Scope
This policy explains how "XSOFT" LIMITED LIABILITY COMPANY, operating Repost21, handles requests from government authorities — law enforcement, regulators, courts or national-security bodies — for personal data of our customers or of people who interact with our customers through connected social accounts. It covers data we hold ourselves and data we receive from platforms such as Meta.
We verify that every request is lawful
We do not act on informal approaches. Each request must be made in writing, come from an identifiable and competent authority, cite the legal basis it relies on, and be served through a valid legal channel in a jurisdiction that applies to us. We check these conditions before any data is considered for disclosure. Requests that do not meet them are refused.
We challenge requests we consider unlawful
Where a request is overbroad, vague, not supported by the cited legal basis, served by an authority without jurisdiction over us, or otherwise unlawful, we push back: we ask for clarification or narrowing, and we object to or challenge the request through the available legal means. We do not comply with a request solely because complying would be easier than contesting it.
We disclose the minimum necessary
If a request is lawful and we must comply, we disclose only the specific data it covers and nothing more. We do not hand over entire accounts, message archives or databases when a narrower answer satisfies the request, and we do not volunteer additional data. We give no government direct, automated or unfettered access to our systems, and we build no back doors.
We document every request
Each request is logged with the date received, the requesting authority, the legal basis cited, the categories of data requested, our assessment, the decision taken with its reasoning, what was disclosed and to whom, and the people inside the company involved. These records are retained so that our handling of requests can be reviewed and audited.
We notify affected users
We tell users whose data is requested, so that they can seek legal protection, unless we are legally prohibited from doing so or there is a credible risk to life. Where notice is delayed by a legal prohibition, we give it once that prohibition ends.
Platform data
Data received from Meta and other platforms is treated exactly as described above. We do not use it for any purpose other than providing our service to the account owner, and disclosure to authorities follows the same verification, minimisation and documentation steps.
How to submit a request
Authorities should send requests to [email protected] with the legal basis attached. Requests sent through other channels will be redirected to this address. Receipt of a request is not an agreement to comply with it.