Privacy policy

1. General

1.1. This Policy sets out how personal data is processed and protected in the Autoposter service. It is published under Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27 July 2006 on Personal Data (the Personal Data Law).

1.2. The data controller (operator) is individual entrepreneur Kuschiy Stepan Romanovich (the Operator). Contact and company details are in section 15.

1.3. The Policy covers all personal data the Operator receives through autoposter.one, the user account, the service's Telegram bot, approval pages and public link-in-bio pages (together, the Service).

1.4. Consent to processing is a separate document: Consent to personal data processing.

2. What we process

• name and email; a salted password hash (never the password itself);
• Telegram ID and username if you sign in with Telegram or turn on bot notifications;
• connected platform accounts: ID, name, link and the access tokens the platform issued, stored encrypted. We never ask for platform passwords;
• your content and publishing data: files, captions, hashtags, schedule, statuses, links to published posts and the view counts platforms report;
• support conversations; team membership, roles and approvals;
• payment records: amount, date, status and the transaction number at Platega (platega.io). Card details are entered on the payment provider's page and never reach us;
• session data: IP address, browser, device and sign-in time;
• for site visitors: a visitor cookie ID, IP address and the country and city derived from it, browser, device type, language, referrer and pages viewed;
• for people approving posts by link: the name and comment they type in.

We do not process special categories of personal data or biometric data.

3. Purposes and legal bases

4. How data is processed

The Operator collects, records, organises, stores, updates, retrieves, uses, transfers, blocks, deletes and destroys personal data by automated means. Personal data of Russian citizens is recorded and stored in databases located in the Russian Federation (Art. 18(5)). Hosting provider: АО «ИОТ», Российская Федерация. No decisions with legal effect are made solely by automated processing.

5. Who receives data

We never sell personal data. It goes only to: the payment provider Platega (platega.io) (payments and refunds); the hosting provider (storage on our behalf); the platforms you connect yourself, which receive your content through their official APIs; Telegram, if you use the bot; the language model provider, when you press an AI button (post text and a few video frames; requests are handled by a language model through an intermediary service; your name, email and other account data are not included); an IP geolocation service (IP address only, for visit stats); and public authorities when the law requires it. Processors are bound by confidentiality and the security duties of Art. 19.

6. Transfers outside Russia

Some platforms and providers are located abroad: YouTube (Google LLC, USA), TikTok (TikTok Pte. Ltd. and affiliates), Instagram* (Meta Platforms Inc., USA), Telegram, the language model provider and the IP geolocation service. Data reaches them only when you connect that platform or use that feature. Cross-border transfers follow Art. 12 of the Personal Data Law, including prior notification of Roskomnadzor.

* Instagram is owned by Meta Platforms Inc., whose activities are recognised as extremist and banned in the Russian Federation.

7. Cookies

We use no third-party advertising or analytics cookies.

8. Retention

• account data and content: while the account exists, then destroyed within 30 days of deletion;
• platform tokens: deleted as soon as you disconnect the platform;
• payment records: 5 years (accounting law);
• visit records: 90 days;
• support conversations: up to 3 years after account deletion (limitation period).

9. Your rights

You may request information about the processing of your data, have it corrected, blocked or destroyed, withdraw consent, object to processing, and complain to Roskomnadzor (rkn.gov.ru) or a court. Send requests to noreply@autoposter.one from your account email. We reply within 10 working days, extendable by 5 working days with a reasoned notice. After consent is withdrawn, data is destroyed within 30 days unless the law requires otherwise.

10. Deleting your account and data

To disconnect one platform, press Disconnect next to the channel; its token is deleted immediately. You can also revoke the app's access in the platform's own security settings. To delete the whole account, write to support in the dashboard or to noreply@autoposter.one from your account email with the subject "Delete my account". Your account, content, tokens and publishing data are destroyed within 30 days and you receive a confirmation. Payment records are kept as long as the law requires.

11. Security

HTTPS everywhere, hashed passwords, AES-256-GCM encrypted platform tokens, need-to-know access and admin action logs. If a data leak is detected, Roskomnadzor is notified within 24 hours and given the investigation results within 72 hours.

12. Third-party data in your content

If your content, comments on your posts or your team list contain other people's personal data, you are the controller of that data and the Service processes it on your behalf only to publish, collect comments and send auto-replies. You confirm you have a lawful basis for that.

13. Age

The Service is for people aged 18 and over.

14. Changes and contacts

We may update this Policy. A new version applies from publication on this page; material changes are announced in the dashboard or by email. Privacy questions: noreply@autoposter.one.