Privacy Policy

Last updated: 31 October 2026

This Privacy Policy explains how NMJ Service Oy ("we", "us", "our") collects, uses and protects personal data in Medialento (the "Service"), our social media publishing tool. We are the data controller and process personal data in line with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.

The Service is used to publish our own content (Tietokettu, NMJ Service and Medialento) to TikTok, YouTube, Instagram, Facebook and LinkedIn.

1. Data we collect

Account and login data. Name, email address and password of the authorised users of the Service. Passwords are stored only as salted hashes.

Content. Videos, images, captions and scheduling details that you upload to the Service for publishing.

Technical data. Server logs such as IP address, time of request and error messages, used for operation, security and troubleshooting.

Data from connected platforms. When you connect a social media account, we receive only the data that the platform shares with your permission, as described below. We do not collect data about your followers or viewers, and we do not read private messages.

2. TikTok

We use TikTok Login Kit and the TikTok Content Posting API (Direct Post) with these scopes:

user.info.basic: open ID, display name and avatar, to identify the connected account in the Service;
user.info.profile: username and profile link, to show which account content will be posted to;
video.upload and video.publish: to upload videos and publish them to the connected TikTok account when you schedule or post them.

We also store the access and refresh tokens TikTok issues, the scopes granted, and the IDs and status of posts published through the Service. Your use of TikTok is also governed by the TikTok Privacy Policy.

You can revoke access in the TikTok app under Settings and privacy > Security > Manage app permissions.

3. YouTube (Google)

When you connect a YouTube channel, we receive the channel ID, channel name and avatar, the scopes granted, and OAuth access and refresh tokens. We use these only to upload videos to your channel and show the status of those uploads.

Medialento uses YouTube API Services. By using the Service with YouTube you agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.

Medialento's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke the Service's access to your Google account at any time at https://myaccount.google.com/permissions.

4. Instagram and Facebook (Meta)

When you connect a Facebook Page or an Instagram professional account, we receive the user, Page and Instagram account IDs, names and profile pictures, the scopes granted, and the access tokens needed to publish posts. We use them only to publish content and show its status. Meta's handling of data is described in the Meta Privacy Policy.

You can remove access in Facebook under Settings and privacy > Settings > Business integrations, or in Instagram under Settings > Apps and websites.

5. LinkedIn

When you connect a LinkedIn profile or company page, we receive the member or organisation ID, name and profile picture, the scopes granted, and the access tokens needed to publish posts. We use them only to publish content and show its status. LinkedIn's handling of data is described in the LinkedIn Privacy Policy.

You can remove access in LinkedIn under Settings > Data privacy > Permitted services.

6. How we use the data

We use personal data only to:

let you sign in and use the Service;
connect to your social media accounts and publish the content you schedule;
show you the status of your posts;
keep the Service secure and fix problems.

We do not sell personal data, use it or your connected-platform content for advertising, or use it to build profiles of individuals. Once content reaches a platform, that platform's own privacy policy governs what it does next.

7. Legal basis

We process personal data because it is necessary to provide the Service you have requested (performance of a contract), on your consent when you connect a social media account, and on our legitimate interest in keeping the Service secure.

8. Where data is stored and who processes it

All data is stored in a PostgreSQL database on a server owned and operated by NMJ Service Oy in Finland. Connections from your browser to the Service and from the Service to the platforms are encrypted (TLS). The Service is reached over a Cloudflare Tunnel, so Cloudflare, Inc. acts as our network processor and passes traffic between your browser and our server. Access to the server is limited to authorised persons.

We share data only with:

the platforms you choose to publish to (TikTok, YouTube, Instagram, Facebook, LinkedIn), to carry out your publishing requests;
Cloudflare, as our network provider;
authorities, when required by law.

Cloudflare and the connected platforms may process data outside the EU/EEA. Where that happens, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

9. Retention

Access and refresh tokens and connected account data are deleted when you disconnect the account, and are no longer used.
Uploaded content is kept for as long as you keep it in the Service; you can delete it at any time.
Database backups are kept for 14 days, so deleted data is fully removed from backups within 14 days.
Server logs are kept only as long as needed for operation and security.

10. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have incorrect data corrected;
have your data deleted;
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time, for example by disconnecting an account.

To use your rights, contact us at the address below. We answer within 30 days and may need to verify your identity first. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

11. Children

The Service is for business use, is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy. The "Last updated" date above shows when it last changed.

13. Contact

NMJ Service Oy
Heinäjoentie 481, 14200 Turenki, Finland
Email: nico.lietsa@nmjservice.fi