Privacy policy

The controller is Tim Hausl-Kramper, trading as THK-Media, sole proprietorship, Sonnweg 17, 3463 Stetteldorf am Wagram, Austria.

Privacy enquiries and requests can be sent to [email protected] or made by telephone at +43 660 133 0906. No data protection officer has been appointed because Selfpost is not subject to the appointment duty in Article 37 GDPR at its current scale; the controller is the direct privacy contact.

DPIA assessment status: The controller reviews whether a data protection impact assessment is required whenever a new high-risk processing activity is introduced.

This policy applies to the Selfpost website, web application, support, waitlist, billing, and publishing integrations. Most data comes directly from you. Connected platforms also provide account identity, permission, publication-status, and analytics data when you authorise a connection.

If a workspace customer invites another person or manages a client's social account, the customer is responsible for having authority to provide that person's data and for giving any additional information required by Article 14 GDPR.

We process account identifiers, email address, display name, optional avatar, authentication identities, session and security records, team invitations, roles, workspace membership, notification and display preferences, and support correspondence.

For the publishing service we process connected social-account identifiers and profile information, encrypted access and refresh tokens, media and metadata, captions, titles, first comments, platform choices and confirmations, drafts, schedules, publishing attempts, provider identifiers, status, and available analytics.

Selfpost AI (optional): when you or a teammate use an AI feature, we send what that request needs to the AI provider: the workspace's voice and topics, captions, titles, analytics summaries, review comments you ask it to summarise, chat messages, and for video understanding a few still frames and the video's speech (converted to text). Requests paid with Selfpost credits go to OpenAI as our processor; with your own ChatGPT plan or OpenAI key they go to OpenAI under your own agreement with OpenAI. We keep the results (video summaries, transcripts, ideas, insights, chat messages) in the workspace until you delete them or the workspace, and a usage log (feature, model, tokens, credits) for billing. AI suggestions are proposals only: nothing is published without your confirmation, and no decision with legal effect is made automatically.

The legal basis is performance of the Selfpost contract and steps requested before entering it (Article 6(1)(b) GDPR). Security, abuse prevention, service diagnostics, and reliable retry handling are based on our legitimate interests in operating a secure and dependable service (Article 6(1)(f)).

Instagram (Meta): when you connect an Instagram professional account we receive and store the Instagram user ID and professional-account ID, username, account type, and profile picture, an encrypted access token valid for about 60 days that we refresh while the account stays connected, the IDs and permalinks of posts published through Selfpost, processing status, and comment IDs for first comments you request. With the insights permission we read and store the views, reach, likes, comments, shares, and saves of those posts. With the comments permission we post the first comment you request under your own post and store its comment ID; we do not read other comments. Permissions used: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_insights.

TikTok: when you connect a TikTok account we receive and store the TikTok open ID, display name, username, and temporary avatar URL, encrypted access and refresh tokens, the Creator Info options TikTok returns (available privacy options, interaction settings, maximum video length), publish IDs and processing status, and, where the account granted it, the view, like, comment, and share counts of videos published through Selfpost. Permissions used: video.publish and video.list (statistics only). If you sign in with TikTok, the user.info.basic permission provides your display name and avatar only.

YouTube (Google): Selfpost uses YouTube API Services. When you connect a YouTube channel we receive and store the channel ID, title, handle, and thumbnail, encrypted OAuth tokens, the IDs and URLs of videos uploaded through Selfpost, upload and privacy status, the view, like, and comment counts you view in Selfpost, and the comment ID of a first comment you request. Permissions used: youtube.upload and youtube.force-ssl. Selfpost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google's privacy policy: https://policies.google.com/privacy. YouTube Terms of Service: https://www.youtube.com/t/terms. If you sign in with Google, the openid, email, and profile scopes provide your name, email address, and avatar only.

We use platform data only to display the connected account, publish what you schedule, show processing status, refresh the statistics you view, and post a first comment you request. We do not sell it, use it for advertising, or share it with other apps.

Workspace members can share a media review link so that a client or colleague can watch a video or image and approve it, request changes, or comment without a Selfpost account. The link itself is the credential; the pages are not indexed and are not shown inside any workspace.

When you open such a link we process the link token, the optional viewing password you enter, and the time of access. When you answer we store the decision, your comments, the name you type (optional), and the time. Your name and comments are shown to everyone who opens the same link or a link passed on from it, and to the members of the workspace that shared it. Your browser keeps the viewing grant and your name in session storage only until the tab is closed.

The workspace that shared the link decides whom to send it to and is the controller for the review it collects; Selfpost processes the data on its behalf under the Selfpost contract (Article 6(1)(b) GDPR) and, for security logging and abuse prevention, under our legitimate interest in a dependable service (Article 6(1)(f)). Review answers are kept as long as the media and the link exist and are deleted with them; the workspace can revoke a link at any time.

Free tools (selfpost.app/tools) need no account. Most of them run entirely in your browser: the files you open, check, crop or record there and the text you type are not sent to us.

Selfpost Send (selfpost.app/tools/send) is the exception, because sharing is its purpose. We store the files you send, with their names, sizes and types, in our object storage at OVHcloud in Frankfurt, and delete them 7 days after the upload finishes, or earlier when you delete them. Anyone holding the link can download them. To keep the free service from being misused, we store a keyed hash of your IP address with each transfer and count transfers per address over 24 hours. A recipient who reports a transfer may add details and an email address for our reply. Transfer records (without file names) and reports are deleted 30 days after the files. The legal basis is our legitimate interest in offering a free service and protecting it from abuse (Article 6(1)(f) GDPR).

Waitlist entries contain email address, locale, signup source, and timestamps. Whoever beats the Selfpost Invaders game (selfpost.app/play) and leaves an email address joins the waitlist too; we also store when they won and their best score, to send the promised voucher at launch. Entries are used for the requested launch update (with the voucher, where earned) on the basis of consent (Article 6(1)(a) GDPR). Consent can be withdrawn at any time by contacting us; withdrawal does not affect earlier lawful processing.

Invites and the partner program: if you arrive through an invite or partner link, your browser keeps the link's code for 60 days (local storage); Selfpost counts visits to a link per day without identifying anyone. If you make an account or join the waitlist through a link, we store whose link it was, plus the credits and payments needed for the reward (Art. 6(1)(b) GDPR, running the referral program). The person who invited you sees your first name and whether you pay; partners see their customers only as a number, never by name. To detect people inviting themselves, we compare Stripe's card fingerprint (not the card number). Partner applications contain name, email, channels, audience size, country and your message; payout details (account holder, IBAN or PayPal address, postal address, optional VAT ID) are stored encrypted and used only for payouts and bookkeeping (Art. 6(1)(b) and (c) GDPR). Declined applications are deleted after six months.

Support requests contain account and optional workspace context, category, subject, message, status, and timestamps. We use them to perform the contract or take requested pre-contract steps and, where applicable, for our legitimate interest in resolving service issues.

Operational messages such as verification, security, publication, reconnection, billing, and invitation emails are necessary for the contract or service security. We do not use provider tokens, private media URLs, or payment-card data in support messages.

Stripe processes checkout and payment-method details when billing is enabled. Current deployment status: used for checkout, subscriptions, and invoicing. Selfpost receives customer and subscription identifiers, plan, quantities, payment and subscription status, invoices or recovery links, and signed billing event metadata, but not complete card details.

Processing is necessary for the contract (Article 6(1)(b) GDPR) and for tax, accounting, and commercial record obligations (Article 6(1)(c)). Fraud prevention and billing reconciliation also serve our legitimate interests (Article 6(1)(f)).

When you connect or publish to Instagram, TikTok, or YouTube, you instruct Selfpost to send the selected account identity, media, captions, settings, and publishing commands to that platform and to receive status and analytics. The platform then also processes data under the agreement and privacy terms for your platform account: Meta at https://privacycenter.instagram.com/policy, TikTok at https://www.tiktok.com/legal/page/eea/privacy-policy/en, and Google at https://policies.google.com/privacy.

Selfpost's infrastructure providers are Contabo (European Union data centre) for the server and the database; OVHcloud (European Union data centres in Frankfurt, Germany) for media storage and backups; Cloudflare as the network proxy in front of the website and the API; Zoho/ZeptoMail for transactional email; and Stripe for billing. Their contracting entities and safeguards are listed on the Subprocessors page.

Platform recipients you select are Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Meta Platforms, Inc. (United States) under the EU-US Data Privacy Framework, TikTok Technology Limited, Dublin, Ireland and TikTok Information Technologies UK Limited, London; group companies outside the EEA may access data under TikTok's transfer safeguards, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC (United States) under the EU-US Data Privacy Framework. Revoke Selfpost's access at any time: Instagram at https://www.instagram.com/accounts/manage_access/ (Settings → Website permissions → Apps and websites); TikTok in the TikTok app under Settings and privacy → Security & permissions → Manage app permissions. You can also revoke Selfpost's access from the Google security settings page at https://security.google.com/settings/security/permissions. Disconnecting in Selfpost also revokes TikTok and Google tokens and deletes cached platform data.

If you connect an AI assistant such as Claude or ChatGPT (Account settings → AI assistants), you instruct Selfpost to answer that assistant's requests: it receives the posts, captions, media details, results, connected account names and client review notes of the workspaces you chose, and can prepare drafts there that wait for your confirmation. You choose the assistant's provider (for example Anthropic or OpenAI); it processes this data under your agreement with it and is not a Selfpost subprocessor. Selfpost never passes it your platform tokens, and it records when and for which workspaces you allowed the assistant. Disconnect it at any time under Account settings → AI assistants; its access ends at once.

Selfpost's own server and database are hosted by Contabo (European Union data centre), its media storage and backups by OVHcloud (European Union data centres in Frankfurt, Germany). Every request to the website and the API passes through Cloudflare (Cloudflare's global network; a request is usually handled in the data centre closest to the visitor; EU-US Data Privacy Framework certification of Cloudflare, Inc. and Standard Contractual Clauses in the Cloudflare Data Processing Addendum). Publishing to a platform transfers the selected content, settings, and account identity to that platform: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Meta Platforms, Inc. (United States) under the EU-US Data Privacy Framework (EU-US Data Privacy Framework and Meta's Standard Contractual Clauses); TikTok Technology Limited, Dublin, Ireland and TikTok Information Technologies UK Limited, London; group companies outside the EEA may access data under TikTok's transfer safeguards (European Commission Standard Contractual Clauses in TikTok's data processing terms plus TikTok's documented supplementary measures); Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC (United States) under the EU-US Data Privacy Framework (EU-US Data Privacy Framework and Google's Standard Contractual Clauses). Selfpost relies on the Standard Contractual Clauses and supplementary measures above; information about the transfer assessment is available from the privacy contact. Copies of the applicable safeguards can be requested at [email protected].

If a court, law-enforcement body, tax authority, regulator, or other public authority asks THK-Media to disclose personal data, we check before disclosing anything that the request is in writing, comes from an authority competent over us, names a legal basis, and is actually binding on us under Austrian or Union law. We do not disclose personal data on an informal or voluntary request.

Where a request appears unlawful, reaches beyond what its stated basis covers, or conflicts with the GDPR — in particular an order from a third-country authority with no recognised route through Austrian or Union law — we challenge it through the legal channels available to us. We do not disclose the data while a challenge with suspensive effect is pending.

We disclose only the specific records the request covers. We do not hand over an entire account, workspace, or media library when a narrower set answers the request, we exclude data about other workspace members and other customers, and we do not disclose access tokens, session tokens, or credentials unless an order names them explicitly and survives the checks above.

Where the law permits, we tell you before we disclose, so that you can seek your own remedy. If a request forbids us from telling you, we ask the authority to lift that prohibition. For data we hold as a processor for a workspace customer, we route the request to that customer and inform them under clause 4 of our data processing agreement.

We document every such request and our response to it: the authority and its case reference, the request as received, the legal basis cited, our own assessment and the reasoning behind it, who decided, what we disclosed and what we withheld, whether we informed you, and any challenge we brought. Aggregated, non-identifying information about the requests we receive is available to customers at [email protected].

Normal sessions expire after 7 days and remembered sessions after 30 days. Authentication and OAuth states expire after 10 minutes, action tokens after 30 minutes, invitations after 7 days, abandoned upload reservations after approximately 1 hour, and idempotency records after approximately 24 hours.

Media, drafts, posts, connected accounts, and workspace data are retained while the relevant account or workspace exists and until the user deletes them; library files that nobody has used for 30 days are deleted automatically, after a notice to the workspace at least 7 days before (on paid plans this can be switched off per file); when an account holds more than its plan includes for 30 days, for example after a subscription ends, earlier versions and then the files used longest ago are deleted until it fits, after notices to the account owner when the 30 days start and 7 days before; deleting a workspace or account removes them immediately, subject to backup rotation. Platform tokens are deleted immediately when you disconnect an account or delete the workspace or your account. Platform analytics and capability data: provider analytics and capability snapshots are refreshed by the scheduled synchronisation and deleted 30 days after their last refresh or immediately when the account is disconnected; audit records are deleted after 12 months. Support and email records: support requests are deleted 24 months after they are closed; delivered email records are deleted after 30 days.

Waitlist data is retained until consent is withdrawn or the requested launch communication no longer requires the entry. Billing records are retained for the applicable Austrian tax and accounting retention period, generally seven years, and longer where a pending proceeding requires it. So that each Instagram, TikTok and YouTube account gets the free trial once, Selfpost keeps a keyed one-way fingerprint of every account connected during a trial (not its name or id) for 24 months, also after the Selfpost account is deleted (legitimate interest in preventing misuse of the trial). Account deletion removes or anonymises operational personal data subject to mandatory retention. Disconnecting revokes Google and TikTok access at the provider and deletes the local tokens; for Instagram, Selfpost deletes its token immediately and you can additionally remove Selfpost under Apps and websites in Instagram.

Backups: database backups are taken daily and before every migration and are rotated automatically; daily backups are kept for 30 days on the server and, encrypted, for at most 31 days at a separate OVHcloud storage location in Germany, where they cannot be altered or deleted early; the latest 14 pre-migration backups are kept on the server.

Selfpost uses a secure HttpOnly session cookie and first-party locale, theme, and animation-preference storage. These are necessary to sign you in, remember choices, and provide requested application functions; they are not advertising cookies.

The application also stores local interface preferences, navigation history, and recent searches in local or session storage on your device. You can clear these using browser controls.

Optional site measurement is configured only as cookieless, non-advertising measurement and must not create cross-site profiles. If the deployed measurement setup changes to store or access non-essential device information, it will remain disabled until valid consent controls and this policy are updated.

Selfpost measures visits to its public website itself, without cookies and without storing or reading anything on your device. For each page view our server records the page address without its query string, the domain of the website that linked to it, campaign tags (utm_source, utm_medium, utm_campaign), a device class (mobile, tablet, or desktop), the country of the connection where our network provider reports it, and a hash of your IP address and browser identifier under a salt that changes every day, which lets us count unique visitors per day. The salt is deleted after two days, so older hashes cannot be linked to anyone, and your IP address itself is never stored. Pages of the signed-in app, review links, and invitations are never measured, and browsers that send Global Privacy Control or Do Not Track are skipped. The legal basis is our legitimate interest in understanding how people find Selfpost (Art. 6(1)(f) GDPR). The records stay on our own systems and are deleted after 400 days.

Depending on the circumstances, you have rights of access, rectification, erasure, restriction, data portability, and objection. Where processing relies on consent, you may withdraw it at any time. Where processing relies on legitimate interests, you may object on grounds relating to your situation; you may object to direct marketing at any time.

You can delete many records in the application, including your whole account from Account settings → “Your data”, and can request the remaining rights at [email protected]. We may need proportionate information to verify identity. Rights can be limited where a statutory exception applies, including mandatory retention or another person's rights.

Data export: Signed-in users can download a machine-readable JSON export of their account, workspaces, posts, media metadata, and analytics from Account settings; requests for other formats are handled through the privacy contact.

Account, authentication, workspace, and destination-specific publishing data are required to provide the requested service. Without them, the relevant account, connection, or publication cannot operate. Waitlist participation is optional.

Selfpost does not make decisions based solely on automated processing that produce legal or similarly significant effects within Article 22 GDPR. Preflight, capability, analytics, and any assistance features provide operational results or suggestions; the user chooses content, destinations, settings, and publication actions.

Measures include role-based workspace authorisation, encrypted provider tokens, hashed session and action tokens, private media storage with short-lived signed URLs, request validation, rate limiting, audit records, log redaction, and restricted production configuration. No internet service can promise absolute security.

Selfpost is intended for adults and business use and is not directed to children. Do not submit another person's sensitive data or content unless it is necessary and you have a lawful basis.

You may complain to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, [email protected], or to another competent supervisory authority, without prejudice to other remedies.

We will update this policy when processing materially changes. The current version and effective date are published at this stable URL; material changes affecting registered users will also be communicated through an appropriate account or email notice.