Log in

Privacy policy

Last updated 25 October 2026

This policy explains what personal data Flexrop collects when you use it to schedule and publish social media posts, why, who it's shared with, how long it's kept and the choices you have.

1. Who we are

Flexrop is operated by PILOTLAB LLC, 304 S. Jones Blvd, Las Vegas, Nevada 89107 (“we”). We are the controller of the personal data described here. The GDPR page explains the legal bases we rely on and your rights in more detail.

2. Information we collect

Your account

  • Email address, name, and a hashed (never plain-text) password.
  • Settings such as your timezone and email notification preference.

Social accounts you connect

  • For Facebook, Instagram, Threads, LinkedIn (profiles and Company Pages), X and Bluesky: the account or Page ID, its name or handle, and its profile picture URL.
  • The access credentials the network issues to Flexrop (access tokens, refresh tokens or token secrets, and their expiry), so we can publish on your behalf. For Bluesky this is a session created from the app password you enter; we don't store the app password.

We only request the permissions needed to list the accounts you can post to and to publish. We don't read your messages, followers or other people's content.

Content you create

  • Post text, schedules, the channels each post goes to, versions customized for each network, post types (post, Reel, Story) and first comments.
  • Images and videos you upload. Each network downloads them from an unlisted public URL when publishing, so anyone with the exact URL can view the file.
  • Publishing results: whether each post went out, the post ID the network returned, and any error.

Technical data

  • Cookies that keep you signed in and protect connections to social networks. We use no analytics or advertising cookies; see the cookie policy.
  • Server logs (IP address, browser, pages requested and errors), used for security and troubleshooting.

3. How we use your information

  • To run Flexrop: sign you in, show your queue and calendar, and publish posts at the times you choose.
  • To tell you when something needs attention, such as a failed post or a channel that needs reconnecting.
  • To keep the service secure, prevent abuse and fix problems.
  • To meet legal obligations.

We don't sell your personal data or use it for advertising, and we use data received from Facebook, Instagram, Threads, LinkedIn, X and Bluesky only to provide the features you use in Flexrop.

4. Who we share it with

  • The networks you publish to. When a post goes out, its text and media are sent to that network, and its privacy policy applies from then on.
  • Service providers that process data for us under contract:
    • Contabo GmbH: hosting for the application and database (servers in the EU, France).
    • Amazon Web Services: storage for uploaded images and videos (S3, us-east-2, Ohio, USA).
  • Others when required: to comply with the law or protect rights and safety, or as part of a merger or sale of the business, with notice to you.

5. How long we keep it

  • Account, connected channels and content: while your account is active. Deleting your account removes them immediately; database backups that contain them roll off within 14 days.
  • A connected channel's credentials: until you disconnect it, remove Flexrop from that network, or delete your account.
  • Web server access logs: 14 days. Application logs: rotated automatically and kept for a limited period.
  • Records of data deletion requests (a confirmation code, the network and the date): kept so you can check a request's status.

6. How we protect it

  • All connections use HTTPS, and passwords are hashed with bcrypt.
  • Access credentials for your social accounts stay on our servers and are never sent to your browser.
  • Sessions use signed tokens, and connections to networks are protected against cross-site forgery.
  • Server access is restricted, and the database is backed up daily.

No system is perfectly secure. If a breach affects your personal data, we'll notify you without undue delay.

7. Your rights and choices

You can access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent where we rely on it. You can disconnect channels and delete your account yourself (see data deletion). For anything else, email support@flexrop.com with the subject “Privacy request”. We may need to confirm your identity first.

California residents: we don't sell or share personal information as defined by the CCPA/CPRA, and you won't be treated differently for exercising your rights.

8. International transfers

The application and database run in the EU (France). Uploaded images and videos are stored in the USA (AWS us-east-2), and the networks you publish to may process data worldwide. Where the law requires it, transfers rely on the EU Standard Contractual Clauses or the UK equivalent.

9. Children

Flexrop is for people aged 18 and over. We don't knowingly collect data from children, and we delete it if we learn we have.

10. Changes to this policy

When we change this policy we update the “Last updated” date above, and we tell you by email or in the app about significant changes.

11. Contact us

PILOTLAB LLC, 304 S. Jones Blvd, Las Vegas, Nevada 89107, USA. Email support@flexrop.com or call 1 888 370 6801.