Privacy Policy.

Postroom is operated by Vardhiva Innovations, a sole proprietorship, using the YET — Not a Company Name Yet brand. Our contact address is GF 216, Gaur City Centre, D Block, Sector-04, Sector 18, Noida, Uttar Pradesh 201301, India. For privacy requests, email privacy@notacompanynameyet.com.

This policy covers Postroom and the website pages that support it. Social networks, hosting services and other independently operated services also have their own policies. Connecting an account does not transfer control of that network to YET.

We process the email address and account identifier used for application access, authentication/session information, workspace settings and information you provide when seeking support. Authentication is provided through Supabase. Social-network passwords are entered on the relevant platform's authorization pages; our application does not ask you to submit those passwords to YET.

When you authorize a connection, we receive identifiers for eligible accounts, Pages, channels or locations and profile information returned by the platform, such as display name, username and profile picture. We store access credentials and, where supplied, refresh credentials, granted permissions and expiry information so the server can perform the actions you authorize.

We process content you submit: captions, images, videos, links, destination settings, scheduling times, time-zone choices and brand guidance. Brand kits may include logos, reference creatives, typography and colour instructions, and uploaded PDF or text guidelines. Brand reference files are stored in a private bucket with owner-restricted access; temporary signed links are used to preview or open them. Detaching a reference removes it from your kit without immediately deleting the uploaded file. Deletion requests follow the process below. We also maintain delivery records such as processing state, attempts, error categories, provider identifiers and available publication links. Selected analytics or replies may be retrieved when a supported feature is used and the account has granted the necessary access.

Campaign rooms store briefs, source links, planned dates, comments, review history and references to publishing previews. Authorized workspace collaborators can access those records according to their roles. Manually entered enquiry records may include names, business contact details, sources, stage and notes; only enter information you are entitled to process. Customer-validation records may contain onboarding observations, support time and stated renewal feedback. Enquiry stages and referral labels do not establish causal marketing attribution. Contact support to request an export or deletion of these records.

We use this information to authenticate access; identify the selected social destination; prepare and deliver approved content; show publishing results and supported reporting; investigate failures; protect the service; and respond to requests. Authorization is not treated as permission to perform every action a platform offers. Features remain limited by implementation, the permissions you grant and provider rules.

Application logs and infrastructure services may process request timestamps, IP addresses, browser details, error information and security events. We aim to avoid putting social access tokens or app secrets in ordinary application logs. Do not include passwords or access tokens in captions, support screenshots or uploads.

TikTok connection data includes open_id, display_name and avatar_url; granted scopes, access and refresh tokens, and their expiry information. Approved publishing uses the video and editable caption you submit, selected destination, privacy, interaction, commercial-disclosure and AI-generated settings, schedule, publish_id, processing status, sanitised failure information and returned published-video identifiers.

When user.info.stats and video.list are granted, reporting can receive follower_count, following_count, likes_count and video_count, and public-video identifiers, titles, creation times, share/cover URLs and view, like, comment and share counts. Reports may use cached results and collected history. A comment count is not comment text or access to private conversations. Postroom does not currently offer TikTok direct-message access or comment replies through this integration.

Creator information is used to show the destination and validate available privacy choices, disabled interactions and the permitted video duration. We do not retain complete raw creator-info responses by default. TikTok credentials stay server-side; profile information, content and supported results are scoped to the authorising workspace. Requested TikTok results may be shared with an assistant only when you choose that assistant connection and request the result; access tokens and app secrets are not included.

Use Accounts → Disconnect to remove stored connection credentials and stop eligible pending jobs. For deletion of TikTok profile data, uploads, reporting caches or delivery history held by Postroom, follow our deletion instructions. Removal from Postroom does not remove content already held by TikTok. TikTok handles its own data under its Privacy Policy.

With the permissions you grant, Postroom processes eligible Page and professional-account identifiers, names, usernames, profile pictures, linked-account relationships, selected content and publication identifiers, and available aggregate insights. The inbox can retrieve comments/replies, their identifiers, author display information, text, timestamps and moderation state for supported accounts.

The Instagram messages feature can retrieve recent conversation/message identifiers, participants, message text and timestamps to display an authorised conversation and send a reply you confirm within the permitted response window. Message attachments can appear as a text notice. This does not provide Facebook Messenger, Threads DMs, cold outreach or bulk messaging.

When you explicitly enable an Instagram comment rule, we store the selected account/post, exact keyword, reply text, enabled state and processing receipts. Incoming comment webhook events can trigger that approved public reply on the chosen post. Removing the rule stops future matching triggers; a reply already sent remains on Instagram. Manual replies and moderation require the relevant permissions and confirmation. These features remain dependent on provider review, authorisation and operational setup.

Meta data is used for the connected-workspace features you select, not sold, licensed as a separate dataset or used for unrelated advertising audiences. Service infrastructure processes it as described below. Privacy and deletion requests can identify a Page, Instagram account or Threads profile; no social-network password is required. See revocation and deletion choices.

With your permission, Postroom receives TikTok account identifiers and available profile information and stores the authorization needed for supported publishing. Inbox Upload transfers your selected video for you to finish inside TikTok. Direct Post submits the content you approve with your selected privacy, interaction and commercial-disclosure settings under our approved Direct Post audit, subject to granted permissions, account eligibility and TikTok restrictions. We distinguish a transfer or processing receipt from confirmed publication.

We use this information for your account connection, approved publishing and status checks. We do not sell TikTok information or use it to build advertising audiences. TikTok controls its own processing, moderation and account availability.

When you connect LinkedIn, we receive the identity fields and permissions you authorize, such as your member identifier, name, photo and, where granted, email. We retain connection credentials, granted scopes, expiry information and records needed for the actions you request. Publishing applies only to your selected authorized profile or Page. Expired authorization requires reconnection.

The YET Community Management developer application has Community Management Development Tier access. Standard Tier production access has not been established. This approval belongs to that application; it does not establish that an existing Postroom connection uses its credentials or has its scopes. Additional functions are enabled only after the relevant approval, OAuth consent and technical verification.

The dedicated Community Management connection uses basic member identity, the authorized member’s current approved Page administrator roles, and Page identifiers/names to offer selectable destinations. Supported publishing uses text, images or video you approve. Page posts and comments are retrieved on demand in the community desk; raw retrieved post/comment content is not persisted by that desk. Confirmed comment/reaction/deletion actions retain minimal request fingerprints and receipts for duplicate prevention. Reporting for the dedicated Community Management connection is request-only: this path does not save API reports, reporting snapshots or daily history. Existing reports from earlier connections are not automatically removed by a new authorization; use the deletion process to request their removal. Independently supplied publishing drafts are separate from retrieved LinkedIn content. Where enabled and authorized, member post reporting can retrieve impressions, reach and supported engagement metrics using r_member_postAnalytics; profile reporting uses r_member_profileAnalytics for supported profile and follower statistics. Page reporting and engagement require separate organization permissions and the appropriate Page role. Available fields depend on the endpoint, API version and granted access. A scope listed in a developer portal is not a promise of a live Postroom feature or access to every LinkedIn metric.

LinkedIn-derived data is limited to the approved service and the account owner or authorized client. Member comments, reactions, follower identities and profile information must not be used to create prospect lists, enrich CRM records, train general-purpose models or support unrelated advertising, sales or recruiting. Providing this data to an external AI provider or assistant requires a separately permitted transfer; enabling a general AI or MCP connection does not itself authorize that transfer. Independently supplied drafts and brand instructions are distinct from data retrieved through LinkedIn APIs.

LinkedIn reporting must remain separately viewable from other networks. Permitted retention depends on the data category: other members' profile data is limited to 24-hour caching, member social activity to 48 hours, and non-member-level Page administration/reporting data to one year. Other categories follow LinkedIn's Data Storage Requirements; the shortest applicable limit controls. These limits do not authorize collection of a category we do not otherwise need or have permission to access. Data independently supplied by you is distinguished from API-retrieved data.

You may stop collection by disconnecting in Accounts or revoking Postroom in LinkedIn permitted services. To delete LinkedIn data held by Postroom, follow our LinkedIn deletion instructions. Requests are handled through our verified administrative process, not a claim of automatic deletion on disconnect. We must permanently delete applicable stored LinkedIn Marketing data within ten days or less of a verified deletion request, subject to any stricter applicable requirement. Published LinkedIn content remains on LinkedIn until separately removed there.

Pages Data Portability, Page Messaging, Lead Sync and advertising products are separate access decisions; they are not included merely because Community Management is approved. Any future additional collection requires the relevant access, disclosures and consent.

For Facebook and linked professional Instagram accounts, the app uses authorized Page/account information to discover destinations and publish supported content. Threads can supply identity, content, replies or aggregate insights for supported tools according to granted permissions. LinkedIn and Pinterest connections use access required for their implemented account, publishing and board-selection workflows. Feature presence does not mean platform approval or availability for every account.

When enabled, YouTube features use YouTube API Services. YouTube's Terms of Service and Google's Privacy Policy apply. You may review or revoke Google access at Google account connections. Google Business Profile information is processed only for authorized locations and implemented features you use. Revoking access does not itself remove posts already published on a platform.

Postroom uses Google API Services for the Google destinations you choose to connect. Google authorization for a social destination is separate from signing in to Postroom. We do not request Gmail, Google Drive, contacts, financial YouTube Analytics or unrelated Google account data for these integrations.

• YouTube: we access the authorized channel identifier, name and available profile information; its uploaded-video list and video identifiers, titles, descriptions, thumbnails, publication status and schedules; available comment threads, reply text, author display information and timestamps; and nonfinancial channel performance reports such as views, watch time and subscriber statistics.
• Business Profile: we access the business account and location identifiers and titles returned for locations you are authorized to manage, and the content and delivery identifiers needed for supported location-post publishing.
• Authorization and content: we store granted permissions, access and refresh tokens, connection identifiers, content you submit, requested actions, schedules and delivery/action receipts needed to operate these features.

The youtube.force-ssl permission supports video uploads, reading and editing video metadata, user-selected visibility and publication schedules, and reading and replying to comments. The separate yt-analytics.readonly permission supports nonfinancial reporting. The business.manage permission supports discovery of authorized business locations and publishing supported location posts. We do not use every operation a permission technically permits. Enabling a Google API in the developer console does not by itself enable an additional Postroom feature.

Uploads, edits, visibility changes, schedules and comment replies require your initiation or explicit confirmation. Approved scheduled content may be submitted later while your device is offline. We use Google data to provide these visible features, show delivery results and investigate service failures, not for unrelated profiling or advertising.

Postroom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use it for personalized or targeted advertising, transfer it to data brokers, use it for credit or lending decisions, or use it to develop, train or improve generalized or non-personalized AI/ML models. These limits also apply to derived Google data.

Google receives the API requests and content needed for the Google actions you approve. Vercel and Supabase process data as infrastructure providers for hosting, authentication, server processing, storage and delivery. If you choose an AI-assistant connection and request a supported result containing Google-connected information, that requested result is shared with the assistant provider you chose; OAuth tokens and app secrets are not included. Your assistant conversation is also subject to that provider's policy. We do not send Google data to an AI provider for generalized model training.

Human access to Google data is restricted to your affirmative agreement to view specific data for support, necessary security investigation, legal obligations, or permitted aggregated internal operations. Other disclosures are limited to providing the user-facing features with consent, security, legal compliance, or a business transfer after obtaining explicit prior consent where Google's rules require it.

Google credentials remain server-side in protected credential storage; database access controls restrict workspace records to authorized access. HTTPS protects network transmission and our managed infrastructure provides encryption at rest. We use report caches and action/delivery records for the requested reporting and publishing features; comments and video details are retrieved when you open or refresh those tools. We do not expose Google OAuth credentials in public media links.

Connection credentials are retained while needed for your authorized connection. YouTube API data is subject to YouTube's retention rules: non-statistical cached API data must be refreshed or deleted within 30 days; longer-lived authorized statistics require authorization checks at least every 30 days. This is a retention requirement, not a claim that every stored record is automatically erased on disconnect.

To stop a connection, use Accounts → Disconnect in Postroom. This removes its stored connection credentials and cancels eligible queued activity; it does not delete posts or videos already on Google. You can also revoke access through Google account permissions. Pausing publishing is not revocation or deletion.

To request deletion of Google-connected data held by Postroom, email privacy@notacompanynameyet.com from your account email, naming the connection. Do not send tokens or passwords. We handle verified requests through our administrative deletion process and delete the applicable YouTube user data as soon as possible and within seven calendar days. On detected authorization revocation, the applicable YouTube API data is removed as soon as possible and within 30 calendar days. Deleting Postroom-held data does not delete data held by YouTube or Google; manage published content in the destination service.

For all deletion choices, see Data deletion. Google handles data under Google's Privacy Policy; YouTube use is also subject to YouTube's Terms of Service.

We send approved content and the requests needed to operate a connection to the platform you select. That platform handles the content under its own terms and privacy rules, including publication settings.

YET uses Vercel for web hosting and delivery and Supabase for application authentication, database, media storage and server functions. Authorized operational personnel may access information where needed for support, security or a verified data request, subject to the stricter Google data access limits stated above. Information may also be disclosed where necessary to comply with an applicable legal obligation or address abuse/security incidents. We do not sell connected-account information or uploaded content to third parties for their advertising.

The current media-delivery system uses publicly retrievable object URLs so supported social networks can access selected images and videos. Anyone with an object URL may be able to retrieve that file, including before a scheduled post is published. Upload only material appropriate for this delivery model; do not upload confidential documents or sensitive personal material. Deleting a copy from YET does not delete copies a social platform or another recipient has already obtained.

Postroom is the product name; some provider developer portals may identify the application as Postroom. Email account registration uses Supabase authentication. Google sign-in, when configured, uses basic identity, email and profile access for application authentication; this is separate from permissions to publish to YouTube or Google Business Profile.

When you submit the early-access form, we store your email, optional name, whether you are a creator, business or agency, the request date and its access status. We use these details to manage access and related contact, not as blanket permission for unrelated advertising. Form submission does not grant publishing or administrator access.

The public caption, formatting, keyword, handle-format and image-splitting tools process their inputs locally in your browser. They do not upload those inputs to YET. Downloaded outputs remain on your device unless you upload them separately into the publishing workspace.

Current or testing integrations cover Facebook Pages, linked professional Instagram accounts, Threads, TikTok, LinkedIn personal profiles, Pinterest boards, YouTube channels and Google Business Profile locations. Each connection can process the profile/account identifiers, credentials, selected content, destination and delivery information needed for its implemented workflow. Analytics, comments and replies require additional permissions and are retrieved only for supported features. We do not claim that every listed network, account or feature has completed public platform review.

TikTok Inbox Upload and Direct Post are separate workflows. Inbox Upload requires creator completion in TikTok. Direct Post uses the separately granted publishing permission, creator privacy choices and content settings; the Direct Post audit is approved, while account eligibility, granted access, media URL verification and TikTok quotas still apply. Account authorization does not authorize unrelated actions or guarantee publication.

Brand guidance and content entered in YET are stored to support workspace features in use. An integrated AI feature must disclose the model provider and inputs it sends before it is made available. We do not claim that merely saving brand guidance trains a model. If you independently use an AI assistant to create content and upload it to YET, that assistant's handling of your conversations is governed by its own policy.

Application authentication and preferences may use cookies or browser storage. The corporate website uses analytics and attribution tools separately; our Cookie and Storage Policy describes the tools verified in the website implementation and available controls. Disabling necessary browser storage can prevent sign-in. A policy link alone is not a consent mechanism.

Workspace information, content and delivery history are retained while needed to operate the workspace, provide requested history, resolve problems or meet applicable obligations. Connection credentials can remain stored while a connection is paused; pausing stops publishing and is not a request to delete stored information.

You may request deletion of a connection, uploaded content or your workspace by emailing privacy@notacompanynameyet.com. We verify the request, identify the relevant workspace, stop eligible pending activity and remove relevant active-system records and stored credentials through the applicable administrative process. Where a limited record must be retained for security, a dispute or a legal requirement, we explain that restriction when responding. Provider logs and backups follow their applicable retention cycles. We do not promise immediate erasure from every backup or an independently operated social network.

See the Data Deletion instructions for what to include and how provider revocation differs from YET deletion.

You can pause publishing, cancel eligible pending posts and change provider permissions through the relevant platform. To request access, correction, a portable copy or deletion of information held by YET, contact our privacy address. Depending on applicable law, you may have additional rights to withdraw consent, object to processing or raise a complaint. We will explain any verification needed and respond according to applicable requirements.

Cloud hosting and service-provider operations may involve processing outside your location. We do not claim that all information stays in India or the European Union.

We use HTTPS, server-side credential storage and access controls intended to protect accounts and workspace information. No online system guarantees absolute security. Contact our privacy address if you suspect unauthorized use or a privacy incident.

Postroom is intended for adults managing content for accounts they are authorized to use. It is not directed to children. We may update this policy as the service changes. Material changes will be communicated through an appropriate service channel. Before using Google data for a new purpose not covered by your original consent, we will disclose the change and obtain the required renewed consent.

Supported or testing connections include Facebook Pages, linked professional Instagram accounts, Threads, TikTok, LinkedIn personal profiles, Bluesky, Pinterest boards and X. YouTube and Google Business Profile workflows are available subject to granted permissions, account eligibility and Google review; app branding verification is separate from data-access approval. YET registers the provider application; each customer authorizes their own accounts through official OAuth. Credentials are kept server-side and access to workspace records is restricted to the authorized workspace.

When you open Analytics or enable supported daily collection, we retrieve available account insights, follower snapshots, native post identifiers and performance counters. We store date-range report caches and collected follower history to display charts and export requested reports. Facebook, Instagram, Threads and Pinterest may provide views, impressions, reach or interactions according to permissions; Bluesky supplies public counters. X reporting is refreshed manually with explicit credit-use consent. TikTok statistics and video lists require separately approved permissions and reconnection. LinkedIn publishing permission alone does not grant analytics; supported reporting requires separately granted member or organization analytics permissions and a verified integration.

The read-only comments inbox retrieves available comment/reply text, author information, timestamps and original-post context for authorized Facebook, Instagram and Threads accounts. Reply, messaging and automation tools are separate, permission-dependent features; their availability is shown in the workspace. They are not enabled merely by opening the comments inbox. YET does not enable X Activity subscriptions in the current release.

Pinterest uses authorized account and board identifiers, Pin content and provider receipts for image, multi-image and single-video publishing; permitted account analytics can be retrieved for reporting. Pinterest Standard access is approved; board/account settings, content eligibility and granted permissions still apply. X uses account identity, post-read, post-write, media-upload and offline-access permissions for scheduling, publishing, connection renewal and requested reports. We do not request DM, mute or block permissions for the current X workflow. Bluesky uses AT Protocol OAuth for supported account and media publishing; public profile and post counters support reporting.

LinkedIn personal profiles support text, images and video through member publishing permission. Company Page publishing and broader community management require separate access. TikTok supports Inbox Upload, which requires creator completion, and a separate Direct Post workflow where permissions and audit status allow; our Direct Post audit is approved; account restrictions, explicit approval and confirmed publication receipts still apply.

You may save a title, description and up to eight destination links, then explicitly publish a public Smart Links page. Published page text and links are public. Aggregate destination click-request counters include repeated requests and bots and are not unique visitor counts. The counter does not store visitor identities; hosting infrastructure can still process ordinary request/security logs. Requests to delete a workspace may include report caches, collected history, Smart Links content and counters as well as connection credentials and uploads.