Legal · Terms of Service

Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how WEB SERVICES OUTSOURCING ("we", "us") collects, uses and protects personal data when you use our social media management application available at https://postiz.oprtr.fr (the "Application"), including when you connect a YouTube, Facebook, Instagram or TikTok account to it.

1. Who is responsible for your data

The data controller is WEB SERVICES OUTSOURCING, a French société par actions simplifiée (SAS) with a share capital of €10, registered under SIREN 911 075 356, with its registered office in Paris, France. Represented by Noah Delophont, President.

Contact for any privacy question or request: noah.delophont@web-services-outsourcing.eu.

2. What the Application is

The Application is a self-hosted instance of the open-source software Postiz, operated by us on our own servers. It is used internally by WEB SERVICES OUTSOURCING and the people we authorise, to schedule, publish and analyse content on social media accounts that they own or manage. Public sign-up is disabled.

3. Data we collect

• Account data: the name, email address and password (stored only as a hash) of authorised users of the Application.
• Connected social accounts: when you connect a YouTube, Facebook, Instagram or TikTok account, we receive from that platform the account or page identifier, name, username and profile picture, and the access and refresh tokens that allow the Application to act on your behalf, within the permissions you approved.
• Content: the posts, texts, images and videos you create, upload or schedule in the Application, and their publication status.
• Analytics: statistics about your published content and accounts that the platforms make available through their APIs (for example views, likes, followers), when you use these features.
• Technical data: server logs (IP address, date and time, requested page) kept for security and troubleshooting.

We do not use cookies for advertising or tracking. The Application uses only the cookies strictly necessary to keep you signed in.

4. How we use data

• to let you sign in and use the Application;
• to publish, schedule and manage content on the social accounts you connected, only at your request;
• to display analytics about your content and accounts;
• to send service emails (account activation, password reset, notifications);
• to keep the Application secure and working.

Legal bases (GDPR): performance of the service you requested (Art. 6(1)(b)), our legitimate interest in operating and securing the Application (Art. 6(1)(f)), and your consent when you connect a social account (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell your data, use it for advertising, or share it with third parties other than those listed below.

5. Data received from Google / YouTube

The Application uses YouTube API Services. By connecting a YouTube account you agree to the YouTube Terms of Service, and Google's processing of data is governed by the Google Privacy Policy. Data obtained from YouTube is used only to provide the features described above. You can revoke the Application's access at any time from your Google account security settings: https://security.google.com/settings/security/permissions. The Application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data received from Meta (Facebook, Instagram) and TikTok

Data received through the Facebook, Instagram and TikTok APIs is used only to publish and manage content and display analytics for the accounts and pages you connected. Your use of those platforms remains governed by their own terms and privacy policies: Meta Privacy Policy, TikTok Privacy Policy.

7. Where data is stored and who can access it

All data is stored on servers we operate, hosted by OVHcloud in France (European Union). Access is limited to WEB SERVICES OUTSOURCING. Our processors are: OVHcloud (hosting and email sending). When you publish content, it is transmitted to the social platform you selected (Google/YouTube, Meta, TikTok), which processes it under its own policies.

8. How long we keep data

• Connected account data and tokens: until you disconnect the account in the Application or ask us to delete it.
• Content and analytics: as long as your user account exists, or until you delete them.
• User accounts: until the account is closed.
• Server logs: at most 12 months.

9. Deleting your data

You can delete your data at any time:

1. Disconnect a social account from the Application's channel settings. This removes its stored tokens.
2. Revoke access on the platform itself:
   • Facebook / Instagram: Facebook Settings & privacy → Settings → Business integrations, then remove the app; on Instagram, Settings → Apps and websites.
   • Google / YouTube: https://security.google.com/settings/security/permissions.
   • TikTok: Settings and privacy → Security → Apps and services permissions.
3. Ask us to delete all data related to you or your accounts by emailing noah.delophont@web-services-outsourcing.eu with the subject "Data deletion request". We will delete it within 30 days and confirm by email.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise them, email noah.delophont@web-services-outsourcing.eu. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

11. Security

Connections to the Application are encrypted (HTTPS). Passwords are stored hashed. Access tokens and data are kept in databases that are not reachable from the internet, on servers accessible only to us.

12. Changes

We may update this policy. The date at the top shows the latest version. Significant changes will be communicated to authorised users of the Application.