1. Who is responsible
The controller is Frederik Bauer, Lessingstraße 35, 4020 Linz, Austria. For privacy questions, complaints, and requests, email webmaster@postreplay.com. See the imprint for more information.
This policy covers the PostReplay website and workspace. The platforms you connect have their own privacy policies.
2. Information we process
- Sign-in. Google supplies your account identifier and verified email address. PostReplay uses them to authenticate the workspace owner.
- Analytics. PostReplay uses YouTube API Services and Instagram’s APIs to retrieve account or channel identifiers, video and post details, and available aggregate watch, retention, and engagement metrics. It requests these when you use the analytics features.
- Uploads. The file you select, the target account, caption or description, publishing settings, and delivery status are used to complete your request. TikTok draft access, when enabled, uses the authorized TikTok account identifier and display name.
- Technical and support information. Hosting infrastructure may process request details such as IP addresses, user agents, and access or error logs. When you contact us, we use your message and contact details to respond.
3. Purposes and legal bases
We process the account and content information necessary to provide requested workspace features and support (Article 6(1)(b) GDPR, where applicable). You choose whether to connect each platform and which permission to grant. Without the relevant data or permission, the corresponding feature cannot run.
We process necessary security and operational information to protect the workspace, investigate failures, and prevent abuse (legitimate interests under Article 6(1)(f)). We retain or disclose records where necessary to comply with applicable law (Article 6(1)(c)).
We use Google user data to provide the user-facing features described here, consistent with the Google API Services User Data Policy, including its Limited Use requirements. PostReplay does not sell connected account data or use it for advertising.
4. Providers and international processing
- Railway hosts the web application and persistent storage in Amsterdam. See Railway’s privacy policy.
- Google and YouTube handle Google sign-in and YouTube analytics or uploads you authorize. See the Google Privacy Policy.
- Meta handles the Instagram permissions, analytics, and publishing actions you request. See the Meta Privacy Policy.
- TikTok handles TikTok account authorization and media you send to its inbox once the sandbox connection is enabled. See the TikTok Privacy Policy.
Providers may process data outside the EEA. Where GDPR transfer rules apply, an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses are required. Contact us for information about the safeguards relevant to your data. We may disclose information to authorities where legally required.
5. Storage and retention
The workspace sign-in cookie lasts up to eight hours. Separate encrypted connector sessions may last up to seven days in the browser. Meta publishing credentials may remain valid for up to 60 days. PostReplay stores publishing and draft connector credentials encrypted when it needs them for the requested action. Provider revocation and expiry determine when the credentials stop working.
PostReplay fetches analytics on demand. It stores queued Instagram media until publication or cancellation. A copy from a failed job is kept for up to 48 hours to allow a retry. Queue records are kept to show schedules and recent outcomes. PostReplay sends YouTube uploads and TikTok draft files to the platform you select. The platform’s own retention rules apply once it receives a copy.
Operational logs follow the hosting service’s retention settings and are used for security and troubleshooting. We keep correspondence while it is needed to resolve your request or meet legal obligations.
7. Revocation and your rights
To revoke YouTube access, use the connection controls in PostReplay or remove PostReplay in Google’s account permission settings. Use the relevant account settings in Instagram or TikTok to revoke those grants. Revoking access does not remove copies or schedules already accepted by the platform.
Contact webmaster@postreplay.com to request access, correction, deletion, restriction, or portability of your data, or to object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it for the future. You can also complain to the Austrian Data Protection Authority or another competent supervisory authority.