Privacy Policy
Last updated [DATE]
What we collect
| What | Why |
|---|---|
| Your email address | To identify your account, sign you in, and send password resets and service notices. |
| Your password, stored only as a scrypt hash | To verify sign-in. We never store the password itself and cannot recover it. |
| Your Google account identifier, if you sign in with Google | To match you to your account. We do not receive your Google password. |
| The videos you upload, their filenames and captions, and technical details such as length and dimensions | To create variations and publish them. |
| The handles of the social accounts you connect | So you can see which account is connected where. |
| A record of each post: which video, which platform, at what time, which variation, and whether it succeeded | To avoid repeating a clip too soon, and so you can see what went out. |
| Post statistics returned by the platforms: views, likes, comments, reach, shares and saves | To show you how posts performed. These cover only posts made through Variation Poster. |
| Session records: a random token, your browser’s user-agent string, and timestamps | To keep you signed in and let you be signed out everywhere when a password changes. |
| Your Stripe customer and subscription identifiers, and the brand and last four digits of your card | To manage your subscription and show you which card is on file. |
What we do not collect
- Card numbers. Payment details are entered on Stripe’s systems and never reach ours. There is no field anywhere in Variation Poster that accepts a card number, an expiry date or a security code.
- Passwords for your social accounts. You authorise each platform directly. We never see those credentials.
- We do not use advertising trackers or third-party analytics on the signed-in application, and we do not sell personal information.
Who else sees your information
We use these companies to run the service. Each receives only what it needs:
| Who | What they receive |
|---|---|
| Upload-Post | Holds the authorised connections to your social accounts and performs the publishing. Receives the video files we send and returns post statistics. |
| Instagram, TikTok, YouTube, Facebook | Receive the posts you schedule, under their own privacy policies. |
| Stripe | Your email, payment details and billing history. |
| [HOSTING PROVIDER] | Runs the servers, and therefore handles data in transit. |
| [STORAGE PROVIDER] | Stores your uploaded videos. |
| [EMAIL PROVIDER] | Your email address, to deliver password resets and service notices. |
We may also disclose information if the law requires it, or to protect our rights or somebody’s safety. If our business is sold, account information may transfer with it; you will be told before that happens.
How long we keep it
- Videos you remove are deleted from storage immediately, along with their thumbnails. This cannot be undone.
- Profiles you remove are deleted from Upload-Post, disconnecting those social accounts from us, and every video belonging to that profile is deleted.
- If you cancel and do not subscribe again, your profiles and videos are deleted at the end of the period you paid for.
- If you close your account, that happens immediately.
- Password reset links are stored only as a hash, expire after two hours, work once, and are deleted after that.
- Records of posts — what was published, where and when — are kept after the videos are deleted, so our own history stays intact. They no longer contain the video.
- Billing records are kept by Stripe for as long as tax and accounting law requires.
Your choices
- See or change your details. Your email, password and email preferences are on the Account page.
- Delete your content. Remove a video or a profile at any time; both delete the underlying files immediately.
- Close your account. The Account page does this, and it deletes your videos and disconnects your social accounts.
- Ask us for a copy of your data, or for it to be deleted. Email [SUPPORT EMAIL] and we will respond within 30 days.
- Email preferences. Service and security emails, such as password resets, are sent regardless — you cannot use the service without them.
Depending on where you live you may have additional rights, including access, correction, deletion, portability, and the right to object to certain processing. Contact us and we will honour them.
Security
Passwords are hashed with scrypt and are never stored or logged in readable form. Sessions use random tokens in cookies that JavaScript cannot read. Password reset links are stored only as a hash, so a copy of our database would not yield a working link. Access to your videos is checked against your account on every request.
No service can promise perfect security. If a breach affects your personal information we will tell you and the relevant authority as the law requires.
Children
Variation Poster is not for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
Where your data is held
Our servers and storage are located in [REGION]. The companies listed above may process data elsewhere, including the United States.
Changes
We may update this policy. If a change materially affects you we will email you before it takes effect, and the date at the top will change.
Contact
[LEGAL ENTITY NAME]
[POSTAL ADDRESS]
[SUPPORT EMAIL]