our infrastructure providers and product configuration support it. Some providers may process data outside the EEA for hosting, CDN, email delivery, security, support, routing, observability, or payment processing. For transfers of personal data outside the EEA, we rely on the EU Standard Contractual Clauses (2021/914), Data Privacy Framework certification where applicable, or equivalent transfer mechanisms.

We retain your information for as long as your account is active and as needed to provide the Service. Third-party access tokens are retained only while the related integration remains connected and are deleted or invalidated when you disconnect the integration or delete your account. Encrypted backups containing your data are purged within 35 days of deletion.

Google Analytics user- and event-level data is configured for 14 months; its consented first-party cookies may remain for up to 2 years, subject to browser limits. Microsoft Clarity playback data is retained for 30 days and aggregated click, heatmap, or labeled-session data for up to 9 months under Microsoft's current retention schedule. With Measurement denied, Ned does not set Google Analytics or Clarity cookies.

When you delete your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, accounting, dispute-resolution, or security purposes.

If your subscription ends through non-payment or cancellation, your data is retained during the 30-day recovery window. If the account is then terminated, primary data is deleted within 30 days of termination and residual backup copies are purged within 35 days of deletion.

How to request deletion of your data

You can delete your data in any of the following ways:

1. Email request — Send a request from the email address associated with your Ned account to hello@ned.social with the subject line "Delete my data". We will confirm receipt within 5 business days and complete deletion within 30 days.
2. In-app self-serve — Use the Delete account control in your Ned account settings when available.
3. Meta — You may remove Ned from your Meta account settings → Business Integrations; we will delete or anonymize Meta platform data associated with your Ned account within 30 days.
4. Google — You may revoke Ned's access from your Google account → Third-party apps & services and email hello@ned.social to request deletion of any remaining data.

Depending on where you live, you have rights regarding your personal information. Under the GDPR (and equivalent UK law), you may:

• Access — request a copy of your personal data.
• Rectify — correct inaccurate or incomplete data.
• Erase — request deletion (see §06).
• Restrict — limit how we process your data.
• Port — receive your data in a portable, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on consent.
• Not be subject to solely automated decision-making that produces legal or similarly significant effects.

To exercise these rights, contact us at hello@ned.social. We will respond within 30 days (extendable by a further two months for complex requests, as permitted by the GDPR).

Supervisory authority. EU and EEA users may also lodge a complaint with their local data protection authority. Our lead supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI) — vdai.lrv.lt.

We use industry-standard safeguards — encryption in transit (TLS), encryption at rest for sensitive fields and secrets where appropriate, role-based access controls, access logging, and regular security review. We protect third-party access tokens and API credentials from unauthorized access and do not expose them in client-side code. No system is perfectly secure; you should also protect your credentials and report any suspected compromise to us promptly.

Ned is intended for use by people aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe we have, contact us and we will delete it.

We may process and store information in countries other than where you live, including the United States. For transfers of personal data outside the European Economic Area, we rely on the EU Standard Contractual Clauses (2021/914) or equivalent mechanisms. See §05 for the sub-processor list and primary locations.

We will update this policy when our practices change. The version and last-updated date at the top will reflect the latest revision. For material changes, we will provide additional notice (such as an email or in-app message) before the change takes effect.