Privacy Policy

1. Who we are

Lemmek is an application programming interface (API) that lets software products ("customers" or "integrators") publish content to social media platforms on behalf of people who connect their own social media accounts ("end users").

Lemmek is operated by Newerse OÜ, a private limited company registered in Estonia (registry code: pending registration), Tallinn, Estonia ("we", "us"). You can reach us about privacy at privacy@lemmek.com.

2. Controller and processor roles

• Customers and website visitors. For data about our customers (their account, team members, billing and API usage) and about visitors to lemmek.com, Newerse OÜ is the controller.
• End users. When an end user connects a social account through a customer's product, we process that end user's data on behalf of and on the instructions of the customer. For this data the customer is the controller and Newerse OÜ is the processor. The customer's own privacy notice applies, and the customer decides what is published and when. Our processing is governed by our data processing terms with the customer.
• Security and abuse prevention. We act as an independent controller for the limited processing needed to secure the service, prevent abuse and comply with platform terms and the law.

If you are an end user and want to exercise your rights, you can contact the product you connected your account to, or contact us directly. We will help or forward your request to the customer.

3. Data we collect

From end users who connect a social account

• OAuth credentials: access tokens and refresh tokens issued by the platform after you approve the connection, together with the list of permissions (scopes) you granted and their expiry.
• Account identifiers: the platform's account id, username or handle, display name, profile picture (avatar) URL, and account type (for example, whether an Instagram account is a professional account).
• Selected destinations: the Facebook Pages, YouTube channels, LinkedIn Pages, Pinterest boards or Telegram channels you choose to allow.
• Content to publish: text, images, video, captions, titles, scheduling time and platform settings (such as privacy level or audience settings) provided for publishing.
• Publishing results: the id and link of each published post, its status and visibility, and the responses and error messages returned by the platform.

From customers

• Name, work email, company name, team members and their roles.
• Billing details. Payments are processed by Stripe; we do not receive or store full card numbers.
• API keys (stored as hashes), webhook endpoints, connect page settings and branding.

Technical data

• API request logs: time, endpoint, response status, request id, IP address and user agent.
• Audit logs of security-relevant actions, such as connecting or disconnecting an account, creating API keys or deleting data.

We do not access private messages, contacts, follower lists, analytics about other people, or content from accounts other than the ones you connected.

4. How we use data

5. What we never do

• We do not sell personal data or data received from platforms.
• We do not use platform data for advertising, ad targeting, profiling or building user profiles.
• We do not use data received from platforms to train general-purpose artificial intelligence or machine learning models.
• We do not publish anything that the end user or the customer acting on their instruction did not request.
• We do not transfer platform data to data brokers or other third parties, except the subprocessors listed below that help us run the service.

6. How long we keep data

Customers can delete their data, or an end user's data, earlier through the API or by contacting us.

7. Sharing and subprocessors

We share data only as needed to provide the service:

• The platforms you publish to. Content and account credentials are sent to the platform the end user chose, to publish on their behalf.
• The customer whose product the end user connected through, who receives account identifiers, account status and publishing results.
• Subprocessors that host and operate the service, listed below.
• Authorities, where we are required to by law. We review each request and disclose only what is legally required.

Current list of subprocessors:

We will update this list before adding a new subprocessor that processes personal data.

8. International transfers

We host the service in the European Union. Some subprocessors may process limited data outside the European Economic Area, for example Cloudflare's global network or Stripe's operations in the United States. Where this happens we rely on the European Commission's adequacy decisions, including the EU-U.S. Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses, together with additional safeguards where needed.

Publishing content to a platform necessarily sends that content to the platform, which may process it in other countries under its own privacy policy.

9. Security

OAuth tokens are encrypted at rest with AES-256-GCM, using keys held in a key management service. Data is encrypted in transit with TLS. Customer data is isolated per tenant, access is limited to staff who need it, and security-relevant actions are logged. See Security for details.

10. Your rights

Under the EU General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

Send requests to privacy@lemmek.com. We respond within one month. We may need to verify your identity, for example by asking you to confirm the connected account.

You also have the right to lodge a complaint with a supervisory authority. In Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). You may also contact the authority in your country of residence.

11. Revoking access and deletion

You can stop Lemmek from accessing your account at any time:

• disconnect the account in the product you connected it through;
• revoke our app's access in the platform's own settings (see the platform sections below and our Data deletion page); or
• email privacy@lemmek.com with the platform and account name.

After access is revoked we stop publishing to the account and delete its tokens and account data within 7 days, and from backups within 30 days. Posts already published stay on the platform; you can delete them there.

12. Google and YouTube

Lemmek uses YouTube API Services to upload videos to YouTube channels that their owners connect. By connecting a YouTube channel to Lemmek, you agree to be bound by the YouTube Terms of Service. Google's processing of your data is described in the Google Privacy Policy.

Data we access from Google

• Basic channel information: channel id, title and thumbnail, to show which channel is connected.
• Upload permission (youtube.upload), to upload the videos you ask us to publish, with the title, description and settings you choose.
• Read-only access (youtube.readonly), used only to identify your channel and confirm that videos we uploaded exist and have finished processing.

We store OAuth tokens and channel identifiers while your channel is connected, and the ids and status of videos we uploaded for 90 days. We do not share Google user data with anyone except as described in this policy, to provide the publishing service. Stored channel data is refreshed while the channel is connected and is deleted within 7 days after you revoke access.

Limited Use

Lemmek's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the user-facing publishing features described here; we do not transfer it except as necessary to provide those features, for security, or to comply with law; we do not use it for advertising; we do not use it to train general-purpose AI or machine learning models; and no person reads it unless you give consent, it is needed for security or to comply with law, or it is aggregated and anonymised for internal operations.

Revoking Google access

You can revoke Lemmek's access to your Google account at any time on the Google security settings page: security.google.com/settings/security/permissions. Select Lemmek and choose to remove access.

13. TikTok

Lemmek uses TikTok Login Kit and the TikTok Content Posting API to publish videos and photo posts that TikTok creators choose to publish from the product they connected.

• Data we access: your TikTok open id, display name and avatar (user.info.basic); your current posting options, such as available privacy levels and maximum video length; and the status of posts we submitted.
• Permissions: video.publish to post directly and video.upload to send drafts to your TikTok inbox.
• Your choices: before each post you choose the privacy level and interaction settings, and commercial content disclosures are applied as you set them. We never pick a privacy level for you.

We do not access your videos, comments, followers or messages beyond the status of posts we published. You can revoke access in the TikTok app under Settings and privacy, Security, then Apps and services (menu names may vary by app version), or by contacting us. See also the TikTok Terms of Service and TikTok Privacy Policy.

14. Meta: Instagram, Facebook, Threads

Lemmek uses the Instagram API, the Facebook Pages API and the Threads API to publish content to Instagram professional accounts, Facebook Pages and Threads profiles that their owners connect.

• Data we access: account or Page id, name, username and profile picture; the list of Pages you manage, so you can choose which ones to allow; and the ids and status of posts we published.
• Purpose: only to publish content you or the product you use asks us to publish, and to confirm the result.
• Not accessed: private messages, comments, followers, insights about other people, or personal Facebook profiles.

We process data received from Meta in accordance with the Meta Platform Terms and Developer Policies. You can remove our app at any time: on Facebook in Settings and privacy, Settings, Business integrations or Apps and websites; on Instagram in Settings, Website permissions, Apps and websites. When you remove the app, Meta notifies us and we delete your data as described on the Data deletion page, where you can also check the status of a deletion request.

15. Other platforms

For LinkedIn, Pinterest, X, Bluesky, Telegram and Mastodon we follow the same approach: we access only the account identifiers and permissions needed to publish content you request, and you can revoke access in that platform's settings or by contacting us. Details for each platform are on the Platforms page.

16. Cookies and analytics

This website does not use analytics, advertising or tracking cookies, and loads no third-party trackers. The customer dashboard uses only strictly necessary cookies to keep you signed in.

17. Children

Lemmek is a business service and is not directed to children. We do not knowingly process data of children under 16 except where a customer's end user has lawfully connected an account under the relevant platform's age rules. If you believe a child's data was provided to us unlawfully, contact us and we will delete it.

18. Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here with a new date and, for material changes, notify customers by email before they take effect.

19. Contact

Newerse OÜ, Tallinn, Estonia. Registry code: pending registration.
Privacy: privacy@lemmek.com · General: hello@lemmek.com