Privacy Policy

1. Introduction

Welcome to SocialAutoUpload ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our social media management platform.

2. Information We Collect

2.1 Personal Information

We collect the following personal information when you register and use our service:

• Account Information: Email address, full name, password (encrypted)
• Profile Information: Avatar/profile picture, bio, preferences
• Contact Information: Email address for communications

2.2 Social Media Account Information

When you connect your social media accounts to SocialAutoUpload, we collect:

• Facebook/Instagram: Page IDs, page names, access tokens, page follower counts
• YouTube: Channel IDs, channel names, access tokens, subscriber counts
• TikTok: Account IDs, usernames, access tokens, follower counts
• Telegram: Bot tokens, channel information

2.3 Content Information

• Posts, captions, and hashtags you create
• Media files (images, videos) you upload
• Scheduling information for posts
• Templates and saved content

2.4 Usage Information

• Activity logs and timestamps
• Feature usage statistics
• Performance metrics
• Error logs and debugging information

2.5 Technical Information

• IP address
• Browser type and version
• Device information
• Operating system
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

• Create and manage your account
• Authenticate and authorize your access
• Connect and manage your social media accounts
• Publish posts to your connected platforms
• Schedule and automate content distribution
• Store and manage your media files

3.2 Service Improvement

• Analyze usage patterns to improve features
• Monitor and analyze platform performance
• Develop new features and functionality
• Fix bugs and technical issues

3.3 Communication

• Send service-related notifications
• Respond to your inquiries and support requests
• Send important updates about our service
• Provide customer support

3.4 AI Features

• Generate captions and content suggestions using OpenAI, Google Gemini, and DeepSeek APIs
• Provide hashtag recommendations
• Optimize content for different platforms

4. Data Storage and Security

4.1 Data Storage

• Database: A secure database with encrypted connections
• Media Files: Stored on secure servers with access controls
• Backups: Regular automated backups for data recovery
• Location: Data stored in secure data centers

4.2 Security Measures

• Industry-standard encryption for data transmission (HTTPS/TLS)
• Encrypted password storage using bcrypt
• JWT tokens for secure authentication
• Regular security audits and updates
• Access controls and permission management
• Database triggers for data validation

4.3 Access Tokens

Social media access tokens are stored securely and encrypted. We only use these tokens to perform actions you explicitly request (posting, scheduling, etc.). Tokens are never shared with third parties.

5. Data Sharing and Disclosure

5.1 Third-Party Services

We share data with the following third-party services:

• Social Media Platforms: Facebook, Instagram, YouTube, TikTok, Telegram - to publish your content
• OpenAI, Google Gemini & DeepSeek: For AI-powered caption and hashtag generation (only content you choose to generate)
• Cloud Storage: For media file storage and delivery

5.2 We Do NOT Share Your Data With:

• Advertisers or marketing companies
• Data brokers
• Analytics companies (beyond anonymous usage statistics)
• Any other third parties for their marketing purposes

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government requests
• Protection of our rights and safety
• Prevention of fraud or illegal activities

6. Your Data Rights

6.1 Access and Portability

• View all your personal data in your account settings
• Export your data in standard formats
• Download your content and media files

6.2 Modification and Correction

• Update your profile information anytime
• Correct any inaccurate personal data
• Modify your preferences and settings

6.3 Deletion Rights

• Delete individual posts and content
• Remove connected social media accounts
• Delete your entire account and associated data
• Request complete data deletion (we will delete within 30 days)

6.4 Data Retention

• Active accounts: Data retained while account is active
• Deleted accounts: Data permanently deleted within 30 days
• Backups: Deleted from backups within 90 days
• Legal requirements: Some data may be retained longer if legally required

7. Cookies and Tracking

7.1 Essential Cookies

• Authentication tokens (JWT)
• Session management
• Security features

7.2 Functional Cookies

• User preferences
• Language settings
• Theme preferences (dark/light mode)

7.3 Cookie Control

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of our service.

8. Children's Privacy

Our service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

9. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ. We ensure appropriate safeguards are in place for such transfers.

10. Changes to Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date
• Sending you an email notification for significant changes

We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Information

12. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate personal data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Restrict processing of your personal data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at [email protected]

13. TikTok Integration & Data Handling

When you connect your TikTok account to SocialAutoUpload, we access TikTok's APIs in compliance with TikTok's Content Sharing Developer Guidelines and Developer Guidelines.

13.1 TikTok Data We Collect

• Account Information: TikTok open_id, display name, and avatar URL (via user.info.basic scope)
• Creator Capabilities: Privacy level options, comment/duet/stitch settings, and maximum video duration (via Content Posting API)
• Access & Refresh Tokens: Encrypted OAuth2 tokens for authorized API actions only

13.2 How We Use TikTok Data

• Publishing Content: We use TikTok's Content Posting API (Direct Post) to upload videos you explicitly choose to publish
• Creator Info Display: We display your TikTok creator nickname, avatar, and posting capabilities before each post, as required by TikTok UX Guidelines
• Privacy Level: You choose your privacy level from options provided by TikTok's Creator Info API — we never set a default
• Commercial Disclosure: We provide UI controls for branded/promotional content disclosure as required by TikTok

13.3 TikTok Data We Do NOT Collect

• We do NOT access your TikTok followers list
• We do NOT read or analyze your TikTok feed or viewing history
• We do NOT collect TikTok analytics or engagement data
• We do NOT modify, watermark, or alter your video content in any way

13.4 TikTok Token Security

• TikTok OAuth tokens are encrypted at rest using AES-256 encryption
• Tokens are only used for actions you explicitly initiate (publishing, fetching creator info)
• Tokens are automatically refreshed when expired and old tokens are securely deleted
• When you disconnect your TikTok account, all tokens are immediately and permanently deleted

13.5 TikTok Data Deletion

You can disconnect your TikTok account at any time from the Channels page. Upon disconnection, we immediately delete your TikTok access token, refresh token, open_id, and all associated metadata. For complete account deletion instructions, see our User Data Deletion page.

13.6 No Automated Posting

SocialAutoUpload does NOT automatically post content to TikTok without your explicit action. Every post requires you to: select content, choose a TikTok channel, configure privacy and interaction settings, agree to TikTok's terms, and explicitly click "Publish" or confirm scheduling.

14. Facebook & Instagram (Meta) Integration

When you connect your Facebook Pages or Instagram accounts, we use Meta's Graph API in compliance with Meta Platform Terms and Developer Policies.

14.1 Meta Data We Collect

• Facebook: Page ID, page name, page access token, page category
• Instagram: Instagram Business/Creator account ID, username, profile picture URL
• Linked Accounts: Facebook-Instagram account linkage information for cross-posting

14.2 How We Use Meta Data

• Publish posts, photos, videos, reels, and stories to your Facebook Pages and Instagram accounts
• Display your connected page/account information in our dashboard
• Schedule future posts for automated publishing
• We do NOT access your personal Facebook profile, friends list, or private messages

14.3 Meta Data Deletion

You can disconnect Facebook/Instagram accounts anytime from the Channels page. We also support Facebook's Data Deletion Callback for automatic data removal when you remove our app from Facebook Settings.

15. YouTube (Google) Integration

Our use of YouTube API Services complies with YouTube API Services Terms of Service and Google Privacy Policy.

15.1 YouTube Data We Collect

• YouTube channel ID and channel name
• OAuth2 access and refresh tokens (encrypted)
• Channel thumbnail/avatar URL

15.2 How We Use YouTube Data

• Upload videos and shorts to your YouTube channel on your behalf
• Set video titles, descriptions, tags, privacy status, and custom thumbnails
• We do NOT access your YouTube viewing history, subscriptions, or playlists
• We do NOT collect YouTube Analytics data

15.3 Google API Services User Data Policy

SocialAutoUpload's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use YouTube data for the purposes described in this policy and do not transfer it to third parties except as necessary to provide our Service.

15.4 YouTube Data Storage and Retention

By using SocialAutoUpload's YouTube features, you are agreeing to be bound by the YouTube Terms of Service. OAuth tokens are stored encrypted and are used only to perform the actions you request. Stored YouTube data other than OAuth tokens (such as your channel name and channel thumbnail) is refreshed or deleted at least every 30 days while your channel remains connected. Video statistics shown in the app are retrieved from the YouTube API on demand and are not stored long-term.

15.5 Revoking YouTube Access

You can disconnect your YouTube account from our Channels page at any time. You may also revoke access via Google security settings (Google Account Permissions). Upon disconnection, all YouTube tokens and metadata are permanently deleted from our systems.

16. Telegram Integration

16.1 Telegram Data We Collect

• Bot token (encrypted) — provided by you via @BotFather
• Channel/group chat ID
• Channel name

16.2 How We Use Telegram Data

• Send text messages, images, videos, and media groups to your specified Telegram channel/group
• We do NOT read messages from your channels or access subscriber information
• Bot tokens are encrypted at rest and only used for sending content you explicitly publish

17. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information
• Access your personal information
• Request deletion of your personal information
• Not be discriminated against for exercising your privacy rights

Note: We do NOT sell your personal information.