Privacy Policy

Merkflow is an AI-powered social media management platform operated by Niels van Haren Holding B.V. (trading as Merkflow), a company registered in the Netherlands (Chamber of Commerce: 73338397).

For the purposes of the General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.

We collect only the data necessary to provide the Merkflow service.

We do not collect special categories of personal data (Article 9 GDPR) such as health, religion, or biometric data.

Under GDPR Article 6, we rely on the following legal bases:

We share data with the following sub-processors to deliver the service. We have a Data Processing Agreement (DPA) with each.

We keep your data for as long as necessary to provide the service or meet legal obligations.

When you delete your account, all personal data is permanently erased within 30 days of the deletion request. A confirmation email will be sent when deletion is complete.

As a data subject under the GDPR, you have the following rights. These can be exercised free of charge and we will respond within 30 days.

To exercise any of these rights, or to download or delete your data directly, log in to your account and go to Settings → Privacy & Data, or email us at support@merkflow.eu.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

We use a small set of cookies. Strictly necessary and functional cookies are always active because the service cannot work without them. Analytics cookies are only set if you accept them via our cookie banner — we use no advertising cookies or tracking pixels.

Your choice. Google Analytics loads with Google Consent Mode v2 and storage denied by default — no analytics cookies are placed until you click “Accept” on the cookie banner shown on your first visit. If you decline, no analytics cookies are set. You can change or withdraw your choice at any time via the “Cookie settings” link in the website footer.

Google Analytics is provided by Google Ireland Ltd. / Google LLC (United States), acting as a processor on our behalf. GA4 does not store full IP addresses. See “Third parties we work with” and “International data transfers” below for the safeguards that apply to this transfer.

Encryption at rest: All OAuth access tokens and refresh tokens are encrypted using AES-256-GCM before being stored in the database. The encryption key never leaves the application layer.

Encryption in transit: All data is transmitted over HTTPS/TLS. Unencrypted connections are rejected.

Infrastructure: The platform runs on Hetzner servers in Germany (EU). No personal data is stored outside the EU by default.

Password security: Passwords (for email/password accounts) are hashed using a one-way algorithm (bcrypt/argon2) and are never stored in readable form — not even by us.

Access control: Access to production systems is restricted to authorised personnel via key-based authentication.

Incident response: In the event of a personal data breach, we will notify the Autoriteit Persoonsgegevens within 72 hours and affected users without undue delay, as required by GDPR Article 33–34.

Our infrastructure is hosted in Germany (EU). However, some of our sub-processors are based in the United States. We ensure adequate protection for these transfers through:

Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914) are in place with all US-based sub-processors, including Anthropic, Meta, LinkedIn, Google, and fal.ai.

These transfers are made in accordance with GDPR Chapter V and the Schrems II ruling requirements, including a Transfer Impact Assessment (TIA) where appropriate.

LinkedIn data: We access your LinkedIn profile, organisation pages, and post analytics solely to provide the Merkflow service — not for advertising, sales, or recruiting. We comply with the LinkedIn API Terms of Use and the LinkedIn Privacy Policy, including their data-storage limits. In line with those limits we retain LinkedIn member data only for the minimum necessary period: a member’s comment or mention content for at most 48 hours, a member’s display name for at most 24 hours, synced organisation-page post content for at most 6 months, and aggregate page statistics for at most 12 months. We keep the underlying reference IDs (URNs) but not the content beyond these windows. When content is deleted or changed on LinkedIn (or another connected platform), we delete or update our copy within 24 hours. LinkedIn member data is never used for advertising, re-sold, exported, or shared with third parties beyond the processors listed in Section 5 — other people’s comments and likes are shown to you in-app only.

Meta (Facebook & Instagram) data: We access your Facebook Pages, Instagram Professional accounts, and post metrics solely to publish content and display analytics within Merkflow. We comply with Meta’s Platform Policy and Data Policy. Meta user data is not used for advertising, profiling, or any purpose beyond the stated service.

Data deletion callback: Meta requires that we provide a mechanism for users to request deletion of data associated with their Facebook login. You can request deletion of all your Merkflow data (including any data obtained via Facebook) by:

1. Visiting Settings → Privacy & Data → Delete Account in your Merkflow dashboard, or
2. Emailing support@merkflow.eu with the subject line “Data Deletion Request”, or
3. Removing Merkflow from your Facebook app settings at facebook.com/settings, which triggers an automatic deletion request.

Upon receiving a deletion request through any of the above channels, all data associated with your account will be permanently deleted within 30 days. You will receive a confirmation email when deletion is complete.

Merkflow is a professional B2B platform intended for adults. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has created an account, please contact us at support@merkflow.eu and we will delete the account promptly.

We may update this privacy policy from time to time. For any material changes — changes that meaningfully affect your rights or how we use your data — we will notify you by email at least 14 days before the change takes effect.

The “Last updated” date at the top of this policy reflects the most recent revision. The current version is always available at https://www.merkflow.eu/privacy-policy/.

Continued use of Merkflow after a change takes effect constitutes acceptance of the updated policy, where permitted by law.

If you have questions about this privacy policy, want to exercise your data rights, or have a complaint, please contact us:

We aim to respond to all privacy-related requests within 30 days in accordance with GDPR Article 12(3). If your request is complex or numerous, we may extend this by a further two months and will inform you accordingly.