This policy explains which personal data Autoposter Connect processes, for which purposes, on what legal basis, who it is shared with and how long it is kept. Autoposter Connect is a business service that publishes short-form videos to the account owner's own social media profiles.
1. Controller
Schulten Solutions, Hans-Justus Schulte, Piepenborn 19, 33039 Nieheim, Germany. E-mail: admin@autoposter-connect.com. There is no statutory obligation to appoint a data protection officer.
2. Access to the service
There is no public sign-up. Clients receive a personal access link. On access we set a signed session cookie containing only the client identifier and an expiry time. It is strictly necessary to operate the service (Art. 6(1)(b) GDPR) and is not used for advertising, profiling or analytics. If a client installs the app, we additionally store the push subscription issued by their browser until they revoke it.
3. Content the client provides
To deliver the service we process the video recordings the client uploads, the transcripts generated from them, the scripts, captions and finished videos, and the conversation history with the assistant that produces those scripts. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
4. Connected TikTok account
Clients may connect their own TikTok account so that finished videos can be published and their performance read back. Sign-in happens exclusively at TikTok; we never see or store a TikTok password.
| What we receive from TikTok | Why |
|---|---|
| Access token and refresh token | To publish on the client's behalf and to read back metrics. Stored encrypted; access restricted to the service. |
Open ID, display name, avatar (user.info.basic) | To show the client which account a video will be published to, before publishing. |
| Creator settings (privacy options, whether comments, Duet and Stitch are allowed, maximum duration) | To offer only the settings this account actually permits, as required by TikTok. |
| Publication status and metrics of the client's own videos (views, likes, comments, shares) | To show the client how their own videos performed. |
We do not collect data about other TikTok users, we do not read a client's follower list, and we do not use TikTok data for advertising, profiling, training of models or resale. TikTok data is used only to deliver the functions described above.
5. Connected Instagram account
The same applies to a connected Instagram account (Meta Platforms Ireland Ltd.): sign-in at Meta, tokens stored encrypted, data limited to publishing the client's own content and reading its metrics.
6. Withdrawing access
Clients can disconnect a platform at any time, either in our app or in the settings of TikTok or Instagram. Disconnecting deletes the stored access and refresh tokens immediately. Videos already published on the platform remain there and are governed by that platform's terms; they can be removed by the client in the platform's own app.
7. Processors and recipients
We use the following processors, each under a data processing agreement pursuant to Art. 28 GDPR:
- Hosting and database: Railway Corp. (USA) and Supabase Inc. (USA), servers in the EU.
- Speech-to-text and text generation: OpenAI Ireland Ltd. and OpenRouter Inc. (USA), used for transcription and for drafting scripts.
- Voice synthesis: ElevenLabs Inc. (USA).
- Messaging, where the client chooses it: Telegram FZ-LLC.
Transfers to the USA are based on the EU standard contractual clauses. We do not sell personal data and we do not pass it on for advertising purposes.
8. Retention
| Data | Kept |
|---|---|
| Access and refresh tokens | Until the client disconnects the platform, then deleted immediately |
| Recordings, transcripts, scripts, finished videos | For the term of the contract, deleted on termination or earlier on request |
| Metrics of published videos | For the term of the contract |
| Server logs | 30 days |
Statutory retention obligations, in particular under German commercial and tax law, remain unaffected.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Requests go to admin@autoposter-connect.com and are answered within one month.
Deleting your data. Write to admin@autoposter-connect.com with the subject "Delete my data". We delete the account, all recordings, transcripts, scripts, finished videos, metrics and tokens within 30 days and confirm in writing. You can remove our access to TikTok yourself at any time under Settings, Security and permissions, Manage app permissions in the TikTok app.
You may lodge a complaint with a supervisory authority. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Germany.
10. Children
The service is offered business to business and is not directed at consumers or at anyone under 18. We do not knowingly process data of minors.
11. Security
All transfers are encrypted with TLS. Tokens are stored in the database with access restricted to the service; platform application secrets are held as environment variables and never in source code. Access to the dashboard is limited to the respective client identifier.
12. Changes
We update this policy when the service or the legal situation changes. The version published here applies, with its date shown above.