Privacy Policy
Privacy Policy
Effective date: October 16, 2026. Current version: 2026-10-16. This policy explains how PostVenue accesses, uses, stores, shares, and deletes user data, including Google, YouTube, TikTok, Instagram, and Facebook data when you connect those platforms.
Who we are
PostVenue is operated by Kitefold Ltd, a company registered in England and Wales under company number 17498985, with its registered office at 82, Unit A James Carter Road, Mildenhall, United Kingdom, IP28 7DE. Kitefold Ltd is the data controller for the personal data this policy describes, and "PostVenue", "we", "us" and "our" in it mean Kitefold Ltd. You can contact us about your data at support@postvenue.com.
What PostVenue does
PostVenue lets you upload videos, connect supported social platforms, schedule publishing, and track publishing status from one dashboard. The integrations you can connect today are YouTube, TikTok, Instagram and Facebook, each described below.
Information we collect
We collect account details such as your name, email address, authentication identifiers, the country you signed up from (worked out from your IP address, and used to admit accounts country by country), uploaded media metadata (titles, descriptions, tags), job history, platform connection status, and product activity needed to operate the service. If you subscribe, we also keep your plan, your trial and billing dates, your payment status, and the identifiers Stripe gives your customer record and subscription. Your card details are collected and held by Stripe, our payment processor - PostVenue never sees or stores your full card number.
Platform connections
When you connect a platform, PostVenue stores encrypted OAuth tokens and the minimum account identifiers needed to run the connection: to upload the content you submit, refresh authorization, read publishing status, reconcile scheduled publishing, and let you reconnect or disconnect later. For content you publish through PostVenue we also read engagement statistics - view, like, comment, and share counts - to show that performance back to you. We read only the accounts you connect, and only the content you published through PostVenue. We do not sell this data, and we use it for nothing beyond the features you authorized. The sections below say what each connected platform specifically gives us; a platform we have not launched is not listed, and we will add its section here before that connection goes live.
YouTube data
PostVenue reads your channel's name and ID to label the connection, uploads the videos you submit, and reads their publishing status. Engagement statistics come from the YouTube Data API and the YouTube Analytics API; the share count is sourced from the Analytics API and may lag real time.
TikTok data
PostVenue reads your display name to label the connection, publishes the videos you submit through the Content Posting API, and reads their publishing status. Each time you compose a TikTok post, PostVenue also reads your account's current posting settings - the audiences available to you, whether comments, duets, and stitches are enabled, and your maximum video length - so the options we offer match what TikTok will accept. Those settings render the form and are not stored. Engagement statistics come from the TikTok Display API.
Instagram data
Instagram publishing runs through the Facebook Page your professional account is linked to, so PostVenue reads the Facebook Pages you choose to share with it in order to find that account, reads the account's username and id to label the connection, publishes the reels you submit, and reads their publishing status. PostVenue also reads engagement statistics - view, like, comment, and share counts, through Instagram's insights - for the posts you published through PostVenue, to show you their performance. The credential we store is an access token for that Page, held encrypted. PostVenue does not read your other Instagram media, your followers, or your messages.
Facebook data
PostVenue reads the Facebook Pages you choose to share with it, reads the name of the Page you connect to label the connection, publishes the videos and reels you submit to that Page, and reads their publishing status. The credential we store is an access token for that Page, held encrypted. PostVenue also reads engagement statistics - view, reaction, comment, and share counts, through the Page's insights - for the videos and reels you published through PostVenue, to show you their performance. PostVenue does not publish to your personal profile, does not read your friends, messages, or timeline, and does not read other people's posts or comments on the Page.
Our lawful bases
We process your data on these bases under UK GDPR. To provide the service you ask for - your account, uploads, scheduling, publishing to the platforms you connect, and your subscription - we rely on performing our contract with you. To keep accounts and the service secure, prevent abuse and enforce usage limits, and to keep a record that you confirmed you hold the rights to what you publish so we can defend a legal claim, we rely on our legitimate interests; you can object to this (see Your controls). To keep billing and tax records we rely on a legal obligation. Where we ask for your consent, for example if we ever add optional cookies or marketing email, you can withdraw it at any time.
How we use data
We use your data to authenticate you, upload videos you request, schedule publishing, reconcile platform state, prevent abuse, support the product, and maintain operational logs. We do not sell Google, YouTube, TikTok, or Meta user data.
How long we keep data
We keep account, upload, and job records as product history while the account is active. OAuth tokens are retained until you disconnect the platform, delete your account, or we no longer need them for the authorized feature. Uploaded media is subject to an automated retention policy and is eligible for deletion from our storage once publishing is confirmed or the retention period expires. Billing records - charges, refunds and invoices - are kept for as long as UK tax law requires, currently up to 6 years, including after you delete your account; Stripe keeps its own payment records under its privacy policy.
Content-rights confirmations
Each time you publish, you confirm you hold the rights to the content - including any music. We keep a minimised record of that confirmation: your email and name as they were at the time, the post's title, the destination platforms and the specific channels or accounts it was published to (their ID and name at the time), the version of these terms you agreed to, and the date, IP address, and browser used. Because these records exist to establish or defend legal claims (for example, if a third party alleges a copyright issue with content you published), we retain them for up to 6 years and - unlike the rest of your data - we keep them even after you delete your account, in this minimised form, as permitted under UK GDPR Article 17(3)(e). They are automatically deleted once the retention period ends, are used only for that legal-defence purpose, and are never sold.
Account deletion
When you request account deletion, PostVenue immediately cancels and removes scheduled posts that haven't yet been published from your connected platforms, revokes our access tokens, and removes drafts and in-progress uploads. Your account then enters a 30-day grace period during which you can recover it by signing in - completed post history is restored, but cancelled scheduled content and platform connections cannot be restored. After the 30-day grace period, the deletion request enters our review queue and is finalised within 3 business days, at which point your profile, history, settings, and any media we hold are permanently removed. The one exception is a minimised set of legal records we retain after deletion, for up to 6 years, solely to establish or defend legal claims: the content-rights confirmation records described under "Content-rights confirmations", and a small record that you accepted these Terms and this Privacy Policy (the versions you agreed to and when). Already-published videos on your connected platforms are not affected. Cancelling a subscription is a separate action from deleting your account: cancelling stops future billing and keeps your access until the end of the period you have paid for, while deleting your account also cancels any active subscription. Billing records are kept as described under "How long we keep data".
Sharing and subprocessors
We share data only with service providers needed to operate PostVenue, such as hosting (Vercel), authentication (Supabase), storage (Cloudflare R2), database (Supabase), background job processing and scheduling (Google Cloud), rate limiting (Upstash), payments (Stripe), email delivery (Resend), logging, and the connected platform APIs (Google/YouTube, TikTok, and Meta for Instagram and Facebook) you explicitly authorize.
Where your data is stored
PostVenue's serverless compute runs in London and our database is hosted in Europe, so account, upload, and job records are processed in the UK and the EEA. Uploaded media is held in Cloudflare R2. Some of our providers, and the platform APIs you authorize (Google/YouTube, TikTok, and Meta), operate globally, so data may be transferred to and processed in other countries. Where that happens we rely on the transfer safeguards those providers have in place, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
Your controls
You can disconnect a platform connection from the app at any time, which revokes the tokens PostVenue holds for it, and you can request account deletion from the app. You can also revoke PostVenue's access from the platform itself: for Google and YouTube, at your Google account permissions page; for TikTok, in the TikTok app under Settings and privacy > Security & permissions > Manage app permissions; for Instagram and Facebook, in your Facebook settings under Settings & privacy > Settings > Business integrations. If platform authorization is revoked - by you, by the platform, or by us - PostVenue stops using the related tokens and removes the related authorized data as required by policy. If you are in the UK or the EU you also have the rights to access, rectification, erasure, restriction, portability, and objection under UK and EU GDPR; you can exercise them from the app or by writing to support@postvenue.com, and you have the right to complain to your data protection authority, which in the UK is the Information Commissioner's Office. You can also complain to us first: write to support@postvenue.com with "Data protection complaint" in the subject line. We acknowledge every complaint within 30 days, look into it without undue delay, and keep you informed of the outcome.
Security
We use reasonable technical and organizational safeguards, including transport encryption and encrypted storage for OAuth tokens, to protect authorized user data against unauthorized access, loss, misuse, or disclosure.
Changes to this policy
We may update this policy as the product, our providers, or the law changes. Every version carries a version identifier and an effective date, both shown at the top of this page. When a change is material we ask you to accept the new version the next time you sign in, and PostVenue records which version you accepted and when.
Contact
Questions about privacy or data handling can be sent to support@postvenue.com.
Google API Services disclosure: PostVenue's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. What PostVenue does with YouTube data is in YouTube data above.
You can review and revoke Google access at Google security permissions.
TikTok API notice: how TikTok itself handles your data is covered by the TikTok Privacy Policy. What PostVenue does with it is in TikTok data above. TikTok exposes third-party app permissions in its mobile app only, so there is no web page to link here - the revoke path is under Your controls.
For privacy questions, contact support@postvenue.com.