Privacy Policy

Table of contents

This is some text inside of a div block.

Last updated: September 29, 2026

This Privacy Policy explains how ZoomSphere collects, uses, shares and protects personal information when you use our website at zoomsphere.com, the ZoomSphere web and mobile applications, our browser extensions, the ZoomSphere MCP server and any other services we provide (together, the "Service"). It also explains your rights and how to contact us.

When our business customers (for example agencies and brands) use the Service, we also process personal information on their behalf as a data processor. In that case the customer is the controller, and you should refer to their privacy policy for how they handle your data.

Use of the Service is also subject to our Terms of Service. Terms not defined here have the meaning given in the Terms of Service.

1. Who we are

The Service is operated by MicroMedia s.r.o., Belgická 196/38, 120 00 Praha 2, Vinohrady, Czech Republic, VAT ID CZ27437973 ("ZoomSphere", "we", "us"). MicroMedia s.r.o. is the controller of the personal information described in this policy, except where we act as a processor for our customers as explained above.

You can reach us about anything in this policy at info@zoomsphere.com.

2. Summary

We collect the information needed to run your account, publish and analyze your social media content, bill you and support you.
We do not sell personal information and we do not use your content or social media data to train AI models.
If you connect ZoomSphere to an AI assistant such as Claude or ChatGPT through our MCP server, the assistant can only see the workspaces and channels your ZoomSphere user can see, and only after you sign in and approve access.
Data from your connected social media accounts is used only to provide the Service to you and is shared only at your direction.
We delete account data within 30 days after your account is closed and remove it from backups within 90 days, except where the law requires us to keep it longer.
You can access, correct, export or delete your data and revoke any connection at any time.

3. Information we collect

3.1 Information you provide

Account and registration: name, email address, phone number, user name, password, country, city, time zone, language and company details.
Content you create: posts, drafts, captions, media files, comments, notes, ideas, approval decisions and other content you upload or create in the Service, including content created on your behalf by an AI assistant you connected.
Team and client information: names and email addresses of teammates, clients and approvers you invite.
Payments: billing name, billing address, VAT ID and payment details. Card payments are handled by our payment provider; we do not store full card numbers.
Support and communication: the content of messages you send to our support team, in our in-app chat, by email or in our community channels.
Business relationships: contact details of people at our customers, vendors and partners.

3.2 Information from connected social media accounts

When you connect a social media account or page to ZoomSphere, we receive information from that platform through its official API, to the extent you authorize it and the platform allows it. Depending on the platform this includes:

profile or page name, user name, profile or page ID and profile image;
access tokens that let us act on your behalf;
posts, videos and other content published through ZoomSphere or already on the account;
engagement and performance data such as impressions, reach, views, clicks, likes, comments, replies, shares, reposts and follower counts;
aggregated audience insights and demographic data where the platform provides them.

We currently support Facebook, Instagram, Threads, LinkedIn, X (Twitter), TikTok, YouTube and Google Business Profile. This data is used only to provide the Service to you, is never sold, and is shared with third parties only as described in section 6 or at your direction.

Google and YouTube: ZoomSphere's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See also the Google Privacy Policy. You can revoke ZoomSphere's access at any time at myaccount.google.com/permissions.

You can disconnect any social media account in ZoomSphere at any time, or revoke our access directly in the settings of the social platform.

3.3 Information collected automatically

Log and device data: IP address, browser and device type, operating system, pages visited, referring page, dates and times of access and error reports.
Usage data: which features you use and how, so we can operate, secure and improve the Service.
Cookies and similar technologies: see section 12 and our Cookies Policy.
Email interaction: whether you opened or clicked our emails, where permitted by law.

4. AI assistants and the ZoomSphere MCP server

ZoomSphere offers a Model Context Protocol (MCP) server at https://mcp.zoomsphere.com/mcp that lets you connect AI assistants and agents you choose, such as Claude, ChatGPT, Grok, Cursor or a local model, to your ZoomSphere account. This section explains how personal information is handled when you do.

4.1 How access works

You connect an AI assistant by signing in to ZoomSphere through OAuth 2.0 and approving access. We never see or store your password for the AI assistant, and the AI assistant never receives your ZoomSphere password.
The AI assistant receives an access token scoped to your ZoomSphere user. It can only see and act on the workspaces, channels, posts, ideas and analytics that your ZoomSphere user can already access, with the same permissions.
Content created through the MCP server is saved in the status you or the assistant choose. We recommend saving AI-created content as drafts and keeping your approval workflow in place.

4.2 What data flows through the MCP server

When your AI assistant calls a ZoomSphere tool, we process the request and return the result. Depending on the tool, results can include workspace and channel names, scheduling settings, post content and media, post statuses, ideas and analytics for your channels. Requests can include the post text, media, schedule and other content the assistant sends to be saved in ZoomSphere.

We only receive what the assistant sends in the tool call. We do not receive your conversation with the AI assistant, its memory, your chat history or files you did not choose to send to ZoomSphere.

4.3 Your AI provider

Data that ZoomSphere returns to your AI assistant is received and processed by the provider of that assistant (for example Anthropic, OpenAI or xAI) under that provider's own terms and privacy policy, and not under this policy. You choose which provider to connect and are responsible for your use of it. We do not control how the provider stores or uses that data, so please review its privacy settings, especially whether your conversations may be used to train its models.

ZoomSphere does not send your data to any AI provider unless you or your team connect one. We do not pay for, operate or see the AI model you use.

4.4 MCP logs and retention

For security, abuse prevention, billing and troubleshooting we keep technical logs of MCP requests: the tool called, time, user, workspace and client identifiers, result status and error messages. We do not store the content of your AI conversations. MCP technical logs are deleted after 30 days. Content you save in ZoomSphere through the MCP server (for example a post or an idea) is kept like any other content in your account.

4.5 Disconnecting

You can disconnect an AI assistant at any time in the connector settings of the assistant. You can also contact us to revoke all MCP access tokens for your user. Once revoked, the assistant can no longer read or change anything in your ZoomSphere account.

5. How we use personal information and our legal bases

We use personal information for the following purposes. Where the GDPR applies, the legal basis is shown in brackets.

To create and manage your account, provide the Service, publish your content, show your analytics and run the MCP server (performance of a contract).
To authenticate users, including two-factor authentication and OAuth connections (performance of a contract; legitimate interest in security).
To process payments, issue invoices and keep accounting records (performance of a contract; legal obligation).
To provide customer support and send service messages about your account, security, billing and system maintenance (performance of a contract).
To secure the Service, prevent fraud and abuse, debug errors and monitor performance (legitimate interest).
To understand how the Service is used and improve it, using aggregated or de-identified data where possible (legitimate interest).
To send newsletters and marketing about ZoomSphere and to show ZoomSphere ads, for example through Google Ads or Meta Ads (consent where required by law, otherwise legitimate interest; you can opt out at any time).
To manage relationships with customers, vendors and partners (legitimate interest).
To comply with the law, respond to lawful requests and enforce our agreements (legal obligation; legitimate interest).

We do not use your content, your connected social media data or data accessed through the MCP server to train artificial intelligence models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

6. How we share personal information

We do not sell or rent personal information. We share it only as follows:

At your direction: with the social networks you publish to, with teammates, clients and approvers you invite, and with the AI assistant you connect through the MCP server (see section 4).
Service providers: companies that help us run the Service, such as cloud hosting and storage, email delivery, customer support and chat, payment processing and billing, error and performance monitoring, and analytics. They may use personal information only to provide their services to us, under a written data processing agreement.
Our affiliates: companies in our group, for the purposes described in this policy.
Legal and safety: authorities or other parties where required by law, or where necessary to protect the rights, property or safety of ZoomSphere, our users or the public.
Business transfers: a buyer or successor in a merger, acquisition, reorganization or sale of assets. We will notify you before your data becomes subject to a materially different privacy policy.

We may share aggregated or de-identified information that cannot reasonably identify you.

A list of our main sub-processors is available on request at info@zoomsphere.com.

7. How long we keep personal information

Account data and content: for as long as your account is active. After you close your account or your subscription ends, we delete it within 30 days, and it is removed from our backups within 90 days.
Connected social media data and access tokens: until you disconnect the account or close your ZoomSphere account. Access tokens are deleted when you disconnect.
MCP technical logs: 30 days.
Other server and security logs: up to 90 days, unless needed longer to investigate a specific security incident.
Invoices and accounting records: for the period required by Czech tax and accounting law, currently up to 10 years.
Support conversations: for as long as your account is active and up to 30 days after it is closed.
Marketing data: until you unsubscribe or withdraw consent.

We may keep information longer where needed to establish, exercise or defend legal claims.

8. How we protect personal information

We use administrative, technical and organizational measures designed to protect personal information against loss, misuse and unauthorized access, disclosure, alteration or destruction. These include:

encryption of data in transit with HTTPS/TLS;
OAuth 2.0 with PKCE for third-party connections, including the MCP server, so passwords are never shared with other apps;
role-based access control that mirrors the permissions set in your workspaces;
optional two-factor authentication for user accounts;
restricted internal access to personal information on a need-to-know basis.

No security measure is perfect. If a personal data breach affects you, we will notify you and the competent authorities as required by applicable law.

9. International data transfers

ZoomSphere is based in the Czech Republic, in the European Economic Area (EEA). Some of our service providers process personal information outside the EEA, the United Kingdom or Switzerland, including in the United States. When we transfer personal information to countries that do not provide an adequate level of protection, we rely on the EU-U.S. Data Privacy Framework and its UK Extension and Swiss-U.S. counterpart where the recipient is certified, on the European Commission's Standard Contractual Clauses, or on another safeguard permitted by law.

When you connect an AI assistant through the MCP server, the transfer of data to your AI provider happens at your direction and under that provider's terms (see section 4.3).

10. Your rights and choices

Depending on where you live, you have the right to:

access the personal information we hold about you and receive a copy;
correct inaccurate or incomplete information;
delete your information;
restrict or object to certain processing, including processing based on legitimate interest and direct marketing;
receive your information in a portable format;
withdraw consent at any time, without affecting processing that took place before;
lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (uoou.gov.cz).

To exercise these rights, email us at info@zoomsphere.com. We will respond within one month. We may need to verify your identity first.

You can also control your data directly: edit your profile in account settings, disconnect social media accounts, disconnect AI assistants in their connector settings, unsubscribe from marketing emails with the link in any email, and manage cookies through the cookie banner. Even if you opt out of marketing, we will still send you essential service messages.

If you use ZoomSphere as a member of a customer's workspace, some requests may need to go to that customer as the controller. We will help them respond.

11. Children's privacy

The Service is not directed to anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at info@zoomsphere.com and we will delete it.

12. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, understand how our website and Service are used and measure our marketing. Non-essential cookies are used only with your consent where the law requires it. Our website may include content, buttons or pixels from third parties such as social networks and advertising platforms, which may collect information directly under their own policies. Details and choices are in our Cookies Policy.

13. Links to other websites

The Service contains links to websites and services we do not operate, including social networks and AI assistants. Their privacy practices are governed by their own policies, and we encourage you to read them.

14. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the "Last updated" date. If the changes materially affect your rights, we will also notify you in advance by email or in the app.

15. Contact us

If you have questions about this policy or want to exercise your rights, contact us at:

MicroMedia s.r.o. (ZoomSphere)
Belgická 196/38
120 00 Praha 2, Vinohrady
Czech Republic
VAT ID: CZ27437973
Email: info@zoomsphere.com

For help with the MCP server, see our MCP page and Help Center.