Privacy Policy.

Who we are

Codyn Reach (reach.codyn.se) is a social media management service run by Codyn, a business of Atlas Lejon AB, Sweden. Atlas Lejon AB is the controller for the personal data described here.

When a company uses Codyn Reach to manage its own channels and clients, that company decides what content and contacts go into its workspace. For that content we act on the company's behalf as a processor.

Questions about privacy: hello@codyn.se.

What we collect

Your account

• Name, email address and password (stored only as a secure hash), or your Google profile name and email if you sign in with Google.
• Organization, workspace and team membership, roles and settings.

Content you create

• Posts, drafts, ideas, captions, schedules, comments and approval notes.
• Images, videos and files you upload to the media library.

Creator marketplace

• If you apply as a creator: display name, bio, topics, markets, profile links and follower counts, and the proposals, messages, content versions and payout details you exchange with brands.
• If you are a brand: briefs, budgets, decisions and messages, and the escrow records for each collaboration.

Technical data

• IP address, browser type and request logs, kept to run, secure and debug the service.
• Clicks on tracked campaign links (/go/ links), counted per campaign to measure results.

Connected social accounts

You can connect accounts on Facebook, Instagram, Threads, LinkedIn, TikTok, YouTube, Google Business Profile, Pinterest, Bluesky, Mastodon and DEV.to. You choose which accounts to connect and which permissions to grant, and you can disconnect at any time.

For each connected account we receive and store:

• Profile information: account id, name, username, profile picture and follower count.
• Access tokens the platform issues to us. They are encrypted at rest and used only to act on the account you connected.
• Your published content and its metadata, so we can show it in the calendar and analytics.
• Comments, mentions and direct messages on your posts and account, so you can read and answer them in the Codyn Reach inbox. This includes the name, username and message text of the people who write to you.
• Insights such as reach, views, likes, comments, saves, shares and follower counts.

We use this data only to provide the features you use in Codyn Reach: publishing and scheduling, the inbox, analytics and the creator marketplace. We do not sell platform data, use it for advertising, build profiles of the people who interact with you, or share it with anyone outside the purposes in this policy.

How we use data

• To run the service: publish and schedule your posts, show your inbox, calendar and analytics, and run approvals.
• To run the creator marketplace: show approved creator profiles to brands, match briefs, hold and release escrow, and measure campaign results.
• To send emails you need: sign-in, invitations, approvals, failed posts and marketplace notices.
• To keep the service secure, prevent abuse and fix problems.
• To meet legal obligations such as bookkeeping for payments.

We do not use your content or your connected accounts' data to train AI models, and we make no automated decisions with legal effect on you.

Legal bases

Under the EU General Data Protection Regulation (GDPR) we rely on:

• Contract: to provide the service you or your company signed up for.
• Consent: to connect each social account. You can withdraw it by disconnecting the account.
• Legitimate interest: to secure the service, prevent fraud and improve it.
• Legal obligation: to keep accounting records for payments and payouts.

Where your data lives

Our servers are located in Europe, and we handle all data according to European law.

How long we keep it

• Connected accounts: until you disconnect them. Disconnecting deletes the access tokens, the inbox messages and analytics we hold for that account, and posts that only targeted that account.
• Your Codyn Reach account and workspace content: while your account is active. When you ask us to delete your account we delete it within 30 days.
• Payment and payout records: 7 years, as Swedish bookkeeping law requires.
• Logs and backups: up to 30 days, then overwritten.

Deleting your data

You can delete data yourself by disconnecting an account in Settings › Social accounts, by removing Codyn Reach from your Facebook or Instagram settings, or by emailing us. Every option is explained on our data deletion page, where you can also check the status of a request.

Your rights

You have the right to access, correct, delete, restrict and export your personal data, and to object to processing based on legitimate interest. Email hello@codyn.se and we will answer within 30 days. If your data sits in a company's workspace, we may forward your request to that company.

You can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.

Cookies

We only use cookies that are needed for the service to work: a session cookie to keep you signed in and a security cookie that protects forms. We do not use advertising or third party tracking cookies.

Security

Traffic is encrypted with HTTPS, access tokens are encrypted in the database, passwords are hashed, and access to production systems is limited to the people who run the service. If a breach affects your personal data, we will tell you and the authorities as the law requires.

Age limit

Codyn Reach is a business service. You must be at least 18 years old to use it or to apply as a creator.

Changes and contact

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top shows the latest version.

Atlas Lejon AB (Codyn), Sweden. Email hello@codyn.se.