Privacy policy

Last updated 11 November 2026

This policy explains what SendToSocial collects, why, how long we keep it, and the choices you have.

SendToSocial is operated by {{OPERATOR_NAME}}, {{OPERATOR_ADDRESS}} (“we”, “us”). We are the controller of your personal data under the UK GDPR and, where it applies, the EU GDPR. Send questions to {{CONTACT_EMAIL}}.

What we collect

Your sign-in details. When you sign in with Google we receive your email address, name and profile picture. We never see your Google password.
Connected accounts. When you connect an Instagram account, Facebook Page, YouTube channel or TikTok account, we receive access tokens (and refresh tokens where the platform issues them), the account's ID, name, username and profile picture, and the permissions you granted. Tokens are encrypted at rest. You sign in on the platform's own page, so we never see your platform passwords.
What you upload and schedule. Videos, poster images, captions, titles, posting options, and the accounts and times you choose. Video and image files are stored in Cloudflare R2. Post details, schedules and account records are stored in Cloudflare D1.
Post results and metrics. The ID each platform gives a published post, its status and any error, and metrics for your posts and accounts such as views, likes, comments, shares and followers.
Brands and settings. Brand names, which accounts belong to each brand, your time zone and other preferences.
Billing. Stripe runs checkout, subscriptions and the billing portal. We receive your Stripe customer ID, plan, subscription status, and trial and renewal dates. Card details go straight to Stripe and never touch our servers.
API keys and agent connections. If you create an API key or connect an agent through MCP, we store a hashed copy of the key or token and when it was last used.
Request logs. Our hosting provider processes your IP address, browser type and the pages and API endpoints you request, so it can deliver the service and protect it from abuse.

We don't collect information about the people who watch your posts, beyond the totals the platforms report.

How we use it

To sign you in and keep your workspace separate from everyone else's.
To upload, publish and schedule the posts you ask for, on the accounts you choose.
To show post status, views and engagement in the dashboard, the API and connected agents.
To run your subscription and free trial.
To contact you about your account, for example when a connection needs renewing, a post fails, or this policy changes.
To keep the service secure, prevent abuse and fix problems.
To keep records the law requires, such as tax and accounting records.

We don't sell your data, use it for advertising, share it with data brokers, or use it to train AI models.

Our legal bases under the UK GDPR and EU GDPR are: performing our contract with you (running the service you signed up for), our legitimate interests (security, preventing abuse and improving the service), and legal obligations (keeping accounting records). You can object to processing based on legitimate interests; see Your rights.

YouTube and Google

SendToSocial uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

Sign in with Google gives us your email address, name and profile picture, which we use to identify your workspace. When you connect a YouTube channel we ask for two further permissions:

Manage your YouTube videos (youtube.upload), to upload the videos you schedule with the title, description, privacy setting and other options you choose.
View your YouTube account (youtube.readonly), to show which channel is connected and to read views, likes and comments for your videos.

We use this data only to provide these features to you. We don't share it with anyone except the providers that run the service for us and as the law requires. We refresh stored YouTube metrics at least every 30 days. When you disconnect a channel, we delete its tokens and YouTube data.

You can remove SendToSocial's access at any time on your Google Account permissions page: myaccount.google.com/permissions. After that we can no longer upload to or read from your channel, and we delete the channel's tokens and YouTube data within 7 days.

SendToSocial's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram and Facebook

We connect to Instagram and Facebook through Meta's official APIs. Depending on how you connect, we ask for:

Basic profile (instagram_business_basic or instagram_basic): your Instagram professional account's ID, username, name and profile picture, to show which account is connected.
Content publishing (instagram_business_content_publish or instagram_content_publish), to post the videos you schedule.
Insights (instagram_business_manage_insights), to show views, likes, comments, shares and reach for your posts.
Facebook Pages (pages_show_list, pages_manage_posts, pages_read_engagement): the list of Pages you manage, permission to post to the Page you choose, and its engagement, so you can pick a Page, publish to it and see how posts performed.

We use this data only to provide these features to you. You can remove SendToSocial in your Facebook or Instagram settings, where connected apps and business integrations are listed. If you also ask for your data to be deleted, Meta passes that request to us; see Data deletion. Meta's practices are described in the Meta Privacy Policy.

TikTok

Basic profile (user.info.basic): your TikTok ID, display name and avatar, to show which account is connected.
Publishing (video.publish), to post the videos you schedule. Before each post we read your creator settings from TikTok, such as the privacy levels available to you, whether comments, duets and stitches are allowed, and the longest video you can post, so the post respects them.
Video list (video.list), only if you grant it: your videos and their view, like, comment and share counts, to show results.

We use this data only to provide these features to you. You can remove SendToSocial in the TikTok app under Settings and privacy, in the list of apps connected to your account. TikTok's practices are described in the TikTok Privacy Policy.

AI agents and the API

You can connect Claude, ChatGPT or another agent to SendToSocial through MCP, or call our API with a key. An agent can do what you can do in the dashboard: upload videos, schedule posts and read results. We receive only the requests the agent sends us, not your conversations with it. What the agent receives back from us is handled by its provider under your agreement with them, not by this policy. You can revoke a key or agent connection in Settings at any time.

Who processes your data

Provider	What for
Cloudflare, Inc.	Hosting, database (D1), file storage (R2) and network security.
Stripe	Checkout, subscriptions, invoices and the billing portal. See the Stripe Privacy Policy.
Google	Sign-in, and YouTube when you connect a channel.
Meta Platforms	Instagram and Facebook, when you connect them.
TikTok	TikTok, when you connect an account.

Cloudflare processes data on our instructions. Stripe, Google, Meta and TikTok also handle data under their own privacy policies. Once a post is published, the platform's policy governs it and it may be public.

International transfers

Our providers store and process data in the United States and other countries outside the UK and EEA. When personal data leaves the UK or EEA, we rely on adequacy decisions, including the EU–US Data Privacy Framework and its UK Extension where the recipient is certified, or on standard contractual clauses with the UK International Data Transfer Addendum. Ask us if you'd like details.

How long we keep it

Data	Kept until
Videos and posters	30 days after every destination for the post has finished (published, failed or cancelled). If you delete a post first, its files go with it.
Connected accounts	Tokens, profile details and metrics are deleted when you disconnect the account or delete your workspace.
Posts and history	Captions, schedules and results stay while your workspace exists, so you can see past posts.
Profile and workspace	Until you delete your workspace.
Billing records	As long as tax law requires, normally six years. Stripe keeps its own records under its policy.
Request logs	Up to 30 days.
Backups	Deleted data can remain in database backups for up to 30 days before it is overwritten.

Deleting a post in SendToSocial doesn't remove it from Instagram, Facebook, YouTube or TikTok. Delete it on the platform as well.

Security

All traffic uses HTTPS. Platform tokens are encrypted at rest and used only to act on your instructions. Access to production systems is limited to the people who run SendToSocial. If a breach affects your data, we'll tell you and the regulator as the law requires.

Your rights

Under the UK GDPR and EU GDPR you can ask us to:

give you a copy of your data;
correct data that's wrong;
delete your data;
restrict or stop processing, or object to processing based on legitimate interests;
send your data to you or another service in a common format.

Email {{CONTACT_EMAIL}} from the address you sign in with. We'll reply within one month. You can also complain to the Information Commissioner's Office or to the data protection authority where you live.

Cookies

We use essential cookies only: one keeps you signed in to app.sendtosocial.com, and a short-lived one protects sign-in and account connections from forgery. We use no advertising or analytics cookies and no third-party trackers. This website, sendtosocial.com, sets no cookies. Because these cookies are strictly necessary, we don't ask for consent.

Children

SendToSocial is for people aged 18 or over. We don't knowingly collect data from children.

Changes and contact

We'll post changes here and update the date at the top. If a change matters, we'll email you before it takes effect.