eignaPost privacy policy

Effective from 1 September 2026. Last updated 4 September 2026.

1. About us

OT AI ehf., Icelandic company registration no. 671113-1520, Bæjarhrauni 10, 220 Hafnarfjörður, Iceland.

References to “OT AI” in this document mean OT AI ehf.

Privacy enquiries: personuvernd@otai.is

This policy applies to eignaPost, a digital worker operated by OT AI that publishes content on Facebook and Instagram on behalf of customers. It does not apply to other OT AI services.

2. Who uses eignaPost

eignaPost is a service for businesses. Its users are employees of businesses that enter into an agreement with OT AI. The service is not intended for individuals acting in a personal capacity or for anyone under 18.

For personal data that a customer sends to us, the customer is the controller and OT AI is the processor. OT AI is the controller for data it collects for its own purposes, such as correspondence with customer contacts.

3. What data we collect

3.1 Data received by email from a customer

The customer sends an email to a dedicated email address provided by OT AI. We store the following information from that email:

• The sender’s email address and name.
• The subject line and body of the email.
• Images attached to the email.
• A link to a listing on a third-party website, if included in the email.
• Facts extracted from the text, such as the property’s address, price, size, number of rooms, features and open house date and time.

3.2 Staff directory

The customer provides us in advance with a list of employees who are authorised to submit content. For each employee, we store their name, job title, email address, telephone number and profile photograph. This information appears in the advertisement itself.

3.3 Data from Meta

When a customer connects their Facebook and Instagram accounts to eignaPost, they grant us specific permissions. These permissions give us access to:

• A list of the Facebook Pages they manage, including each Page’s ID and name (pages_show_list).
• An access token for the Pages they select and permission to publish posts on those Pages (pages_manage_posts).
• Aggregate engagement metrics for the posts we publish: impressions, reactions, comments and shares (pages_read_engagement).
• The ID and username of the Instagram professional account connected to the Page (instagram_basic).
• Permission to publish to that Instagram account (instagram_content_publish).
• Connections between the customer’s accounts in Meta Business Manager, so we can verify that they own the Page on which content is published (business_management).

We do not retrieve personal data about people who view, like or comment on posts. We only see aggregate metrics. We do not read private messages or request permission to do so.

3.4 Technical data

We record timestamps, task statuses and error messages so we can operate the service and diagnose faults. Email content, images and access tokens are never written to error logs.

4. How we use the data

We use the data solely to provide the service agreed with the customer:

• To prepare draft posts for Facebook and Instagram.
• To send the customer an email through which they can approve or reject a draft.
• To publish approved posts to Facebook and Instagram accounts owned by the customer.
• To display post statuses in the customer’s dashboard.
• To identify and fix errors in the service.

The legal basis for OT AI’s processing of data for its own purposes, such as contact details and billing, is the performance of a contract with the customer under Article 6(1)(b) of Regulation (EU) 2016/679. Data supplied by the customer is processed under a data processing agreement between the parties and in accordance with the customer’s instructions. The customer is responsible for ensuring that the processing is lawful in relation to the data subjects.

5. What we do not do

• We do not sell or trade any data.
• We do not use customer content or data from Meta to train AI models.
• We do not use the data to market other products.
• We do not share data from Meta with anyone other than the service providers listed in section 6.
• We do not transfer data between customers. Each customer can only see their own data.

6. Who we share data with

We share data with the following service providers, in each case solely to operate the service. Each provider is bound by a data processing agreement with OT AI.

Some of these providers process data outside the European Economic Area, including in the United States. In these cases, the transfer is based on a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or the Commission’s standard contractual clauses.

We do not disclose data to public authorities unless required by law.

7. How long we retain data

Accounting and billing records are retained for seven years in accordance with Icelandic Act No. 145/1994 on Accounting. They are not subject to deletion under section 8.

Once the retention period has ended, we permanently delete the data from active systems and remove it from backups during the next regular backup cycle, no later than 30 days afterwards.

8. How to request data deletion

You can request the deletion of all data relating to you or your business, wherever you live. This right is not limited to a particular country or legal framework. You do not need to log in or obtain our approval.

To make a request:

1. Email personuvernd@otai.is with the subject line “Eyðing gagna” (Data deletion).
2. Include the email address you used to submit content or the name of the Facebook Page concerned.
3. We acknowledge receipt within five working days.
4. We delete the data within 30 days of that acknowledgement and send you written confirmation when this is complete.

We delete all drafts, property facts, images, staff directory information, Meta access tokens and the connection itself.

You can also disconnect the service yourself at any time. In Meta Business Manager, select Business settings → Apps, find OT AI and remove the app. This immediately revokes our access. Then email us using the steps above to request deletion of the remaining data.

Further instructions are available at eignapost.is/data-deletion.

9. Your rights

You have the right to access, correct and delete data about you, to restrict its processing, to data portability and to object to its processing. We extend these rights to all users, regardless of where they live.

Send your request to personuvernd@otai.is. We respond within 30 days.

You can also lodge a complaint with Persónuvernd, the Icelandic Data Protection Authority, at personuvernd.is.

10. Security

Data is encrypted in transit and at rest. Staff access is limited to those who need it. Meta access tokens are stored in encrypted form and are never written into code, files or error logs.

11. Changes to this policy

If we change this policy, we notify you by email 30 days in advance.

12. Contact

OT AI ehf. · personuvernd@otai.is · Bæjarhrauni 10, 220 Hafnarfjörður