Privacy Policy

This Privacy Policy explains how PostAut ("PostAut", "we") collects, uses, stores, shares and deletes personal data when you use the PostAut website and dashboard, a tool to schedule and publish your own content to Instagram, Facebook, TikTok, YouTube, LinkedIn, Pinterest and Telegram through those platforms' official APIs.

This policy follows Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD) and the requirements of the integrated platforms, including the TikTok Developer Terms, the Meta Platform Terms, the LinkedIn API Terms, the Pinterest Developer Guidelines and the Telegram Bot API Terms. If you live outside Brazil, you may also have rights under your country's data protection laws; write to us to exercise them.

PostAut uses the YouTube API Services. By connecting a YouTube channel, you also agree to the YouTube Terms of Service, and data handled by Google follows the Google Privacy Policy.

1. Who is responsible (controller)

The data controller is Kelvin Vitor Francisco, Catanduva - SP. For any privacy matter or to exercise your rights, write to telecanais10@gmail.com.

2. Data we collect

a) Your PostAut account data

• Name, email and password (the password is stored only as a cryptographic hash, never as plain text).
• Account creation date and last access.
• When you subscribe to a paid plan: name, email and tax ID (CPF or CNPJ in Brazil), sent to our payment processor to issue the charge. We do not receive or store card details.

b) TikTok data (when you connect a TikTok account)

Access happens through TikTok's official Login Kit, and only after you explicitly authorize it on TikTok's own screen. We only ask for the scopes below:

• user.info.basic and user.info.profile: the account's identifier in the app (open_id), display name, username and profile photo, used to show which account is connected.
• video.upload and video.publish: send TikTok the videos you chose to publish and check the publishing status. We also check your account's creator info (such as the available privacy options), which TikTok requires before each post.
• Access token and refresh token issued by TikTok, with their expiry date.

We do not collect your TikTok password, follower list, private messages, payment data or videos you did not upload through PostAut.

c) YouTube data (when you connect a channel)

Access happens through Google's official login (OAuth), only after you authorize it on Google's own screen. We only ask for these scopes:

• youtube.upload: upload to your channel the videos you chose to publish, with the title, description and privacy status (public, unlisted or private) you chose.
• youtube.readonly: read the channel's ID, name and handle, to show which channel is connected.
• Access token and refresh token issued by Google, with their expiry date.

We do not collect your Google password, subscribers, comments, messages, monetization data or videos you did not upload through PostAut. Our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

d) Instagram and Facebook data (when you connect these accounts)

• ID, name and username of the Instagram professional account and of the Facebook Pages you manage.
• Access tokens issued by Meta.
• Metrics of posts published by PostAut (reach, views, likes, comments), when the API provides them.
• Comments and messages received on your posts, only if you turn on automatic replies (DMs).
• The list of your already published posts (thumbnail, caption, link and date), only when you open the "DMs on old posts" screen to choose which one to turn automatic replies on for.

e) LinkedIn data (when you connect your profile)

• Through LinkedIn's official login, with the scopes openid, profile and w_member_social: profile identifier and name, to show which account is connected, and permission to publish to your profile the posts you schedule.
• Access token issued by LinkedIn, with its expiry date (about 60 days).

f) Pinterest data (when you connect your account)

• Through Pinterest's official login, with the scopes user_accounts:read, boards:read, boards:write, pins:read and pins:write: the account's username, the list of your boards so you can choose where pins go, creating a board when you ask, and creating the pins you schedule.
• Access token and refresh token issued by Pinterest, with their expiry date.

g) Telegram data (when you connect a channel or group)

• The token of your own bot, which you create in @BotFather and paste into PostAut, stored encrypted on the server.
• ID, name and handle of the channel or group where the bot posts, and the bot's handle.
• We do not read the channel's messages: the bot only looks for the connection code you send once, and after that it only posts.

h) Content you upload

• Videos, images, captions, hashtags, scheduling dates and times, and drafts.
• Logs of each post: success, error and the identifier returned by the platform.

i) Refer and earn (affiliate program)

• If you take part: the account holder's name, CPF/CNPJ and Pix key to receive commissions (stored encrypted), your link code, how many clicks it got, and your commission and withdrawal history.
• If you created your account through someone's link: the record of who referred you and the commission amounts generated by your payments. The referrer only sees your first name with your last-name initial, the plan and those amounts.
• When you subscribe, we store a code derived from your CPF/CNPJ (not the number itself), only to prevent people from referring themselves.

j) Technical data

• A strictly necessary session cookie (postaut_session) to keep you signed in, a language cookie (postaut_lang) when you choose a language, and temporary security cookies (tt_oauth_state, yt_oauth_state, li_oauth_state and pin_oauth_state, 10 minutes) while connecting TikTok, YouTube, LinkedIn and Pinterest.
• When you open a referral link, a first-party PostAut cookie (pa_ref) stores the referrer's code for up to 90 days, to record the referral if you create an account. It is deleted when the account is created.
• In the Android app, a device identifier to send the notifications you turned on (post published, failure, post taking off).
• Server logs (IP address, date and time, route accessed), for security and troubleshooting.

We do not use advertising cookies, tracking pixels or third-party analytics tools.

3. How we use data and legal basis

• Providing the service (authenticating your account, connecting networks, uploading and publishing videos at the date and time you chose, showing status and history). Legal basis: performance of a contract (art. 7, V, LGPD).
• Security and abuse prevention (logs, sessions, protection against improper access). Legal basis: legitimate interest (art. 7, IX).
• Complying with legal obligations and requests from authorities. Legal basis: legal obligation (art. 7, II).
• Automatic replies to comments on Instagram/Facebook, only when you turn them on. Legal basis: performance of a contract.
• AI captions, only when you click generate: a frame taken from the video and the instructions you wrote are sent to the AI provider to write the caption. Legal basis: performance of a contract.
• Billing for paid plans. Legal basis: performance of a contract and legal obligation (keeping tax records).
• Refer and earn (recording referrals, calculating and paying commissions, preventing fraud). Legal basis: performance of a contract and legitimate interest (fraud prevention).

We do not sell data, do not use your data for advertising, do not build marketing profiles and do not use data obtained from the TikTok, Google/YouTube, Meta, LinkedIn, Pinterest or Telegram APIs for any purpose other than providing the features you asked for.

4. Who we share data with

• TikTok (TikTok Pte. Ltd. and affiliates): receives the video, the caption and the privacy settings you chose, at publishing time.
• Google/YouTube (Google LLC): receives the video, the title, the description and the privacy status of posts meant for your channel, at publishing time.
• Meta (Instagram and Facebook): receives media and captions of posts meant for those networks and, if you turn on DMs, the reply and the message sent to people who commented.
• LinkedIn (LinkedIn Corporation), Pinterest (Pinterest, Inc.) and Telegram (Telegram FZ-LLC): receive the media, the caption and, when there is one, the link of posts meant for each of them.
• xAI (AI caption provider): receives a frame of the video and your instructions, only when you ask for a caption. We do not send your name, email or accounts.
• Asaas (Asaas Gestão Financeira S.A.): processes Pix, bank slip and card payments for paid plans and receives your name, email, CPF/CNPJ and the plan amount.
• Cloudflare (Cloudflare, Inc.): stores files for up to 1 day while they are being sent to our server, to make uploads faster.
• Google Firebase: delivers notifications in the Android app to people who installed the app and turned notifications on.
• Hosting provider (the VPS server where PostAut runs), which acts as a processor and only stores data on our behalf.
• Authorities, only when required by law or court order.

We do not share data with advertisers, data brokers or any other third parties.

5. International transfer

When publishing to the networks, generating AI captions or uploading files, content passes through the servers of the companies listed above, which may be located in other countries. This transfer is necessary to carry out the service you requested (art. 33, IX, LGPD) and follows those platforms' privacy policies. Our server is located in Brazil.

6. How long we keep data

• Network tokens (TikTok, Google, Meta, LinkedIn, Pinterest) and your Telegram bot token: while the account is connected. Deleted as soon as you disconnect the account or delete your PostAut account.
• TikTok profile data (open_id, name, username) and YouTube channel data (ID, name, handle): while the account is connected. The channel name and handle are refreshed from YouTube every 24 hours, and everything is deleted as soon as you disconnect the channel or delete your account.
• Uploaded video and image files: kept on the server until the post is published (for scheduling and retrying on error) and deleted afterwards. Files that were not used in any post are deleted within a few days.
• Images sent to the caption AI: not stored by PostAut; we ask the provider not to store them.
• Billing data: for the period required by tax law.
• Refer and earn commissions, withdrawals and Pix details: while you take part and, afterwards, for the period required by tax law.
• Scheduled posts, drafts and history: while your PostAut account exists, or until you delete them.
• Server logs: for as long as needed for security and troubleshooting, and at most 6 months.
• PostAut account: until you ask for it to be deleted. After deletion, we erase the data within 30 days, except what the law requires us to keep.

7. Security

We use HTTPS, hashed passwords, signed HttpOnly session cookies, server access restricted to the administrator, and platform tokens stay only on the server — they are never sent to the browser or to third parties. No system is 100% secure; if an incident could cause relevant risk or harm, we will notify you and the Brazilian data protection authority (ANPD) as required by the LGPD.

8. Your rights

You can, at any time and at no cost:

• confirm whether we process your data and access it;
• correct incomplete or outdated data;
• ask for anonymization, blocking or deletion;
• ask for portability of your data;
• find out who we share data with;
• withdraw consent and disconnect any network;
• complain to the Brazilian National Data Protection Authority (ANPD) or to the data protection authority of your country.

To exercise these rights, write to telecanais10@gmail.com. We reply within 15 days.

9. How to disconnect and delete your data

• In PostAut: in Accounts, click disconnect. The token and the link are deleted from our server immediately.
• On TikTok: open Profile → Menu → Settings and privacy → Security and permissions → Apps and services → PostAut → Remove access.
• On YouTube/Google: go to security.google.com/settings/security/permissions and remove PostAut's access.
• On Instagram/Facebook: Settings → Apps and websites → remove PostAut.
• On LinkedIn: Settings → Data privacy → Other applications → remove PostAut.
• On Pinterest: Settings → Security and permissions → Apps → revoke PostAut's access.
• On Telegram: remove your bot from the channel's admins or delete the bot in @BotFather.
• Delete everything: see the Data deletion page or write to telecanais10@gmail.com.

Posts already published stay on the networks until you delete them directly on the platform.

10. Children and teenagers

PostAut is not meant for anyone under 18 and we do not knowingly collect data from children or teenagers. If we learn that a minor has created an account, it will be deleted.

11. Changes to this policy

We may update this policy. The "Last updated" date at the top shows the version in force. Relevant changes will be announced in the dashboard or by email before they take effect.

12. Contact

Kelvin Vitor Francisco · Catanduva - SP
Email: telecanais10@gmail.com