Privacy Policy

KosmoLab is operated by Simon, an independent developer based in Slovenia (“KosmoLab”, “we”, “us”). We are the controller of the personal data described in this policy.

For any privacy question or request, contact hello@kosmolab.si.

This policy covers the website kosmolab.si and the KosmoLab app, which connects to Facebook Pages and Instagram professional accounts through Meta’s APIs (together, the “Services”).

Website visits. kosmolab.si does not use cookies, analytics or advertising trackers. Our hosting provider processes technical data needed to deliver the site, such as IP address, browser type, requested page and time of request, and keeps it in short-lived server logs for security and reliability.

Email. If you contact us, we receive your email address, your name if you provide it, and the content of your message.

KosmoLab app. When you connect a Facebook Page or Instagram professional account and approve permissions, we may receive, depending on the permissions you grant:

• account and Page identifiers, names, usernames and profile pictures;
• access tokens that allow the app to act on your behalf;
• content you create, schedule or publish through the app, such as captions, images and videos;
• comments on your posts, including the commenter’s public username, when you use comment features;
• performance insights such as reach, impressions and engagement for your Page, account and posts.

We never receive your Facebook or Instagram password. The app can only access data covered by the permissions you approve in Meta’s login dialog.

• To provide the features you use: connecting accounts, publishing and scheduling content, showing insights and managing comments.
• To operate, secure and troubleshoot the Services.
• To reply to your messages and requests.
• To meet legal obligations.

We do not sell personal data, use data received from Meta for advertising, or share it with data brokers. We use data received from Meta only as permitted by Meta’s Platform Terms and Developer Policies.

• Contract (Art. 6(1)(b) GDPR): to provide the app features you request.
• Consent (Art. 6(1)(a) GDPR): when you connect an account and grant permissions. You can withdraw consent at any time by removing the app; this does not affect processing carried out before withdrawal.
• Legitimate interests (Art. 6(1)(f) GDPR): to keep the Services secure and to respond to enquiries.
• Legal obligation (Art. 6(1)(c) GDPR): where the law requires us to keep or disclose data.

• Meta Platforms, to carry out the actions you request. Content you publish is sent to Facebook or Instagram and is then also governed by Meta’s privacy policy.
• Service providers that host and run the Services for us, such as our website host (Vercel Inc.) and email provider, under data processing agreements.
• Authorities, where we are legally required to do so.

We do not share personal data with anyone else.

Some providers, including Meta and Vercel, may process data outside the European Economic Area, including in the United States. These transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

• Connected account data, including access tokens, content records and insights: for as long as your account is connected. When you remove the app or ask us to delete your data, we delete it within 30 days.
• Emails: for as long as needed to handle your request and any follow-up.
• Server logs: for a short period set by our hosting provider for security and operations.

We use encrypted connections (HTTPS), store access tokens securely and limit access to personal data to what is needed to run the Services. No system is completely secure, but we take reasonable technical and organisational measures to protect your data.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or transfer it to you in a portable format. You can also withdraw consent at any time. Send requests to hello@kosmolab.si; we respond within one month.

You may also complain to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, www.ip-rs.si) or to the data protection authority in your country.

You can remove the app’s access and request deletion of your data at any time. See the data deletion instructions.

The Services are not directed at children under 16, and we do not knowingly collect their personal data.

We may update this policy when the Services change. The date at the top shows the latest version. If a change is significant, we will notify connected users through the app or by email.

Simon, KosmoLab · Slovenia · hello@kosmolab.si