Privacy Policy

Effective 17 October 2026

1. Summary

We publish videos to social accounts you connect, and show you how they perform. That is the only reason we use platform data.
Platform tokens are encrypted. Disconnecting an account deletes its tokens at once.
YouTube statistics are deleted after 30 days. Everything else is deleted within 30 days of your request.
We do not sell data, do not show ads and do not use your data to train general AI models.

2. Who is responsible

Fabian Egger, Eugen-Jäger-Straße 73, 67346 Speyer, Germany. Email: fabianbezma@gmail.com. More in the Imprint.

3. This website

This website has no login, no cookies, no analytics and no external fonts or scripts. Our host Vercel Inc. processes the data every web request needs (IP address, time, page, browser details) in short-lived server logs to deliver the site and protect it from abuse. The "videos posted" counter on the home page is an image loaded from our own server (https://engine.scalingpersonalbrands.com); that request is handled the same way and the counter itself contains only a total number.

4. The service and the data it uses

The app (https://app.scalingpersonalbrands.com) is a separate, password-protected service. It works with these kinds of data:

Workspace data: names of your brands and handles, video plans, planning boards (the board is kept in your browser's local storage).
Connection data: the platform account ID and name, and OAuth access and refresh tokens.
Content: scripts, captions, rendered video files and preview images.
Post records: scheduled time, status, the platform's post ID and link, error messages.
Statistics: numbers about the posts the service published and about the connected account (section 6).
Auto-reply (optional, Instagram): comments on your Reels that are checked for your keyword, and the private replies sent. People who comment are third parties; we keep their comment text and ID for 30 days only.
Link clicks: when someone opens one of your short links, only the time and whether it was an automated preview. No IP address, no cookie, no device data.

5. What we store and what we fetch

Data	Stored by us	Fetched from the platform
Account ID, name, follower count	yes, while connected	at connection, followers hourly
OAuth tokens	yes, encrypted, while connected	at connection and on refresh
Posts the service published	post ID, link, status	status until published
Post statistics	snapshots (YouTube: max. 30 days)	at most hourly
Account insights (Instagram)	one value per day	at most hourly
Your other posts, messages, comments' text, followers' identities	never	never

6. Platform permissions and why we need them

YouTube (Google)

The service uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service; Google's own processing is described in the Google Privacy Policy.

Permission	What we do with it
`youtube.upload`	Upload the videos you planned, with title, description and settings from your plan.
`youtube.readonly`	Read your channel's ID and title, and the view, like and comment counts of videos the service uploaded.

Revoke access any time: https://security.google.com/settings/security/permissions.

Instagram (Meta)

The service uses the Instagram API with Instagram Login for professional accounts. Meta's processing: Instagram Privacy Policy.

Permission	What we do with it
`instagram_business_basic`	Read the account ID, username, account type and follower count to identify the account you connected.
`instagram_business_content_publish`	Publish the Reels you planned. Instagram downloads each video from a signed link on our server that expires after 6 hours.
`instagram_business_manage_insights`	Read views, likes, comments, shares and saves of Reels the service published, and account insights such as profile views, link taps and reach, to show them in your dashboard.
`instagram_business_manage_comments` only with Auto-reply	Receive new comments on your Reels (comment ID, text, author ID, media ID) to check them for the keyword you set, for example "BOOK". We do not hide, delete or publicly answer comments.
`instagram_business_manage_messages` only with Auto-reply	Send one private reply with your link to a person whose comment contains your keyword, within 7 days and never twice per comment. Each message says "Reply STOP if you don't want these messages"; after STOP, that person gets no more messages. We do not read your inbox or message people who did not comment.

Auto-reply is optional and off by default. The last two permissions are only requested when you switch it on.

Revoke access any time in Instagram: Settings → Website permissions → Apps and websites.

TikTok

Publishing to TikTok is in review and not yet active. If you connect TikTok, the service uses TikTok Login Kit and the Content Posting API. TikTok's processing: TikTok Privacy Policy.

Permission	What we do with it
`user.info.basic`	Read your open ID, display name and username to identify the account.
`video.publish`	Publish videos you planned, with the privacy setting you chose; read the creator info TikTok requires before posting.
`video.list`	Read view, like, comment and share counts of videos the service published.

Revoke access any time in TikTok: Settings and privacy → Security → Manage app permissions.

7. Google API Services User Data Policy

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

We use YouTube data only to upload your planned videos and show their statistics to you.
We transfer it to no one, except where needed to run these features, to comply with law, or as part of a merger or sale of the service with the same protections.
We never use it for advertising, never sell it, and never use it to train AI models.
No person reads it, unless you ask us to (for example for support), it is needed for security, or the law requires it.

8. AI used for scripts

To write video scripts, the service sends your brand name and product description to an AI provider: Groq or Google Gemini, and Anthropic only if you switch a handle to Pro. No platform data (YouTube, Instagram, TikTok) and no data about your audience is sent to them. Free tiers of some providers may use inputs to improve their services; that is why we send product text only.

9. What we never do

Sell or rent personal data.
Use your data or platform data for advertising, or show ads.
Use your data or platform data to train general AI models.
Post anything you did not plan, or access accounts you did not connect.
Create platform accounts or ask for platform passwords.

10. Security

OAuth tokens are encrypted with AES-256-GCM; the key is kept outside the database. Tokens never appear in the interface or in logs.
All connections use HTTPS. The app is password-protected; the server interface needs a secret token.
Login states expire after 15 minutes; video download links for Instagram after 6 hours.
Database backups stay on our server in Germany and are overwritten after 7 days.

11. Service providers

Provider	Role	Data
Hetzner Online GmbH, Germany	Servers for the publishing service, database, videos, backups	all service data
Vercel Inc., USA	Hosting of this website and the app interface	request logs; app requests pass through
Groq, Inc., USA	AI scripts	brand and product text
Google (Gemini API)	AI scripts (fallback)	brand and product text
Anthropic PBC, USA	AI scripts, Pro mode only	brand and product text
ntfy.sh	Push alerts to the operator when a post fails	handle ID, platform, time, error message

Google (YouTube), Meta (Instagram) and TikTok receive your videos and captions because you connected them; for their own processing they are independent controllers under their policies linked above.

12. How long we keep data

Data	Kept for
OAuth tokens	until you disconnect; deleted immediately
Login state during connection	15 minutes
Video download link for Instagram	6 hours
YouTube statistics	30 days after they were fetched, then deleted automatically
Instagram and TikTok statistics, account insights	while you use the service; deleted within 30 days of your request
Posts, scripts, rendered videos, link clicks	while you use the service; deleted within 30 days of your request
Auto-reply: comment text and commenter ID	30 days, then cleared (only counts stay)
Auto-reply: STOP list	while you use the service, so a person who wrote STOP is never messaged again
Database backups	7 days
Push alerts on ntfy.sh	a short period set by ntfy (by default 12 hours)
Website request logs	a short period set by Vercel

13. Disconnecting and revoking access

In the app: Konnektoren → platform → Disconnect. The tokens are deleted at once, scheduled posts for that account can no longer be published, and statistics stop updating. Posts and statistics already stored stay until you ask us to delete them (see Data deletion). You can also revoke access on the platform itself (links in section 6); the effect for us is the same.

14. Legal bases and transfers

We process data to provide the service you asked for (Art. 6(1)(b) GDPR), and for security, website delivery and counting link clicks on the basis of legitimate interests (Art. 6(1)(f) GDPR). Transfers to providers in the USA rely on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

15. Your rights

You can ask for access, correction, deletion, restriction, data portability, and object to processing (Art. 15–21 GDPR). Write to fabianbezma@gmail.com. You can also complain to a data protection supervisory authority, in particular in the EU country where you live or work.

16. Children

The service is for businesses and adults. It is not directed at anyone under 16, and we do not knowingly process their personal data. If you believe a child has given us data, write to us and we will delete it.

17. Changes

When the service changes, we update this policy and the date at the top. Material changes are announced in the app before they apply.

18. Contact

fabianbezma@gmail.com · Fabian Egger, Eugen-Jäger-Straße 73, 67346 Speyer, Germany