Terms of Service Postiz

1. Operator and contact

These terms govern access to and use of the self-hosted Postiz instance available at
https://postiz.base.the-corona.net
(the “Service”).

The Service is operated by xFHEngineering, represented by
Max Becker (the “Operator”, “we”, “us” or “our”).

Questions concerning the Service or these terms may be sent to
hermine@the-corona.net.

2. Scope and internal-use status

1. The Service is provided solely for the Operator’s own company, organisational and
   internal business purposes. It is not offered to the general public.
2. Registration is not public. Only personnel, contractors, collaborators or other
   persons expressly invited or authorised by the Operator (“Authorised Users”) may
   access or use the Service.
3. The Service is not a consumer offering, paid subscription service, public hosting
   service or service for external clients. No right to register, obtain an account or
   continue using the Service arises merely because the Service is reachable over the
   internet.
4. This Service is a separately operated, self-hosted installation. It is not the
   Postiz.com or Gitroom hosted service, and the Operator does not act on behalf of the
   providers of those services.
5. These terms supplement any applicable employment, contractor, confidentiality,
   information-security or internal-use policies. If a mandatory contractual or legal
   provision conflicts with these terms, that provision prevails to the extent of the
   conflict.

3. Acceptance and authority

1. By accessing or using the Service, an Authorised User agrees to comply with these
   terms and confirms that they are acting within the scope of the authority granted by
   the Operator and, where relevant, by the organisation or account owner they represent.
2. A person who has not been authorised must not access, attempt to access or use the
   Service. Accidental or unauthorised access must be reported promptly to the Operator.
3. These terms regulate use of an internal technical facility. They do not create an
   employment relationship, alter an existing employment or contractor relationship, or
   grant any right to remuneration, continued access or future functionality.

4. Accounts and access credentials

1. Accounts are personal unless the Operator expressly designates an account as shared
   or functional. Users must provide accurate account information and keep it reasonably
   current.
2. Credentials, access links, recovery codes and authenticated sessions must be kept
   confidential and must not be transferred, disclosed or made available to unauthorised
   persons.
3. Users must employ reasonable security measures, including strong unique passwords and
   multi-factor authentication where available or required.
4. Users remain responsible for activity conducted through their accounts to the extent
   that the activity results from their intentional conduct or failure to exercise
   reasonable care.
5. Suspected credential compromise, unauthorised access, unintended publication or other
   security incidents must be reported immediately to
   hermine@the-corona.net. Where reasonably
   possible, the affected user must also revoke compromised sessions or third-party
   authorisations.
6. The Operator may impose access controls, require credentials to be reset, limit
   permissions or deactivate dormant or unnecessary accounts.

5. Permitted use

Authorised Users may use the Service only for legitimate activities connected with the
Operator’s authorised communications, social-media management and related internal
workflows. Users must follow all applicable laws, internal instructions, approval
processes, brand rules and the terms of each connected third-party platform.

Access to publishing, scheduling, analytics or account-management functions does not by
itself constitute approval to publish particular content. Users must obtain all
organisational, editorial, legal or client approvals required for their activities.

6. Acceptable-use requirements

Users must not use the Service to:

• commit, facilitate or encourage unlawful, fraudulent or deceptive conduct;
• publish or process content that is defamatory, threatening, unlawfully discriminatory,
  harassing, obscene or otherwise unlawful;
• infringe copyrights, trade marks, privacy rights, publicity rights, trade secrets or
  other rights of any person or organisation;
• send spam, conduct unauthorised advertising, manipulate engagement or perform
  prohibited automated activity;
• impersonate another person or organisation, misrepresent affiliation or publish
  misleading claims about identity, authority or endorsement;
• upload malware, exploit code or other material intended to damage, disrupt, monitor or
  gain unauthorised access to systems or data;
• probe, scan, circumvent or interfere with authentication, access restrictions, rate
  limits or security mechanisms, except as expressly authorised for security testing;
• scrape, harvest or process personal data without an appropriate legal basis and
  authorisation;
• disclose confidential information, credentials, personal data or internal material
  without permission; or
• use connected platforms in breach of their applicable rules, developer policies or
  technical restrictions.

Users must exercise particular care with scheduled posts, bulk actions, automated
functions and AI-assisted content. Before publication, users must review outputs for
accuracy, legality, confidentiality, appropriate tone and required approvals.

7. Content, ownership and permissions

1. These terms do not transfer ownership of content uploaded, drafted, scheduled,
   published or otherwise processed through the Service (“User Content”).
2. Rights in User Content remain with the applicable rights holder, which may be the
   Operator, an affiliated organisation, an employee’s employer, a client, the individual
   creator or another third party, depending on the circumstances and applicable
   agreements.
3. Each user must ensure that they are authorised to use, edit, reproduce, store,
   schedule, transmit and publish User Content and that all necessary licences, releases,
   consents and approvals have been obtained.
4. To the extent necessary to operate the Service, the user permits the Operator to host,
   copy, technically modify, transmit and otherwise process User Content. This permission
   is limited to operating, securing, maintaining and administering the Service and does
   not transfer ownership to the Operator.
5. The Operator may remove, restrict or preserve User Content where reasonably necessary
   to comply with law, protect rights or security, investigate an incident, enforce these
   terms or maintain the Service.
6. Users are responsible for checking the final content, intended audience, connected
   account, scheduled time and publication status. The Service must not be treated as the
   sole archive or authoritative copy of important material.

8. Third-party platforms, integrations and OAuth

1. The Service may connect to social networks, media services, identity providers and
   other third-party systems (“Third-Party Platforms”). Those platforms are independent
   of the Operator and are governed by their own terms, privacy notices and technical
   rules.
2. Users may connect only accounts that they own or are expressly authorised to manage.
   They must select only permissions reasonably required for the authorised purpose.
3. Connecting an account may grant the Service access to account information and the
   ability to perform actions such as reading profile information, uploading media or
   publishing and deleting posts. Users must understand and approve the permissions shown
   by the relevant Third-Party Platform before completing an authorisation.
4. Users must promptly revoke access when it is no longer required, when their authority
   ends or when compromise is suspected. Revocation may be available through the
   Third-Party Platform as well as through the Service.
5. The Operator does not control Third-Party Platforms and is not responsible for their
   availability, moderation decisions, policy changes, data handling, API limitations,
   account restrictions or removal of published content.
6. Features may stop working if a Third-Party Platform changes or withdraws its API,
   permissions, authentication process, quotas or terms. The Operator does not guarantee
   that any particular integration will remain available.

9. Privacy and data deletion

1. Information about the Operator’s processing of personal data in connection with the
   Service is provided in the
   Postiz Privacy Policy.
2. Instructions for disconnecting integrations and requesting or carrying out deletion
   are available in the
   User Data Deletion Instructions.
3. Users must process personal data through the Service only when authorised, necessary
   for an approved purpose and consistent with applicable data-protection law and
   internal policies.
4. Users must not upload special-category, highly sensitive or unrelated personal data
   unless the Operator has expressly approved that processing and suitable safeguards
   are in place.
5. Requests concerning access, correction, deletion, restriction or other data-protection
   matters may be sent to
   hermine@the-corona.net.

10. Confidentiality

1. Non-public information accessed through the Service, including drafts, campaign plans,
   credentials, tokens, analytics, account details, business information and information
   concerning other users, must be treated as confidential unless it is clearly public or
   has been authorised for disclosure.
2. Confidential information may be used and disclosed only for the authorised internal
   purpose and only to persons who are permitted to receive it.
3. Confidentiality obligations arising from law, employment, contract or separate
   policies continue to apply and are not reduced by these terms.
4. The confidentiality obligations in this section continue after access to the Service
   ends for as long as the information remains confidential.

11. Security and incident handling

1. Users must follow reasonable security instructions issued by the Operator and must not
   disable or circumvent safeguards.
2. Devices used to access the Service must be appropriately protected, updated and
   secured against unauthorised access.
3. The Operator may maintain logs, backups and technical records where reasonably
   necessary for security, troubleshooting, legal compliance and operation, subject to
   the applicable Privacy Policy.
4. The Operator may investigate suspected misuse or security incidents and may preserve
   relevant information where legally permitted. Users must reasonably cooperate with
   such investigations.
5. No internet-connected system can be guaranteed completely secure. Users must not rely
   on the Service as the sole protection or storage location for sensitive or important
   information.

12. Availability, maintenance and changes to the Service

1. The Service is provided as an internal operational facility. No specific uptime,
   response time, support level, storage duration or service-level commitment is promised
   unless separately agreed in writing.
2. The Operator may maintain, update, reconfigure, restrict, suspend or discontinue all
   or part of the Service. Planned notice will be given where reasonably practicable, but
   urgent maintenance or security measures may be performed without prior notice.
3. Drafts, schedules, publications, integrations or other functions may fail, be delayed
   or produce unexpected results. Users remain responsible for verifying time-sensitive
   or important actions directly on the relevant Third-Party Platform.
4. The Operator may alter functionality, storage limits, retention periods, integrations
   and access permissions to meet operational, technical, security or legal requirements.

13. Suspension and termination

1. Access may be limited or suspended immediately where the Operator reasonably believes
   this is necessary to protect systems or data, investigate an incident, prevent
   unlawful conduct, enforce these terms or comply with law or a third-party platform’s
   requirements.
2. Access may also end when the user’s employment, engagement, role, project assignment
   or other basis for authorisation ends, or whenever the Operator withdraws the
   authorisation.
3. On termination of access, the user must cease using the Service, return or delete
   confidential material as instructed and revoke any connection that should no longer
   remain active.
4. The Operator may delete or anonymise account information and stored content in
   accordance with legal obligations, operational needs, applicable retention rules and
   the Privacy Policy. Users should arrange the authorised export or preservation of
   necessary business records before access ends where practicable.
5. Provisions concerning ownership, confidentiality, responsibility, liability and
   governing law continue to apply where their nature requires survival.

14. Nature of the Service and disclaimers

1. To the extent permitted by law, the Service is made available on an “as available”
   basis for internal use. The Operator does not guarantee uninterrupted or error-free
   operation, compatibility with every platform, successful publication, preservation of
   every item, or any particular business result.
2. Analytics, previews, recommendations, generated material and status information may
   be incomplete, delayed or inaccurate. They must be independently reviewed before being
   relied upon for important decisions.
3. The Service does not provide legal, tax, compliance, public-relations or professional
   advice. Users remain responsible for obtaining appropriate review where required.
4. Nothing in these terms excludes statutory rights or duties that cannot lawfully be
   excluded or restricted.

15. Liability

1. The Operator has unlimited liability for intent and gross negligence; for injury to
   life, body or health; under the German Product Liability Act
   (Produkthaftungsgesetz); for a guarantee expressly assumed by the Operator;
   and in any other case in which liability cannot lawfully be limited.
2. In cases of ordinary negligence, the Operator is liable only for breach of a material
   contractual obligation whose fulfilment is essential to proper performance and on
   which the user may ordinarily rely. In such cases, liability is limited to the
   foreseeable loss typical for this type of internal service.
3. Subject to the preceding paragraphs, liability for ordinary negligence is excluded.
   In particular, the Operator is not liable merely because a Third-Party Platform
   rejects, delays, alters or removes content, restricts an account, changes its systems
   or becomes unavailable.
4. Any mandatory liability arising from an employment relationship, data-protection law
   or other applicable law remains unaffected.
5. Users may be responsible under applicable law and their contractual duties for damage
   caused by intentional or negligent misuse, unauthorised publication, rights
   infringement or disclosure of confidential information. This provision does not
   create liability beyond what applicable law or a separate agreement permits.

16. Open-source software and attribution

1. The Service uses the self-hosted edition of Postiz, an open-source software project
   developed and maintained by its respective authors and contributors.
2. Postiz and included third-party components remain subject to their applicable
   open-source licences, copyright notices and attribution requirements. Those licence
   terms govern the copying, modification and distribution of the relevant software and
   are not replaced by these internal-use terms.
3. References to Postiz, Gitroom or other project and product names are for identification
   and attribution only. Unless expressly stated otherwise, the Operator is not affiliated
   with, endorsed by or acting for the Postiz project, Gitroom, Postiz.com or their
   maintainers.
4. Applicable licence texts and notices may be supplied with the installed software or
   made available through the corresponding source-code repository. Requests concerning
   notices or any source-code disclosure obligation applicable to the Operator may be
   directed to
   hermine@the-corona.net.

17. Changes to these terms

1. The Operator may update these terms to reflect changes in the Service, internal
   processes, security requirements, third-party integrations or applicable law.
2. The current version will be published with its effective date. Material changes will
   be communicated to Authorised Users by reasonable means where practicable.
3. Changes do not apply retroactively where retroactive application would be unlawful.
   Continued access may be made conditional on acknowledging an updated version.

18. Governing law

1. These terms are governed by the laws of the Federal Republic of Germany, excluding
   rules that would require the application of another jurisdiction’s law.
2. Mandatory provisions of applicable law, including mandatory employment and
   data-protection law, remain unaffected.
3. Any place-of-jurisdiction agreement applies only to the extent legally permissible and
   separately agreed or established by mandatory law.

19. General provisions

1. A failure or delay in enforcing a provision does not constitute a waiver of that
   provision.
2. Users may not transfer their access rights or obligations under these terms to another
   person without the Operator’s prior permission.
3. If any provision is invalid or unenforceable, the remaining provisions remain
   unaffected. The applicable statutory rule applies in place of the invalid or
   unenforceable provision. This also applies to unintended omissions.
4. In the event of questions, access problems, suspected misuse or legal notices
   concerning the Service, contact
   hermine@the-corona.net.