Privacy Policy

1. Introduction

This Privacy Policy describes how Postiz Social Media ("we", "our", or "us"), operated by Antoine LANDRY, accesses, collects, uses, stores, shares, and protects information in connection with the Postiz Social Media web application (the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by applicable law, you will be asked to agree to this Privacy Policy before using the relevant features.

We are committed to handling personal data responsibly and transparently and to complying with applicable privacy laws, including the General Data Protection Regulation (GDPR) where applicable.

2. Who We Are

Postiz Social Media is operated by:

Antoine LANDRY
97419, France
Email: support@bricksworld.fr

For the purposes of applicable data protection law, Antoine LANDRY is the data controller for personal data processed through the Service, except where a third-party platform independently determines how it processes data on its own service.

3. What the Service Does

Postiz Social Media is a web-based social media management and scheduling application. It allows authorized users to connect their own social media accounts and channels, prepare original video content, review the applicable publishing settings, publish immediately, or schedule publication for a later date and time.

The Service currently integrates with:

• TikTok, through TikTok's official Login Kit and Content Posting API; and
• YouTube, through Google OAuth 2.0 and the YouTube API Services, including the YouTube Data API.

Postiz Social Media does not request or collect users' TikTok, Google, or YouTube passwords. Authentication and authorization take place through the official authorization systems provided by TikTok and Google.

Every immediate or scheduled publication must first be prepared and expressly confirmed by the authorized user. For a scheduled publication, the Service automatically executes the previously confirmed instruction at the selected time. The Service does not publish to an account or channel that has not been explicitly connected and authorized by its owner.

4. Information We Access or Collect

4.1 Service Account and Contact Data

If the Service includes account creation, we may collect information such as:

• your email address;
• your username or display name;
• authentication and session information;
• your account preferences; and
• communications and information you provide when contacting support.

We use this information to create and maintain your Service account, secure access to the Service, provide support, and communicate with you about the Service.

4.2 TikTok Account and Authorization Data

When you connect a TikTok account using TikTok Login Kit, we receive information made available by TikTok under the permissions you grant. Depending on the permissions requested and approved, this may include:

• your TikTok user identifier, such as OpenID or UnionID;
• OAuth access tokens and refresh tokens issued by TikTok;
• basic profile information, such as a display name or avatar; and
• information needed to identify the TikTok account selected for publication.

This information is used only to connect the authorized TikTok account, display it within the Service, and perform the publishing actions you request.

4.3 Google and YouTube Account, Channel, and Authorization Data

Postiz Social Media uses YouTube API Services. When you connect a YouTube channel through Google OAuth 2.0, we access or receive information made available by Google and YouTube under the permissions you grant. Depending on the permissions requested and approved, this may include:

• OAuth access tokens and refresh tokens issued by Google;
• your Google account identifier and basic account information used during authorization;
• the YouTube channel identifier, channel name, and other basic channel information needed to identify the authorized channel;
• information necessary to confirm which YouTube channel is connected; and
• YouTube API Data created, submitted, or returned in connection with a user-authorized upload or publishing action.

The Service uses this information only to authenticate the connection, identify and display the authorized channel, upload content, apply the publishing settings selected by the user, and maintain the authorized integration.

Postiz Social Media requests only the permissions reasonably necessary for the YouTube features currently provided. It does not use Google or YouTube user data for advertising, credit decisions, surveillance, or purposes unrelated to the user-facing functionality described in this Privacy Policy.

4.4 Content, Media, and Publishing Data

When you prepare content for publication, the Service may process and store:

• uploaded video or other media files;
• video titles, descriptions, tags, and related metadata;
• the selected social media account or YouTube channel;
• publishing date and time;
• publication status and technical results;
• for YouTube, the selected privacy status and made-for-kids setting; and
• other settings that you deliberately provide for publication.

This data is used to display the proposed publication to you, allow you to review or edit it, and perform the immediate or scheduled publishing action you confirm. The Service does not claim ownership of your content and does not use uploaded content for advertising or unrelated purposes.

4.5 Technical, Security, and Usage Data

When you use the Service, we may collect standard technical information such as:

• IP address;
• browser type and version;
• operating system and device type;
• pages accessed and timestamps;
• referring URLs;
• session duration;
• security and authentication events; and
• diagnostic logs, error messages, and basic interaction data.

This information is used for service operation, security, abuse prevention, diagnostics, and reliability. It is not used to create advertising profiles.

4.6 Cookies and Similar Technologies

The Service may use cookies or similar technologies that are necessary to authenticate users, maintain sessions, remember essential preferences, protect accounts, and operate the Service securely.

Postiz Social Media does not use Google or YouTube API Data for interest-based advertising. If non-essential analytics or advertising technologies are introduced in the future, this Privacy Policy will be updated and any consent required by law will be obtained before those technologies are used.

5. Actions Performed Through YouTube API Services

With the user's express authorization, Postiz Social Media may use YouTube API Services to upload a video to the YouTube channel selected by the user and apply the title, description, privacy status, made-for-kids selection, scheduling information, and other supported settings reviewed and confirmed by the user.

The Service clearly identifies the YouTube channel to which content will be submitted. The user retains final control over the content and settings sent to YouTube. Postiz Social Media does not intentionally change user-provided values or publish content without the user's prior instruction and consent.

6. How We Use Information

We use the information described in this Privacy Policy to:

• provide, operate, maintain, and secure the Service;
• authenticate users and manage Service sessions;
• connect authorized TikTok accounts and YouTube channels;
• identify and display the connected account or channel;
• prepare, review, publish, and schedule content as instructed by the user;
• store the settings needed to complete scheduled publications;
• communicate publication status, errors, or required actions;
• respond to support requests and communications;
• diagnose technical problems and improve reliability;
• detect and prevent unauthorized access, fraud, or abuse; and
• comply with applicable legal obligations and enforce our Terms of Service.

We do not sell, rent, or trade personal data, Google user data, YouTube API Data, or TikTok user data. We do not disclose such data to third parties for their independent advertising or marketing purposes.

7. Legal Bases for Processing

Where the GDPR or a similar law applies, we process personal data on one or more of the following legal bases:

• Performance of a contract: to provide the Service and features requested by the user.
• Consent: to connect third-party accounts and channels and perform authorized actions where consent is required.
• Legitimate interests: to protect the Service, prevent abuse, diagnose problems, and improve reliability, provided those interests do not override the user's rights.
• Legal obligation: to comply with applicable laws, regulations, court orders, or other binding legal requirements.

Where processing is based on consent, the user may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed before withdrawal.

8. How Information Is Shared

We disclose information only as necessary for the purposes described in this Privacy Policy, including to:

• TikTok: to authenticate the connected account and submit content and settings for publication at the user's request;
• Google and YouTube: to authenticate the connected account or channel and submit content and settings through YouTube API Services at the user's request;
• hosting and infrastructure providers: to host the Service, securely store required data, and transmit media and API requests;
• technical service providers: where necessary for security, maintenance, diagnostics, or support and subject to appropriate confidentiality and data protection obligations;
• persons expressly authorized by the user: where the user has deliberately granted access to manage the relevant account, channel, or content; and
• public authorities or other parties when legally required: where disclosure is necessary to comply with applicable law, a binding legal request, protect rights or safety, investigate abuse, or enforce our Terms of Service.

Third-party service providers may process information only to provide services to us and may not use it for unrelated purposes.

Postiz Social Media's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Third-Party Platform Privacy Policies

Data processed independently by a third-party platform is also governed by that platform's own terms and privacy policy. Users should review:

• the Google Privacy Policy;
• the YouTube Terms of Service; and
• TikTok's applicable Privacy Policy and Terms of Service.

Postiz Social Media is not responsible for the independent privacy practices of Google, YouTube, TikTok, or another third-party service.

10. Data Storage and Security

We implement reasonable and appropriate technical and organizational measures designed to protect information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include, where applicable:

• encrypted transmission through HTTPS/TLS;
• access controls limiting access to stored data;
• secure storage of OAuth tokens and other authentication data;
• separation of user data and authorization records;
• monitoring, logging, and security review; and
• regular review of access rights and security practices.

OAuth tokens are used only for the permissions and actions authorized by the user and are not disclosed to unauthorized parties. We do not request or store users' Google, YouTube, or TikTok passwords.

No method of transmission or storage is completely secure. Although we take reasonable precautions, we cannot guarantee absolute security.

11. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary to provide the Service, complete authorized actions, protect the Service, or comply with legal obligations.

In general:

• Service account data is retained while the account remains active and for a limited period afterward where necessary for security, dispute resolution, or legal compliance.
• OAuth access and refresh tokens are retained while the corresponding integration remains connected and authorized. They are deleted or rendered unusable when the integration is disconnected, authorization is revoked, the Service account is deleted, or continued retention is no longer necessary.
• Uploaded media and publishing metadata may be retained until an immediate or scheduled publication has completed or has been cancelled, and for a limited operational period afterward where necessary for publication history, diagnostics, security, or legal obligations. The content is not repurposed for advertising or unrelated uses.
• Technical and security logs are generally retained for no longer than 90 days, unless a longer period is reasonably necessary to investigate abuse, resolve a security incident, or comply with law.
• Support communications may be retained for as long as necessary to resolve the request and maintain appropriate business records.

When a user revokes YouTube authorization through the Service, Postiz Social Media will revoke the applicable authorization and delete the Authorized Data obtained under that consent as soon as reasonably possible and within seven calendar days. When authorization is revoked through Google's security settings, related YouTube API Data will be deleted as soon as reasonably possible and within 30 calendar days after the Service becomes aware of the revocation, subject to any retention strictly required by applicable law.

The Service may periodically verify whether authorization tokens remain valid and delete associated API Data when authorization can no longer be refreshed.

Where deletion is requested, information will be deleted or anonymized unless continued retention is required by law or is necessary to establish, exercise, or defend legal claims.

12. Disconnecting Accounts and Revoking Platform Access

Users may stop future access by disconnecting the relevant integration within the Service where that option is available.

Access to Google and YouTube data can also be reviewed or revoked at any time through the Google Account third-party connections and security settings. Revoking access prevents Postiz Social Media from making new authorized requests after the revocation takes effect.

Access to TikTok data can be revoked through TikTok's account settings under Settings and privacy > Security and permissions > Apps and services permissions, or the equivalent menu made available by TikTok.

Revoking a platform authorization does not automatically delete the user's Service account. To request deletion of the Service account and associated personal data, follow the process in Section 13.

13. Account and Data Deletion Requests

Users may request deletion of their Service account and associated personal data by emailing support@bricksworld.fr with the subject line "Data Deletion Request".

The request should include the email address associated with the Service account and, where relevant, the connected TikTok identifier or YouTube channel identifier needed to locate the data. We may request reasonable verification before completing the deletion to protect against unauthorized requests.

After verification, we will delete or anonymize the relevant data within a reasonable period and in accordance with the deadlines described in Section 11, except where retention is required by applicable law.

14. Your Privacy Rights

Depending on the user's jurisdiction and applicable law, the user may have rights including:

• Right of access: to obtain information about and a copy of personal data we hold;
• Right to rectification: to correct inaccurate or incomplete personal data;
• Right to erasure: to request deletion of personal data, subject to lawful retention requirements;
• Right to withdraw consent: where processing is based on consent;
• Right to object or restrict processing: in circumstances provided by applicable law;
• Right to data portability: to receive eligible data in a structured, commonly used, machine-readable format; and
• Right to lodge a complaint: with a competent data protection authority.

To exercise these rights, contact support@bricksworld.fr. We will respond in accordance with applicable law and may request reasonable proof of identity.

15. Children and Minors

The Service is not directed to individuals under the age of 16, or under the minimum age required in their jurisdiction to consent to the processing of personal data. We do not knowingly collect personal data from children in violation of applicable law.

If we learn that personal data was collected from a child without valid authorization, we will take appropriate steps to delete it. A parent, guardian, or other concerned person may contact support@bricksworld.fr regarding such data.

16. International Data Transfers

Information may be processed in countries outside the user's country of residence, including by third-party platforms and infrastructure providers. Where applicable law requires safeguards for an international transfer, we take reasonable steps to use an approved transfer mechanism, such as standard contractual clauses, an adequacy decision, or another lawful safeguard.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, platform requirements, applicable law, or our data practices. When we update it, we will revise the effective date at the top of the page.

If a change materially affects how Google user data, YouTube API Data, TikTok user data, or other personal data is accessed, used, stored, or shared, we will provide appropriate notice and request renewed consent where required before applying the new use.

Users are encouraged to review this Privacy Policy periodically.

18. Contact

For questions, complaints, or requests concerning this Privacy Policy or our processing of personal data, contact:

Antoine LANDRY
Email: support@bricksworld.fr
Location: 97419, France