This policy explains how Craft AI Solutions ("we", "us") handles information in the self-hosted Postiz instance at postiz.craftai.solutions (the "Service"). The Service is a social media scheduling tool used by our own team to publish content to social media accounts we own or are authorised to manage. It is not offered to the general public.
Craft AI Solutions. Contact: [email protected].
The Service is self-hosted on infrastructure we control. Application data is held in a PostgreSQL database and uploaded media on server storage, both on that same server. Data is not sold, rented, or shared with advertisers or data brokers.
| Category | Detail | Why |
|---|---|---|
| Account details | Email address and a hashed password for each user of the Service | Authentication |
| Platform access tokens | OAuth access and refresh tokens issued by connected platforms (for example TikTok, Instagram, Slack) | To publish content you schedule, on your behalf |
| Connected account profile | Account/username, display name, avatar and basic profile fields returned by the platform | To show you which account a post targets |
| Content you create | Post text, images and video you upload, and scheduling times | To publish at the scheduled time |
| Performance data | Post and account metrics returned by the platform | To display analytics back to you |
We do not collect data about the followers or audiences of connected accounts beyond aggregate metrics the platform itself returns, and we do not build advertising or tracking profiles of any individual.
When you connect a social account, the platform issues us a token scoped to the permissions you approve. We use that token only to perform the actions you request in the Service — publishing content you have composed, and reading back your own account and post information to display it to you. We do not use platform data for any other purpose, do not transfer it to third parties, and do not use it to train machine learning models.
Content you schedule is transmitted to the social platform you selected, so that platform's own privacy policy governs it once delivered. Our server infrastructure and DNS/CDN providers process traffic in the course of hosting the Service. We do not use third-party advertising or analytics trackers on this Service.
Account records, scheduled posts and uploaded media are kept until deleted in the Service or the account is removed. Disconnecting a social account removes its stored tokens. You can request deletion of all data associated with you by emailing [email protected]; we will action it within 30 days. You may also revoke our access at any time from the connected platform's own app settings, which immediately invalidates the token.
Traffic to the Service is encrypted in transit with TLS. Access to the server and database is restricted to authorised administrators. No system is perfectly secure, and we cannot guarantee absolute security.
Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to certain processing. Contact us at the address above to exercise them.
The Service is not intended for, and is not made available to, anyone under 18.
If this policy changes materially we will update the date at the top of this page.