Privacy Policy

Merkflow is an AI-powered social media management platform operated by Niels van Haren Holding B.V. (trading as Merkflow), a company registered in the Netherlands (Chamber of Commerce: 73338397).

For the purposes of the General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.

We collect only the data necessary to provide the Merkflow service.

We do not collect special categories of personal data (Article 9 GDPR) such as health, religion, or biometric data.

Under GDPR Article 6, we rely on the following legal bases:

We share data with the following sub-processors to deliver the service. We have a Data Processing Agreement (DPA) with each.

We keep your data for as long as necessary to provide the service or meet legal obligations.

When you delete your account, all personal data is permanently erased within 30 days of the deletion request. A confirmation email will be sent when deletion is complete.

As a data subject under the GDPR, you have the following rights. These can be exercised free of charge and we will respond within 30 days.

To exercise any of these rights, or to download or delete your data directly, log in to your account and go to Settings → Privacy & Data, or email us at support@merkflow.eu.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

We use a minimal set of cookies required to operate the service. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Because we use only strictly necessary and functional cookies, no consent banner is required under the Dutch Telecommunications Act (Telecommunicatiewet) and the ePrivacy Directive.

Encryption at rest: All OAuth access tokens and refresh tokens are encrypted using AES-256-GCM before being stored in the database. The encryption key never leaves the application layer.

Encryption in transit: All data is transmitted over HTTPS/TLS. Unencrypted connections are rejected.

Infrastructure: The platform runs on Hetzner servers in Germany (EU). No personal data is stored outside the EU by default.

Password security: Passwords (for email/password accounts) are hashed using a one-way algorithm (bcrypt/argon2) and are never stored in readable form — not even by us.

Access control: Access to production systems is restricted to authorised personnel via key-based authentication.

Incident response: In the event of a personal data breach, we will notify the Autoriteit Persoonsgegevens within 72 hours and affected users without undue delay, as required by GDPR Article 33–34.

Our infrastructure is hosted in Germany (EU). However, some of our sub-processors are based in the United States. We ensure adequate protection for these transfers through:

Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914) are in place with all US-based sub-processors, including Anthropic, Meta, LinkedIn, Google, and fal.ai.

These transfers are made in accordance with GDPR Chapter V and the Schrems II ruling requirements, including a Transfer Impact Assessment (TIA) where appropriate.

LinkedIn data: We access your LinkedIn profile, organisation pages, and post analytics solely to provide the Merkflow service. We do not store LinkedIn member data beyond what is necessary for the service. We comply with the LinkedIn API Terms of Use and the LinkedIn Privacy Policy. LinkedIn member data is not used for advertising, re-sold, or shared with third parties beyond the processors listed in Section 5.

Meta (Facebook & Instagram) data: We access your Facebook Pages, Instagram Professional accounts, and post metrics solely to publish content and display analytics within Merkflow. We comply with Meta’s Platform Policy and Data Policy. Meta user data is not used for advertising, profiling, or any purpose beyond the stated service.

Data deletion callback: Meta requires that we provide a mechanism for users to request deletion of data associated with their Facebook login. You can request deletion of all your Merkflow data (including any data obtained via Facebook) by:

1. Visiting Settings → Privacy & Data → Delete Account in your Merkflow dashboard, or
2. Emailing support@merkflow.eu with the subject line “Data Deletion Request”, or
3. Removing Merkflow from your Facebook app settings at facebook.com/settings, which triggers an automatic deletion request.

Upon receiving a deletion request through any of the above channels, all data associated with your account will be permanently deleted within 30 days. You will receive a confirmation email when deletion is complete.

Merkflow is a professional B2B platform intended for adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has created an account, please contact us at support@merkflow.eu and we will delete the account promptly.

We may update this privacy policy from time to time. For any material changes — changes that meaningfully affect your rights or how we use your data — we will notify you by email at least 14 days before the change takes effect.

The “Last updated” date at the top of this policy reflects the most recent revision. The current version is always available at https://www.merkflow.eu/privacy-policy/.

Continued use of Merkflow after a change takes effect constitutes acceptance of the updated policy, where permitted by law.

If you have questions about this privacy policy, want to exercise your data rights, or have a complaint, please contact us:

We aim to respond to all privacy-related requests within 30 days in accordance with GDPR Article 12(3). If your request is complex or numerous, we may extend this by a further two months and will inform you accordingly.