Privacy Policy

This Privacy Policy describes how PostBot ("PostBot," "we," "us," or "our") collects, uses, and protects information about you when you use our service at irida.social (the "Service"). By using PostBot, you agree to the practices described in this policy.

1. Information We Collect

Account Information: When you register, we collect your name, email address, and password (stored as a secure hash, never in plaintext).

Social Media Platform Connections: When you connect a social media account (e.g., TikTok, Instagram, YouTube), we receive and store OAuth access tokens issued by that platform. We never receive or store your passwords for those platforms.

Content You Publish: We temporarily process video files and associated metadata (captions, hashtags, scheduling information) that you submit for publishing. Files are processed in memory and are not permanently stored on our servers after publication.

Google Drive Integration: If you connect Google Drive, we request read access to specific folders you designate. We access only the files you explicitly configure for publishing.

Usage Data: We collect technical information about how you use the Service, including browser type, IP address, pages visited, and feature usage. This data is used to improve the Service.

Payment Information: If you subscribe to a paid plan, payment processing is handled by our third-party payment processor. PostBot does not store your credit card numbers.

2. How We Use Your Information

• To provide and operate the Service, including publishing content to connected platforms on your behalf
• To authenticate your identity and maintain your account
• To send transactional emails (account confirmation, password reset, publishing status notifications)
• To analyze usage patterns and improve the Service
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To comply with legal obligations

3. OAuth and Third-Party Platforms

PostBot uses OAuth 2.0 to connect to social media platforms. This means:

• You authorize PostBot through the official login flow of each platform
• We receive access tokens scoped to the specific permissions required for publishing
• We store these tokens in encrypted form
• You can revoke PostBot's access at any time through your social media account's security settings or through your PostBot dashboard
• Revoking access immediately prevents PostBot from publishing to that platform on your behalf

PostBot's use of data received from TikTok APIs complies with TikTok's Platform Terms and Developer Policies.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• Service Providers: Trusted third-party vendors who assist in operating the Service (hosting, analytics, payment processing) under strict data protection agreements
• Legal Requirements: When required by law, court order, or governmental authority
• Protection of Rights: When necessary to protect the rights, property, or safety of PostBot, our users, or the public
• Business Transfer: In connection with a merger, acquisition, or sale of assets, with appropriate notice to users

5. Data Retention

We retain your account data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting [email protected] or using the account deletion feature in your dashboard. Step-by-step instructions are on our data deletion page. Upon deletion, your personal information will be permanently removed within 30 days, except where retention is required by law.

6. Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• OAuth access tokens are encrypted at rest
• Passwords are hashed using industry-standard algorithms and are never stored in plaintext
• Access to user data is restricted to authorized personnel with a legitimate need
• We conduct regular security reviews and vulnerability assessments

7. TikTok API Data Practices

Specifically regarding data obtained through the TikTok API:

• We use TikTok API data exclusively for the purpose of publishing content on your behalf as directed by you
• We do not use TikTok data for advertising, profiling, or any purpose beyond Service functionality
• We do not share TikTok user data with third parties except as required to provide the publishing service
• TikTok access tokens are stored encrypted and used only for API requests you initiate
• You can disconnect your TikTok account at any time, which immediately revokes our access

8. Cookies and Tracking

We use essential cookies necessary to operate the Service (session management, authentication). We may use analytics cookies to understand usage patterns — you may opt out of analytics cookies in your account settings. We do not use advertising or tracking cookies.

9. Children's Privacy

PostBot is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided personal information, we will delete it promptly.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a portable format
• Objection: Object to certain types of processing

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

11. International Data Transfers

PostBot operates globally. Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in accordance with applicable data protection law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes and, where required, by sending an email notification. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

PostBot
Email: [email protected]
Website: https://irida.social

---

This Privacy Policy applies to all users of PostBot at irida.social.