The engine runs entirely in your browser. Your Facebook password, session and cookies stay on your device — we never receive or store them, and the extension never reads your Facebook messages. Nobody from Group Posting, including your account manager, will ever ask for them.
What does reach us depends on who you are. Website visitors: security logs, and analytics and ad cookies only as your cookie choice allows. Enquiries: what you type into our questionnaires, with the campaign that brought you. Extension users: the text you ask our AI to write and the details that feature uses, your email and payment details at checkout, a daily licence check on paid plans, Pro's daily cloud backup and optional diagnostics. Agencies: your account, and what each client's browser shares once that client confirms it. Done-for-you clients: what we need to plan, run and report your posting. We don't sell your data.
1. Who we are
Group Posting is operated by Global Charity Solutions Kft., a company registered in Hungary. In this policy, “we”, “us” and “Group Posting” mean that company. For most of what this page describes we decide why and how data is used, so we are its controller. For some data we act on someone else's instructions, as their processor — an agency for its clients' data, and a business that uses our Done-for-you service. Section 10 says exactly when. Group Posting is made in the EU and built to be GDPR-friendly.
We have not appointed a data protection officer; write to [email protected] about anything on this page.
2. Website visitors
This applies to anyone who visits groupposting.com. The agency dashboard at agency.groupposting.com, the page that hands an agency connect code to the extension, and the extension itself carry no Google or Meta tags.
2.1 Hosting and security
Cloudflare hosts the website and our backend at the edge. It processes standard technical data — such as your IP address, browser and the page requested — in security logs, to deliver and protect the site.
2.2 Your cookie choice
A banner asks whether you accept cookies “for analytics and to measure our ads”. Decline and Accept are the same size. Your choice is saved in your own browser, not on our server, and you can change it at any time with Cookie settings in the footer of every page. A later change does not reach an enquiry you already sent; section 3.5 says how to stop events about it. (Section 2.4 explains how Decline withdraws a stored Google ad click.)
2.3 Google Analytics and Google Ads
We use Google Tag Manager, Google Analytics and Google Ads to measure traffic and how our ads perform. In the EEA, the UK and Switzerland, Google's analytics and advertising storage stays off until you click Accept; until then Google's tags set no cookies, but may still send Google basic measurement signals without cookies. Everywhere else, these Google tags run with cookies unless you click Decline.
2.4 Google Ads clicks
If you arrive on our home page or our /start/ page from a Google ad, we keep the ad's click identifier in your browser for up to 90 days. In the EEA, the UK and Switzerland we do this only after you click Accept. Everywhere else we do it unless you click Decline, as with Google's own tags in section 2.3. To tell which applies, the page asks our server only whether your connection comes from one of those countries; that check carries no click or installation identifier, and its answer is not saved. If you then install the extension, our welcome page links that click to your installation: our server records the click with a one-way code of your installation's random id, for up to 90 days from the click. If you later buy a plan, the click identifier travels with your checkout, and we record it with the purchase time and amount for up to 100 days so that we can report the sale to Google Ads. None of this includes your name or email. If you click Decline, now or later, the click is withdrawn: our site deletes it from your browser and tells our server, which deletes its records of that click.
2.5 Meta Pixel (only if you accept)
The Meta Pixel does not load at all until you click Accept, anywhere in the world. After that it tells Meta which of our pages you viewed, so we can measure our Facebook and Instagram ads. (when launched) On our Done-for-you, agency and trial pages it will also report starting a questionnaire, sending one (a “Lead”) and opening a checkout, and Meta may let us show our ads again to people who visited those pages. If you decline, none of this happens. For collecting and sending data through the Pixel and the Conversions API (section 3.5), Meta and we are joint controllers under Meta’s Controller Addendum; Meta is responsible for what it does with the data afterwards; you can exercise your rights with either of us.
2.6 Campaign tags and ad click ids
(when launched) When you reach our Done-for-you or agency pages from a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id), the page reads them in memory and adds them only to links within those pages. If you then send us a questionnaire, the tags are stored with your enquiry — whether or not you accepted cookies — so we can see which campaign brought it; they stay with us (and with LemonSqueezy if you open an agency checkout, see below) and are never sent to Meta unless you accepted. Facebook's click id (fbclid) is used only after you click Accept: we then keep it for the browser session and pass it on as Meta's click identifier (section 3.5). Google's click ids (gclid and similar) follow section 2.4. When you open an agency plan checkout, we add a source label to it and, under the rules in section 2.4, the stored Google ad click and the page you landed on. (when launched) We will also add the campaign tags and the id of your enquiry, whether or not you accepted, and Meta’s click identifier (fbc) only if you accepted. LemonSqueezy passes them back to us with the order, so we can see which campaign led to a purchase.
2.7 Our video
Our home page, our agency page and our Done-for-you page each show a picture of one of our videos. YouTube's player loads only when you press play; YouTube (Google) may then set its own cookies and receive your IP address.
2.8 Spam protection on forms
(when launched) Our questionnaires use Cloudflare Turnstile, a check that the visitor is not a bot. It processes technical signals from your browser, such as your IP address, to make that check. Forms also carry a hidden field that only bots fill in, and limit how many forms one network address or email address can send in a day.
2.9 Small things your browser keeps for our site
Besides your cookie choice, our site keeps a few small items in your browser's own storage: whether you closed a promotion or minimised the bottom bar, whether you came from one of our emails, and — straight after a purchase — your licence key, so the page can hand it to the extension (we remove it from the address bar first). These last only for the browser session. If you arrive through a friend's invite link, the invite code is kept so the referral can be credited when you install, and the welcome page remembers that you already asked for the setup guide. The full list is in section 13.
3. You sent us a form
This applies when you ask us about Done-for-you or an agency plan through a questionnaire on our site or fill in a form in one of our ads. A call happens only if you ask for one. These questionnaires are new and are marked (when launched) until they are live. Today the Done-for-you page only prepares an email draft in your own mail app, and nothing reaches us until you send that email yourself; it is then handled as in section 8.
3.1 The Done-for-you questionnaire
(when launched) Five short questions — what kind of business it is, where your customers are, the business name (and, if you like, its website or Facebook page), how customers reach you today, and whether a computer with Chrome is on during opening hours — then your first name, your email and, optionally, a phone or WhatsApp number. Your answers stay in the page until you give your email: if you leave before that, your answers are not stored and not sent to us. If analytics are on for you (section 2.3), Google Analytics records which question you reached and the type of business you picked; if you accepted cookies, Meta is told that you started the questionnaire (section 2.5). We store the website address you give, but our server never opens it; a team member may look at it by hand to edit your sample posts.
What we then send you: your 3 sample posts, our edited versions within one business day, and up to two short follow-ups about them. They stop when you reply. Anything more only if you tick the unticked “Send me occasional tips” box.
3.2 The agency questionnaire
(when launched) You first give your first name, work email and agency name; we store them as soon as you continue. Then six short questions: how many clients you would run, what kinds of clients, how you handle their Facebook groups today, whether they can keep a computer with Chrome on during posting hours, what matters most to you, and when you want to start. Your answers are added to your enquiry. You can then buy straight away, or ask us your questions by email; a call happens only if you ask for one. If you give your email but neither book nor buy, we send one reminder.
3.3 What we store about an enquiry
(when launched) Each enquiry is stored in its own Cloudflare database, kept apart from our agency database: your answers and contact details, the page you came from, the domain of the site that referred you, the campaign tags in section 2.6, your cookie choice at that moment, Meta's browser and click identifiers (fbp and fbc) only if you had accepted, a random enquiry id, where the enquiry stands (for example new, call booked, call held, became a customer, not a fit, waitlist), and, only if you had accepted cookies, your IP address and browser user agent at the moment you sent the enquiry, kept only so the later events in 3.5 can be matched by Meta. We receive an email notice about each enquiry, sent through Resend; its subject line never contains anything you typed.
3.4 Calls, only if you ask for one
(when launched) If you ask for a call, we book it with Cal.com, using its EU data region. Cal.com receives your name and email (filled in from the questionnaire), the time you pick, your answers as booking notes and your enquiry id. It tells our server when a call is booked, moved or cancelled, through a signed message (a webhook), and sends you the confirmation and a reminder 24 hours before.
3.5 Telling Meta about your enquiry, checkout or purchase (only if you accepted marketing cookies)
(when launched) Only if you had accepted marketing cookies, our server tells Meta, through its Conversions API, about these steps. An enquiry: that you sent a questionnaire (a Lead). This message carries Meta’s identifiers fbc and fbp, your IP address and browser user agent, an event id and the page, and never your email, phone, name or answers, hashed or otherwise. A checkout: when you open a checkout for the €1 trial or for Done-for-you from our site, that you started a checkout (InitiateCheckout); if the order follows within 24 hours, that you started a trial (StartTrial) or paid (Purchase, with the amount); and later each renewal payment of that subscription. These messages carry an event id that matches the Pixel event in your browser, so Meta counts it once, your IP address and browser user agent from the moment you opened the checkout, and, for a trial or a payment, your email address and, if you gave one with an international dialling code, your phone number, each turned into a one-way hash (SHA-256) before it leaves our server. They never carry your name, your answers or your posts. Agency plans are never reported. If you declined, nothing is sent. If you change your mind later, Cookie settings stops the Pixel in your browser; to stop any later message about an enquiry, a checkout or a subscription, reply to any of our emails or write to [email protected] and we will stop it. We keep what these messages need only for them: for a checkout that leads to no order, at most 7 days; for a subscription, until 90 days after it ends.
3.6 Lead forms inside Facebook or Instagram
(when launched) If we run lead forms on Meta and you fill one in, Meta collects your answers for us and makes them available to us; every form links to this policy. We import them into the enquiry database described in 3.3, marked as coming from a Meta form. What Meta does with your use of Facebook and Instagram is covered by Meta’s own privacy policy.
3.7 How long
Enquiries that do not lead to a contract are deleted 12 months after they arrive. The IP address and browser user agent kept for Meta matching are deleted after 90 days (section 14). If you become a customer, your enquiry becomes part of your customer record (sections 5 and 7). You can ask us to delete an enquiry at any time.
4. Extension users: Lite, Plus, Pro and Lifetime
This part is for everyone who installs the Group Posting extension in Chrome or Edge. It also applies to a browser connected to an agency, for everything that connection does not cause (section 6 covers the connection).
4.1 Local-first by design
Most tools like this route your Facebook activity through a cloud server. Group Posting doesn't. The engine runs inside your own Chrome or Edge browser, on your computer, using your own logged-in session. Your Facebook credentials, your session and your cookies never leave your device and are never uploaded to us. That part has no exceptions.
Your list of groups is a separate question, and we want to be exact about it rather than reassuring. On the free and Plus plans it stays on your machine. Pro includes a daily cloud backup, which uploads a copy of it so you can restore it (section 4.3). And if you connect this extension to an agency that manages posting for you, it is shared with that agency once you confirm that inside the extension (section 6).
4.2 What stays on your device
Two things people expect to find on the list below are not on it. Your group list — names, links, approximate member counts — and your templates, campaigns, schedules and posting history live in your browser rather than on our servers, but they do leave it in two clearly different cases. Pro's daily cloud backup uploads all of them, so they can be restored (section 4.3). Connecting to an agency shares your group list, and not your own templates, campaigns, schedules or results (section 6). Both are described in full below.
Image cards are drawn on your device. The logo you upload and the cards you create are stored in your browser; Pro's cloud backup keeps a copy of your brand kit and each card's text and layout (section 4.3).
These never leave your browser, and we can't see them:
4.3 What the extension sends us, and who helps us
To deliver the licence, the AI features and Pro's backup, and to take payment, the extension talks to our service and a few carefully chosen providers process limited data on our behalf. The engine that touches your Facebook data stays on your device (see section 4.1) — the providers below only ever see what's described here. Google's and Meta's tags are on our marketing website only, never inside the extension (section 2).
The licence check. If you have a paid licence, the extension checks it with our server about once a day. That check carries your licence key, a random installation id, and the time of your last successful post — a timestamp only, never a group or any content. We use it only to decide whether a usage-related email (a reminder when nothing has been posted for weeks, a request for a review) is appropriate. A browser whose Pro features are covered by an agency's plan does not send that timestamp.
(when launched) Introductory offer test. For new installations we may test two introductory offers (€1 for 6 days, or €14 for the first month). Our server assigns the installation’s random id to one of them and keeps that for the length of the test, so you always see the same offer. It holds nothing else about you.
(when launched) Founding Lifetime licences. These licences are bound to the Facebook profiles they are first used with (Terms, section 2). To do that, the extension sends our server the numeric id of the signed-in Facebook profile; we keep only a keyed one-way hash of it with the licence, never the profile’s name, permanently, so the binding cannot move. Names stay on your device.
Posting results. While the extension's "Allow Anonymous Usage Data" setting is on (it is on by default), each posting run also sends our server a short summary made of counts and fixed codes: how many posts were published, held for approval, failed, could not be confirmed or were not sent, the codes for why, the posting method, whether it posted as a Page, the extension version, Chrome version and languages in use, and when the run ended. It never names a group and never contains any post text. With a paid licence the summary also carries your licence key and the run's id, so our server can check the licence and count each run once; it keeps them only as one-way codes. A browser whose Pro features are covered by an agency's plan sends the summary without a licence key. From version 2.10.47 the summary also says what started the run (you, a schedule, a campaign, a queued free post, a share from your Facebook feed or an agency) and which plan the browser is on (Lite, Plus, Pro or an agency plan).
Hosts the website and backend at the edge. Processes standard technical data (such as IP address in security logs) needed to deliver and protect the Service. Cloud backup: Pro includes an automatic daily backup — it is part of the plan, not an extra — stored in Cloudflare R2 (encrypted at rest by Cloudflare) so you can restore it. It holds your group list and tags, your templates, campaigns, schedules and post categories, your AI persona and pacing settings, the writing voice the AI learned from your posts, any business information, group notes and group permissions stored for each of your profiles and Pages (with the phrases you removed from AI drafts, which it learns to avoid), your Lead Radar keyword and monitoring settings for each profile and Page (never the webhook addresses), the profile and Page information the extension holds (names, Facebook id numbers and profile picture links), the images attached to your templates when they fit, your image-card brand kit for each profile and Page (logo, brand colour and contact line) and each card's text and layout, up to 90 days of posting history, up to 500 recent Lead Radar matches and Lead Radar's archive of earlier ones — for each match the group it was found in, the link to the post, the keyword that matched and the post text shortened to a snippet, with the author's name, id and picture removed — and the work you did on your leads (the stage you set, your notes and replies, and the AI's assessment), with the post each one came from shortened and stripped of its author in the same way. It never holds your Facebook password, session or cookies. On the free and Plus plans nothing is uploaded. You can restore it from the extension, and you can ask us to delete it.
Our merchant of record for paid plans. When you buy Plus, Pro (including the paid Pro trial) or Lifetime — and agency plans (section 5) — LemonSqueezy handles your email, payment details and invoicing (including VAT). We never see your full card details.
Powers the AI features, and what each request carries depends on the feature you use. Writing, rewriting or varying a post, suggesting other words, ideas or a week of posts, planning a campaign and checking a post's spam risk send the text, topic or goal you give it and the options you choose (a spam-risk check also sends how many groups the post is going to, how often, and how many posts went out today); finding new groups sends the topic and place you type. Different wording in each group (Pro, when it is switched on) sends the text of the post you are about to send to three or more groups, how many groups it is going to and the language to write in, so it can write small word variations; it never carries your AI Studio profile, writing voice, business information or group names. Depending on the feature, a request also carries your AI Studio profile while it is switched on (the name or role, offer, link, tone and extra instructions you saved there), the writing voice it learned from your posts unless you have switched that off, any business information stored for the profile or Page you are using (such as services, offers, example posts and results you recorded), only when that record is switched on or holds facts you saved (a record that holds only group permissions does not count), and group names: the names of up to eight of your groups, so a new post, idea or week plan fits where it is going; the names of the groups of the profile or Page you are using when the campaign wizard matches groups to a goal for you, with the title and opening lines of any saved posts you pick for it; for campaign preparation, the names of the groups you choose, with what you recorded about each one's rules, whether promotion and links are allowed there and when posting is allowed; and, when it scores or recommends groups, their names (with approximate member counts where the extension knows them) and the topic you type or a short description of your business. Requests also say which language to write in, and those that carry business information add today's date and your time zone. To learn your writing voice, up to five of the most recent posts you wrote yourself in the extension are sent. The growth coach receives what you type to it, your last few messages with it, what you approved it to remember, a short summary of your setup (whether your groups and a draft are ready, and how many of your posts went out, are waiting or failed) and any draft or plan you work on with it — plus, only if you tick the options for them, your business context and the titles of your collections, your upcoming posts (title, text and start time) and, for recent failed attempts, the reason, the group's name and the post's title. None of these requests carries your Facebook password, cookies or session, or your private messages. One further use: when Facebook changes its layout, the extension asks it which on-screen control to use, sending a short list of the visible button labels. That request carries no post text and nothing you typed into a box. Lead Radar has its own use: when you ask it to draft a reply to a match, or when its automatic replies are switched on, the text of that post, the name of the group it was found in, what you have recorded about that group's rules (including whether promotion and links are allowed there), the reply style you set in Lead Radar and, while AI Studio is switched on, your own AI Studio profile and writing voice (the name or role, offer, link, tone and extra instructions you saved there, and the voice it learned from your posts if that is switched on), with today's date and your time zone, are sent to DeepSeek to write the reply — and where an agency manages that setup, the tone and the note it chose go with it. When you ask for a draft yourself, the direction you pick for a rewrite and the draft you are editing are sent too. The name of the person who wrote the post is not sent. A third use applies only to a browser connected to an agency (section 6): when that agency asks our assistant to rank the groups, the names and approximate member counts of the groups being ranked are sent to DeepSeek to produce the ranking — nothing else about the person, the group or its members. DeepSeek processes outside the EEA, in China; we rely on the European Commission's standard contractual clauses for that transfer.
4.4 Optional product diagnostics and usage data
The extension's “Allow Anonymous Usage Data” setting is on by default and you can switch it off in Settings. It controls optional product events and posting diagnostics sent to Group Posting, including extension and browser versions, a random installation id, posting mode, error categories and run counts (attempted, published, held for approval, unconfirmed or failed). A verified paid run can also send its licence key and run id; our server hashes these before using them to measure reliability. These reports do not send the post you wrote or your Facebook password, cookies or session. Licensing, paid cloud backup and reporting for an agency you connect are separate service functions and continue according to their own disclosures.
Despite its name, these reports are pseudonymous: they carry a random installation id.
The same setting covers an occasional one-question rating inside the extension (how easy setup or automation was, from 1 to 5). If you answer or dismiss it, we store your answer, the extension version, language and plan, and a one-way code of your installation id instead of the id itself, for up to 120 days.
4.5 Emails from us
We email you only if you gave us your address or bought a plan. Emails are sent through Resend from addresses on send.groupposting.com, and replies reach [email protected]. Receipts and payment emails come from LemonSqueezy.
The sign-up records behind these emails have no automatic expiry today.
4.6 Other things you may use
5. Agency customers and their team
This applies to an agency that buys Agency Starter or Agency Scale, and to each person the agency adds to its dashboard at agency.groupposting.com. Agency plans are for businesses only and run under our Business Terms. If you are a client of an agency, section 6 is your part.
5.1 Your account and your team
For the agency: its name, account email and time zone, the LemonSqueezy customer and product details of your plan, and your licence key, which we store only as a one-way code. For each member: email address, role (owner, manager or viewer), whether they are invited, active or removed, and when they last signed in. Members sign in with a one-time code we email to them; codes, invite links and sessions are stored only as one-way codes. The dashboard uses two strictly necessary cookies (section 13).
5.2 What we email
Only two kinds of email go to an agency's own members: the sign-in code, and the one notice we send when a licence key cannot be matched to the address presenting it. There is no invitation email — you invite a member by passing on a link yourself — and we never email your clients.
5.3 Payment
Agency plans are sold by LemonSqueezy as merchant of record, which handles your payment details, invoices and VAT; we never see full card details. A checkout opened from our site carries the source and campaign details described in section 2.6. No client data ever goes to LemonSqueezy.
5.4 The audit log
Every change made in your dashboard — by your members or by us — and every connection, disconnection and role change is recorded in your agency's audit log. It is kept for 400 days and available to you.
5.5 The AI suite in the dashboard
When your team uses it, our AI provider DeepSeek receives what you type (the text, topic or goal), the options you choose and the brand profile you saved for that client. Ranking a client's groups sends their names and approximate member counts; finding new groups sends the topic and place you type. The “what to fix” diagnosis sends only numbers, with neutral labels in place of group names, links and post titles.
5.6 Your clients' data
For the data your clients' browsers share and the content you create for them, you are the controller and we are your processor, under the Data Processing Agreement an owner accepts in the dashboard (version dpa-2026-09-cp1). Section 6 tells your clients exactly what that means for them; please point them to it before you send a connect link. We never use your clients' data to sell to them.
5.7 Support and retention
Every agency gets setup help by email from our support team (section 9); a call happens only if you ask for one. When your agency account ends, everything belonging to it is deleted after 90 days, with the exceptions the Data Processing Agreement lists — for example each client's authorisation record, kept for 3 years marked withdrawn. LemonSqueezy keeps billing records as tax law requires. The full list is in section 14.
6. Agency-managed browsers: clients connected to an agency
Group Posting can be connected to a marketing agency that runs Facebook group posting for you. Everything in this section applies only to a browser where someone has connected the extension to an agency. If you have not done that, nothing here happens on your computer.
Connecting is a deliberate act inside the extension. A link or a code alone changes nothing: the extension shows you a sheet listing exactly what would be shared, and nothing about your groups, your profile, your Pages or your posting is shared until you tick the box and press Connect. One thing does happen before that, so the sheet can tell you who is asking: the extension sends the code and a random installation id to our server and gets back the agency's name and the domain of its account email. Nothing else leaves your browser until you confirm, and the agency is told nothing at that point. Your Facebook login stays yours — the agency never holds a password, and posts publish from your own browser, with your own session, while Chrome is open.
What is sent to us and shown to that agency
This reporting is separate from the extension's "Allow Anonymous Usage Data" setting. It continues while you are connected even if that setting is off, and routine reporting stops when you disconnect. A saved pending managed-reply OFF choice can still be sent to Group Posting after disconnect, to protect it across browsers.
What an agency can set up on your browser
Data moves the other way too. Besides the posts, collections, schedules and campaigns an agency publishes to your browser, it can set up Lead Radar for you: which of your groups it watches, the exact phrases and keywords it looks for, the words that rule a post out, how often it scans, whether it is running, whether it replies to matching posts under your own account automatically, up to a daily limit of at most ten, and — because those replies go out in your name — how those replies are written: how helpful they sound, how much they sell, how direct they are, and a short note of up to 400 characters the agency adds about your business. That is the entire list. There is nothing else in Lead Radar an agency can reach.
What they never get back is the catch. Everything Lead Radar finds stays on your own computer as far as an agency is concerned: every matching post, every person behind one, your notes on them, and even how many there were. None of it is sent to us for the agency, there is no screen in their dashboard that shows it, and there is no table in our database it could be written to. They can set the watch; they never see what it catches. (Your own Pro plan's cloud backup is a separate matter — it does carry a shortened copy of your recent Lead Radar matches, and section 4 says exactly what it keeps and what it strips out. A browser covered by an agency's plan does not get a backup at all.)
What connecting never shares — with the agency or with us
We also store, and never show the agency, a random installation id for the browser you connected. It is how your browser proves it is the one you authorised; we do not join it to anything else we hold about you.
To protect your managed-reply OFF choice, this browser profile keeps a random clearing proof outside exports and cloud backups and sends it to Group Posting when checking or changing that choice. The service stores a verifier with the agency/client and Facebook profile or Page identifiers, the OFF state, ordering and replay-prevention information, and server time. This authority record contains no browser name, IP address, profile picture, reply text or Lead Radar matches. The agency sees only whether a shared OFF hold exists for the selected profile or Page; it cannot identify which browser set it, see an unsent offline choice, read the proof or clear a hold. An unavailable status is unknown, and no shared OFF hold does not mean replies are enabled.
Connecting also does not start anything else. It does not turn on cloud backup: a browser covered by an agency's plan gets every Pro feature except cloud backup, and its daily licence check leaves out the last-post timestamp described in section 4. Your own plan, if you have one, carries on exactly as before.
Who is responsible, and for how long we keep it
For the data an agency directs us to process about you, the agency is the controller and we act as its processor under a written agreement. The agency decides what is posted for you and is responsible for it, including for having a lawful basis to manage your account. We stay an independent controller for our own billing, licensing and product diagnostics. Our sub-processors for this are Cloudflare (hosting and storage), Resend (our email to the agency), LemonSqueezy (the agency's payments) and DeepSeek (group ranking, and drafting the automatic Lead Radar replies an agency has switched on; section 4).
If the agency on your sheet is Group Posting ProTeam. Our own Done-for-you service connects to your browser in exactly the same way, and everything in this section applies, with three differences. Group Posting ProTeam does not set up Lead Radar or automatic replies on your browser. The business that ordered Done-for-you is the controller of this data and we act as its processor (section 7). And your account manager is part of the team that operates the connection (section 9).
Results of the agency's posts are kept for up to 400 days. Your group list, collections and the profile/Page names and pictures are kept until 90 days after the last connection ends. The Lead Radar setup an agency wrote for you is not kept by us as a separate record at all: it is part of what they authored, your own settings are put back on your browser when you disconnect — for the profile or Page you are using at that moment, and for any other one as soon as you next switch to it — and it is deleted with their account. When you disconnect you can ask for them to be deleted straight away, and the record that you authorised the connection is kept for three years, marked withdrawn — it is the evidence that the processing was allowed.
Managed-reply OFF choices have a separate retention rule. Disconnecting, reconnecting, changing an agency setup or choosing Also delete does not clear a confirmed choice. We retain the minimal authority record and replay-prevention state until 90 days after the last active connection to that agency client ends; a later archive or edit does not restart that clock. The ordinary reported-data and authorisation-record rules above remain separate. This browser keeps its clearing proof and any pending OFF through disconnect. A saved OFF can be delivered with a verifiable revoked credential for up to 90 days after that particular connection was revoked. If that credential is no longer usable, the choice remains local and pending until you reconnect in the original browser profile. The existing connection-record retention remains separate from this delivery window.
After the service confirms expiry of the old authority period, old queued choices cannot recreate a shared hold. Replies remain off locally; establishing a shared hold in a new period requires a fresh explicit OFF choice. Complete loss of the original browser profile's local data also loses its clearing proof. Another browser, the agency and support cannot clear that original choice. Restoring the original local profile, or ending all connections to that agency client and waiting for the authority-retention period to expire, are the supported recovery paths. An exported or cloud backup does not restore the proof.
You stay in control. In the extension's Settings you can see the exact text you accepted and its date, pause the agency's posting, or disconnect. Pausing and disconnecting work even with no internet connection. Everything you made yourself stays on your computer, and the agency's schedules, templates and images are removed — with one choice offered at that moment: you can keep a copy of the post templates they gave you, which then become your own. You can ask the agency or us for a copy of this data, to correct it or to delete it, and you can complain to your data protection authority (in Hungary, the NAIH).
7. Done-for-you clients
(when launched) Done-for-you is our AI-written posting plan for businesses (groupposting.com/facebook-group-marketing-service/): our AI (built on Anthropic’s Claude) researches the business, plans each month and writes the posts; the business approves them; and they publish from the business’s own Chrome. No person on our side writes or edits the posts. It is sold to businesses only, under our Terms, which you accept when you buy. This part is for the business, and for the person whose Facebook account posts for it (the “connected account holder”).
7.1 Before you order
Before you buy you can see a free plan for your business: you give your website (or a short description), answer three quick questions and give your email. Our server reads a few public pages of your website and sends what it found, with your answers, to Anthropic (section 12) to build the plan. We keep your answers, email and plan as an enquiry (sections 3.3 and 3.7) and email you a link to it. Other questionnaires are covered in section 3.
7.2 Your subscription and payments
You subscribe on our site through LemonSqueezy, our merchant of record for Done-for-you as for our other paid plans: LemonSqueezy takes the payment, issues the invoice and handles VAT, under its own terms and privacy policy (section 12). We never see your full card details. From LemonSqueezy we receive your name and email, the business name and VAT number if you gave them, your country, the product and price, payment, renewal and refund events, the subscription status, and a link to LemonSqueezy’s customer portal so you can manage billing. A reference in the checkout links the order to your plan. Before you pay you confirm that you are buying for your business and accept our Terms; we keep that confirmation. Each successful monthly payment adds one month.
7.3 Research, plans, posts and approvals
After you subscribe, our server reads public pages of your website again and sends what it found, with your answers, to Anthropic (section 12) to build a short profile of the business, each month’s plan and its 14 posts, and 3 extra gift posts after your first payment. To choose groups, the names and approximate member counts of the groups in your extension go to Anthropic too, and nothing else about the connected account holder or the groups’ members; only after the declaration in 7.4. We do not use DeepSeek for the posts we prepare. (AI features you use yourself in the extension run on DeepSeek, as for any Pro user: section 4.3.) Each post’s image is drawn in your own browser in the app and uploaded to our storage at Cloudflare. We keep the profile, the plans, the posts and images, your posting times, the profile or Page you chose to post as, and your approvals.
7.3a The client app
You manage Done-for-you at groupposting.com/my/. You sign in with a link we email you (it works for 7 days) or, right after paying, in the same browser; the app keeps you signed in on that device for up to 30 days. A short code (groupposting.com/go/…) lets you continue on your computer. We keep each sign-in session and link only while it is valid. In the app you can manage billing (it opens LemonSqueezy’s customer portal) and delete your data (section 14).
7.4 Your connected browser
The connected account holder installs the extension and confirms the connection personally, in their own browser, on the Done-for-you version of the sheet in section 6, which names Group Posting ProTeam. They then pick, from the profiles and Pages the extension reports, the one that posts for the business; posts go out only as that profile or Page, and stop if a different one is signed in. From then on our systems receive what an agency receives about that browser: the group list, the profile and Page names and pictures, the results of the posts we scheduled, and the extension’s health; our team looks at it only to handle an exception. We use the group list only to suggest groups that fit the business. Because a list of groups can reveal sensitive things about a person, think about which Facebook account to connect: one whose groups are mostly business-related exposes less, and the business owner’s own account is the simplest choice.
Before connecting, the connected account holder confirms a short declaration in the app for the business. It says what our systems receive, that group names can reveal sensitive information, and that group names and sizes are sent to our AI provider, Anthropic, in the United States, when groups are chosen; and it records their explicit consent, given to the business. They can withdraw it at any time by disconnecting in the extension or the app, or by writing to the business or to us. While the browser is connected, our plan covers it with Group Posting Pro features except cloud backup, so connecting does not start a cloud backup. The AI features in the extension work as for any Pro user and use DeepSeek (section 4.3); the posts we prepare for Done-for-you do not.
7.5 Updates and reminders
Updates in the app and by email separate confirmed publications, posts held for an administrator’s approval, and runs that were missed or failed, with a link to each published post. We also email you when a month is ready to approve and when posting needs your attention, for example if Chrome has been offline for a while.
7.6 Who is responsible
For the data from your connected browser and any personal data in what we read from your website or in your posts, your business is the controller and we act as its processor. We are the controller for your subscription and account, support, and our own sales and marketing; LemonSqueezy is a separate controller for payments and invoices. Before we delete your posts and images you can download them in the app or ask us for a copy.
7.7 Who helps us, and how long we keep it
Cloudflare (hosting, databases and storage, including your post images), Anthropic (research, plans, posts and group suggestions; United States), Resend (our emails to you: sign-in links, setup help, month-ready and posting reminders, and updates; United States) and LemonSqueezy (merchant of record: payments, invoices and VAT; a separate controller) help us deliver Done-for-you. DeepSeek is not used for the posts we prepare; it powers the AI features the connected account holder uses themselves in the extension. We email clients before we add or replace a provider. Data from your connected browser follows the agency retention rules in section 6. Your profile, plans, posts, images, approvals and app sign-ins are deleted 90 days after your plan ends, or earlier when you use “Delete my data” in the app or ask us; LemonSqueezy keeps invoices as the law requires.
8. People who email us
If you write to [email protected] or [email protected], or reply to one of our emails, we receive your address, your message and anything you attach. We use them to answer you and keep them as the record of our conversation. To find a purchase we may ask for the email you bought with, or your licence key. Please never send us a password, a Facebook login code or full card details. Some replies are written with the help of an AI model (DeepSeek, section 4.3), which reads your message to write the answer; refunds and payment questions always go to our team.
Our help centre is self-serve and has no chat widget. The setup partners on our Experts page are independent businesses: if you contact them, they handle your data under their own terms.
9. Our support team: what they can and cannot see
Every agency and every Done-for-you client gets setup help by email from our support team, Group Posting ProTeam: our small team of employees and contractors. A call happens only if you ask for one. They are bound by confidentiality and use what they see only to help you. They do not write, edit or check Done-for-you posts: our AI prepares them and you approve them.
Your agency account (agency name, account email, plan, members and their roles), your messages and call notes, and anything you send them. When you ask for help with something specific, the part of your dashboard you need help with, such as a client's schedules or results.
Any Facebook password, cookie, login code or session; private messages; anything Lead Radar finds (we never receive it for an agency); posts, templates and schedules your clients make themselves; your clients' own licence keys; full card details.
Ask for a password or for remote control of a computer to sign in to Facebook, or contact your clients to sell to them.
What they need to answer you or handle an exception, from section 7: your subscription status, your plan, posts and approvals, your updates and the state of your connection. Because our systems run the agency side of your connection, once the connected account holder has confirmed it, they can also see what an agency sees about your connected browser (section 6).
Any Facebook password, cookie, login code or session; your private messages; anything Lead Radar finds; posts, templates and schedules you make yourself; full card details.
Ask for a password or remote control, publish anything you have not approved, write or edit your posts, or reply to comments or messages for you.
Any change we make in an agency's dashboard is recorded in that agency's audit log (section 5.4).
10. Who is responsible: controller and processor
The controller decides why and how personal data is used and answers for it. A processor handles it only on the controller's instructions.
| Situation | Our role | Who else |
|---|---|---|
| Website visits, cookies and analytics | Controller | Google and Meta process data for their own purposes too. For collection through the Meta Pixel, Meta and we may be joint controllers. |
| Questionnaires, calls and ad measurement | Controller | Cal.com and Resend act for us. Meta receives Conversions API events only with consent, and for those Meta and we may be joint controllers. For Meta lead forms, Meta may act for us |
| Using the extension: licences, AI features, Pro backup, diagnostics, emails | Controller | LemonSqueezy, as merchant of record, uses payment and tax data as its own controller |
| An agency's account, members, billing, support and account management | Controller | — |
| A client's data processed for an agency through the dashboard | Processor, under the Data Processing Agreement (dpa-2026-09-cp1) | The agency is the controller. We stay controller for our own billing, licensing, security logs and product diagnostics |
| Done-for-you: data from the connected browser, personal data in the client's materials | Processor, under the Business Terms, Schedule 3 Part B | The client business is the controller |
| Done-for-you: contract, invoices, account management, support | Controller | — |
| Support emails | Controller | — |
Facebook (Meta) is not our processor when you post: posts go out from your own browser, in your own Facebook session, and we never send anything to Facebook on anyone's behalf.
11. Why we may use your data: lawful bases
The GDPR lets us use personal data only on a lawful basis (Article 6). These are ours:
| Purpose | Whose data | Lawful basis |
|---|---|---|
| Running and protecting the website and our service (security logs, spam protection) | Everyone | Legitimate interests in a secure, working service |
| Analytics and ad cookies, Meta Pixel, Google Ads clicks, Conversions API, ad audiences | Website visitors | Consent, given with Accept and withdrawn with Cookie settings. Outside the EEA, the UK and Switzerland, Google's tags run and we keep Google ad clicks (section 2.4) until you click Decline; there we rely on legitimate interests in measuring our ads, and you can object at any time with Decline. |
| Campaign tags stored with an enquiry or added to an agency checkout | People who send a questionnaire | Legitimate interests in knowing which campaigns bring enquiries (internal use only) |
| Answering an enquiry, sample posts, booking and holding a call | People who send a questionnaire or book | Steps you ask for before a contract; follow-ups: legitimate interests; tips: consent |
| The extension's service: licence checks, Pro cloud backup, AI features you use, an agency connection you confirm | Extension users | Contract (our Terms of Service) |
| Usage-related email timing from the licence check; optional diagnostics (on by default, with an off switch) | Extension users | Legitimate interests in reliability and useful timing |
| Setup guide and tips emails | People who asked for them | Consent; unsubscribe at any time |
| Emails to customers about features, renewals, reviews, referrals and plan changes | Customers | Consent, or the existing-customer exception where the law allows it; you can unsubscribe or object at any time |
| Agency and Done-for-you contracts, account management and support | Business customers and their contact people | Contract; for contact people at a business, legitimate interests |
| Processing for an agency or a Done-for-you client | Agency clients, connected account holders, people in client materials | The agency or client business needs its own basis. A group list can reveal special category data, so it also needs an Article 9 condition, usually explicit consent |
| Invoices, accounting and tax | Customers | Legal obligation (Hungarian accounting and VAT law) |
| Acceptance records, managed-reply OFF records, referral fraud checks, legal claims | Agencies, clients, referrers | Legitimate interests; legal obligation where the law requires a record |
| Support emails | Anyone who writes | Legitimate interests; contract where you are a customer |
You do not have to give us personal data. Without an email address we cannot send your samples or book a call; without business and VAT details we cannot contract with you or invoice you, as the law requires.
Where we rely on consent, you can withdraw it at any time without affecting what happened before. Where we rely on legitimate interests, you can object (section 15).
12. Service providers and international transfers
These providers handle personal data for our website and services. Cloudflare, Anthropic, DeepSeek, Resend and (when launched) Cal.com act only on our instructions, under written data processing agreements. LemonSqueezy (as merchant of record), Google and Meta also use the data for their own purposes, as controllers under their own privacy policies. For the Meta Pixel and the Conversions API, Meta and we may be joint controllers (section 10). Items marked (when launched) start only with those features.
| Provider | What for | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, network security, databases and storage: the website, the extension's service, Pro cloud backup, the agency dashboard and media, (when launched) the enquiry database, the Done-for-you client app, its database and post images, and Turnstile | Global edge network | Cloudflare's data processing addendum with the EU standard contractual clauses |
| Anthropic, PBC | (when launched) Done-for-you: building the free plan, research, plans, posts and group suggestions (section 7) | United States | EU standard contractual clauses in Anthropic’s data processing addendum |
| DeepSeek | AI features in the extension and the agency dashboard, and help drafting replies to emails we receive (sections 4.3, 5.5, 6, 8). Never used for the posts we prepare for Done-for-you | China | EU standard contractual clauses |
| LemonSqueezy | Merchant of record for Plus, Pro, Lifetime, agency plans and (when launched) Done-for-you: payment, invoices, VAT | United States | EU–US Data Privacy Framework (Stripe group) and EU standard contractual clauses |
| Resend | Our emails: setup and customer emails, agency sign-in codes, (when launched) enquiry notices and Done-for-you emails (sign-in links, setup help, month-ready and posting reminders, updates) | United States | EU standard contractual clauses |
| Google (Tag Manager, Analytics, Ads, YouTube player) | Website measurement and ads (section 2); never in the extension or the agency dashboard | May include the United States | EU–US Data Privacy Framework |
| Meta Platforms | Pixel on the website with consent; (when launched) Conversions API and lead forms (sections 2.5, 3.5, 3.6). Joint controller with us for Pixel and Conversions API collection; for lead-form answers, possibly our processor | May include the United States | EU–US Data Privacy Framework |
| Cal.com | (when launched) Booking calls (section 3.4) | EU data region | Not needed: data stays in the EU |
| Our email hosting provider | Our hello@ and sales@ mailboxes (section 8) | EEA or United States | EU standard contractual clauses or the EU–US Data Privacy Framework where data leaves the EEA |
| The chat and video-call tools we use with you | Support calls, only if you ask for one (sections 3.4 and 9) | EEA or United States | EU standard contractual clauses or the EU–US Data Privacy Framework where data leaves the EEA |
The Hungarian tax authority (NAV) receives invoice data because the law requires it; it is not our processor. Agencies see their own sub-processor list in the dashboard, in Annex 2 of the Data Processing Agreement.
Transfers outside the EEA. Where a provider processes personal data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on its standard contractual clauses (Decision (EU) 2021/914), with any extra safeguards needed. The table names the safeguards specified in this policy. You can ask us for a copy of the safeguard that applies.
14. How long we keep data
We keep personal data only as long as needed for the purpose it was collected — for example, payment and invoice records are retained by our payment provider for as long as tax and accounting law requires. Data stored locally in your browser stays until you clear it or uninstall the extension.
| Data | How long |
|---|---|
| Website security logs | Up to 30 days |
| Google Ads click links and conversion records | 90 days (click link); 100 days (conversion record) |
| Enquiries (when launched) | Deleted 12 months after they arrive if no contract follows; otherwise part of the customer record |
| IP address and browser user agent kept with an enquiry, only if you accepted cookies (when launched) | 90 days, then deleted |
| Call bookings (when launched) | In Cal.com: 12 months, then deleted; our copy follows the enquiry |
| Email sign-up records (setup guide, welcome page, extension, uninstall page) | No automatic expiry today. An unsubscribe note is kept so we never email you again by mistake |
| Uninstall reasons | Counted per day; the daily counts are kept 120 days; the note that stops setup emails, 90 days |
| Licence check details | While your licence is active, then 90 days |
| Optional diagnostics | Posting summaries and rating answers up to 120 days; aggregated counts without personal data longer |
| Pro cloud backup | Until you ask us to delete it. Inside it: up to 90 days of posting history and up to 500 recent Lead Radar matches |
| Referral records | 24 months after the referral |
| Agency client data (groups, collections, profile and Page names and pictures) | 90 days after the client's last connection is revoked and the client is archived; deleted at once on request |
| Results of an agency's posts; per-group outcomes | 400 days; 180 days |
| Connection record | Health data, session identifier and time zone removed after 90 days; the record deleted 180 days after it is revoked |
| A client's authorisation record | 3 years after the relationship ends, marked withdrawn |
| Managed-reply OFF authority record | Until 90 days after the last active connection to that agency client ends (section 6) |
| Agency audit log | 400 days |
| Everything else belonging to an agency | 90 days after the agency account ends, with the exceptions above |
| Done-for-you materials, posts and approvals | 90 days after the service ends; returned to you in a common format on request before then |
| Done-for-you reports and conversations; support emails | Up to 3 years after the last message |
| Invoices and accounting records | As long as Hungarian accounting and tax law requires |
| Data the extension stores in your browser | Until you clear it or uninstall the extension |
Anything Lead Radar finds on a client's device is never stored by us for an agency, so there is nothing to keep or delete.
15. Your rights, and how to use them
Under the GDPR you can ask us for:
How. Email [email protected] from the address we know you by, and say what you would like. We may ask you to confirm who you are. We answer within one month; if a request is complex we may need up to two more months, and we will tell you why. It is free unless a request is clearly unfounded or excessive.
Data held for an agency or a Done-for-you client. You can ask the agency, or the business that ordered Done-for-you, or us. If you ask us, we tell them and help them answer. You can always ask us to erase the data we hold about you under that connection, and disconnecting with “Also delete” in the extension does exactly that, except for the records section 6 says are kept: the record that you authorised the connection, and a confirmed managed-reply OFF choice. Data the extension keeps on your own computer is in your hands: you can delete it in the extension or by uninstalling it.
Complaints. You can complain to the data protection authority where you live or work, or where you think the law was broken. In Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): Falk Miksa utca 9–11, 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; phone +36 1 391 1400; [email protected]; naih.hu. You can also go to court. We would welcome the chance to sort things out first.
16. Changes and other things to know
Changes. If we change this policy we'll update the “last updated” date and version above and, for material changes, flag it where practical — by email to customers, and in the dashboard for agencies. This version (2026-10) adds the parts for website visitors, enquiries, agency customers, Done-for-you clients and support, a roles table, lawful bases, a provider list, a cookie table and a retention table.
No automated decisions. We make no decisions about you based solely on automated processing that have legal or similarly significant effects. The AI features draft and score content only when you, an agency you connect to, or our team ask them to — or, for Lead Radar's automatic replies, while they are switched on (section 6).
Children. Group Posting is a tool for businesses and adults. It is not meant for children under 16, and we do not knowingly collect their data.
Group Posting is an independent product and is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc.