Privacy policy

Effective date: 5 October 2026

This policy explains how Lokola handles personal data when you visit lokola.com, use our business service, contact us, or appear in public content included in our media-monitoring and creator-research reports. Publicly available information can still be personal data.

1. Who is responsible for your data

LOKOLA s.r.o. is the controller for operating its website, handling its business communications and deciding its own research and monitoring purposes. Where we process a client’s data solely on that client’s documented instructions, the client is the controller and Lokola acts as a processor under the applicable agreement.

2. Data we collect and its sources

• Public profiles and content: public account or Page identifiers, names, handles, profile links, declared country or market, published posts and video titles/descriptions, publication dates, content links, thumbnails, and available aggregate engagement figures such as views, likes and follower counts. We also keep collection dates and historical observations where permitted by the source platform.
• Sources: platform APIs, including YouTube API Services and X, public publisher feeds and sitemaps, and profile lists supplied by our clients or selected for a project. Facebook Page data is collected only when that integration has the required Meta access and approvals. Inclusion of a profile link for another platform does not mean we collect that platform’s content.
• Business and support communications: your name, email address, organization, messages and information you choose to provide when contacting us or requesting assistance.
• Service and security data: login information, session information, IP addresses, request details, timestamps, browser/device information available in service logs, and errors needed to operate and secure the service.
• Browser preferences: locally saved display and filter settings, described in section 7.

The current collection features read public profile and published-content information. They do not collect private messages, private personal profiles, the text of audience comments, or the identities of individual followers or people reacting to posts. Aggregate comment or reaction counts are different from collecting those individuals’ identities. We do not ask for your Facebook, YouTube or X password. For Meta data, we analyze or display public Page posts and engagement only within the approved use case; we do not build or augment personal user profiles without the valid consent required by Meta.

Public posts may incidentally mention other people or contain sensitive information. We do not intentionally build datasets of sensitive personal characteristics or infer those characteristics about individuals.

3. Why we process data and the legal bases

• Media monitoring, creator research and reporting: to organize public sources, identify relevant published coverage, display public content and available engagement, and produce business reports. Where this involves personal data, we rely on our and our clients’ legitimate interests under Article 6(1)(f) GDPR, subject to necessity, proportionality and the rights of the people concerned.
• Providing the service and answering requests: performance of a contract or steps you request before entering a contract under Article 6(1)(b), where you are the contracting person. For contacts acting for an organization, we rely on legitimate interests in managing that business relationship.
• Security and service reliability: legitimate interests in preventing abuse, managing access and diagnosing failures.
• Legal duties and privacy requests: compliance with applicable legal obligations under Article 6(1)(c), and legitimate interests in documenting and defending legal claims where appropriate.

If an optional feature requires consent, we will explain that feature and obtain consent before using it. You can withdraw consent without affecting the lawfulness of processing that occurred before withdrawal. Making information public does not itself amount to consent to every use of that information.

4. Who receives data

Access is limited to authorized Lokola personnel and service providers who need it for their work, and business clients receiving the relevant project’s profiles, content and reports. Clients may export reports and must use them consistently with applicable data-protection law and source-platform terms. Where Meta requires it, our client and service-provider agreements must impose those restrictions, including on onward sharing.

We use Google Cloud for hosting and data storage and Google Workspace for business email. These providers process information to supply their services. Authorities or professional advisers may receive information where required by law or necessary to address a legal matter.

Collected personal data is used only for media monitoring, creator research, reporting and operating the service. It is not sold as a standalone dataset, used to build advertising audiences, or used to train general-purpose AI models. Profiles, posts and reports are available only to authorized business clients.

5. Storage, international transfers and security

Lokola’s main application and data stores are configured in Google Cloud European regions. This does not mean that every provider operation, support activity or external-content request stays within the European Economic Area.

If personal data is transferred outside the EEA, the transfer must have an applicable legal safeguard, such as a European Commission adequacy decision or standard contractual clauses together with any necessary supplementary measures. You can contact us for information about the safeguards relevant to your data.

Our current service uses encrypted HTTPS connections, authenticated access to the client area, and restricted cloud service accounts. Access credentials are managed separately from report data. No system can guarantee absolute security.

6. How long we keep data

We retain data only for as long as needed for the purposes in this policy and within the limits imposed by law and the source platform. We delete data earlier when the relevant purpose ends or an applicable deletion request or platform instruction requires it.

• Facebook public Page posts and engagement: up to 24 months from collection where necessary for media monitoring and comparisons across reporting years. We review continued necessity at least annually. This limit also applies to public content relating to identifiable creators; operating a business does not automatically make a person’s data non-personal.
• Routine technical and security logs: up to 30 days. Where a particular record is needed for an active security investigation or a legal obligation, we restrict it to that purpose and delete it when that need ends.
• Other personal data: only while needed to provide the service, handle your correspondence or resolve a privacy request, or meet an applicable legal recordkeeping obligation. We review this data when the relevant service or request ends. Information required for a legal claim is limited to what is necessary for that claim.
• Information solely about legal business entities and genuinely anonymous information: while needed for the relevant business or reporting purpose, subject to the source platform’s rules. Sole traders, identifiable employees and named creators remain individuals for this distinction.
• Browser storage: the login cookie lasts up to 14 days and is cleared on logout. Local display preferences remain until you clear your browser’s site data.

YouTube API data follows YouTube’s separate storage, refresh and deletion requirements. Non-authorized API data must be refreshed or deleted within the applicable 30-day window; historical non-authorized statistics must not be retained beyond the period allowed by YouTube. The Facebook retention period does not apply to YouTube data.

Retention limits apply to relevant source captures, reports, exports and stored copies. Backup handling must preserve the effect of deletion: restricted recovery copies must not return deleted data to normal use. A backup is not a reason to retain data indefinitely.

7. Cookies, local storage and external content

The client portal uses a first-party cookie named lk_s to maintain an authenticated session. It contains signed session information and is used for login functionality. It lasts up to 14 days; blocking it prevents authenticated access.

Some workspace and profile views use browser local storage to remember display and filter preferences. You can remove these through your browser’s site-data settings. The reviewed application code does not include advertising pixels or website audience-analytics trackers.

Some service pages load fonts, images or software libraries from external services, including Google services and cdnjs, operated by Cloudflare. Those requests disclose network information such as your IP address and browser request headers to the relevant provider. Following a link to a social platform or another website also brings you under that site’s own privacy practices.

This policy page uses system fonts and does not load external scripts, fonts or images.

8. Your privacy rights

Depending on the applicable circumstances, you can request access to your personal data, correction, deletion, restriction of processing, and portability of data processed automatically on the basis of consent or a contract. You can object to processing based on legitimate interests, including public-profile monitoring, for reasons relating to your particular situation. We will stop that processing unless the applicable legal conditions justify continuing it.

Write to privacy@lokola.com. Include enough information to identify the relevant profile, content or account. We may request proportionate evidence of identity or authority to prevent disclosure or deletion of another person’s data. Please do not send identity documents unless we specifically explain why they are needed.

We will respond without undue delay and normally within one month. Where the GDPR permits an extension for a complex request, we will explain the extension and its reason within that first month. Requests are normally free of charge.

You can complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or the competent supervisory authority where you live, work, or believe an infringement occurred.

9. Data-deletion instructions, including Facebook data

1. Email privacy@lokola.com with the subject “Lokola data deletion request”.
2. Identify the relevant platform and include your account/Page/profile URL or ID, or links to the relevant content. If acting for an organization, explain your authority. A Lokola login is not required to make a request.
3. We will identify the data, verify the request where necessary, and explain the action taken, any lawful exception and any further information needed.

Where deletion is required, it must cover relevant copies in Lokola’s operational stores and outputs, with backup handling under the retention process described above. Records that must be preserved by law will be limited to that purpose. A valid suppression or objection must also be considered when deciding whether to collect the same data again.

Removing an app’s authorization on a platform stops the access covered by that authorization; it does not automatically remove every existing copy held by Lokola. Contact us to request deletion of those copies. Deleting data at Lokola does not delete the original post, Page or account on Facebook, YouTube, X or another source service. The relevant platform provides its own controls for deleting source content.

For YouTube stored-data deletion requests, the applicable YouTube API rules require deletion as soon as possible and within seven calendar days. If you have separately granted access through Google authorization, you can also revoke it through Google’s permissions settings.

10. YouTube and other platform policies

Lokola uses YouTube API Services. Google’s handling of data is described in the Google Privacy Policy, and YouTube’s service terms are available in the YouTube Terms of Service. Other platforms apply their own terms and privacy policies to their services. Their permission rules do not replace Lokola’s obligations under data-protection law.

11. Automated processing and children

The current service uses automated collection, keyword matching, filtering and reporting. It does not make decisions about individuals that produce legal effects or similarly significant effects solely through automated processing. Lokola is a business service and is not directed at children. If you believe we hold personal data about a child that should not be included, contact our privacy address.

12. Changes and contact

We will update this policy when the service or its data practices change and show the effective date at the top. Material changes will be communicated through the service or another appropriate channel. Questions and privacy requests can be sent to privacy@lokola.com or to our registered office above.