Privacy Policy.
How PostSwipe handles personal data, including data from TikTok and other accounts you connect.
1. Who is responsible
PrimeTech Solutions Sweden AB (corporate identity number 559491-3427), Gothenburg, Sweden, is the controller for the personal data processed in PostSwipe: the website postswipe.se, the web app postswipe.app and the PostSwipe iPhone app (the “Service”). Questions about privacy: [email protected].
If you use PostSwipe on behalf of a business, that business decides what material is uploaded. We process personal data in that material (for example people shown in images) in order to provide the Service to the business.
2. What we collect
- Account data: your email address, name if you provide it, the business/workspace you belong to, your role, and sign-in events. We sign you in with a link and a code sent to your email, or where offered with an account from a sign-in provider such as Google.
- Content: material you upload or provide (images, video, text, information about your business), the posts generated from it, your Yes/No decisions and the reasons you give, and your schedule.
- Connected social accounts: for each platform account you connect: an account identifier, username or display name, profile picture, the permissions granted, access and refresh tokens (stored encrypted), when the connection expires, connection status and delivery results for your posts.
- Technical data: IP address, browser and device type and logs of requests and errors, used to run and secure the Service.
- Beta waitlist: see the separate section below.
- Communication: what you write when you contact us.
3. TikTok data
If you choose to connect a TikTok account, you sign in with TikTok and approve PostSwipe’s access on TikTok’s own consent screen. We request only these permissions:
- user.info.basic: we receive your TikTok open_id (an identifier unique to PostSwipe), your display name and your profile picture (avatar). We use them to link the TikTok account to your workspace and to show you which TikTok account a post will be sent to.
- video.upload: lets us send a video you have approved in PostSwipe to your TikTok account as a draft. TikTok notifies you in your TikTok inbox, and you edit and publish the draft yourself in the TikTok app. We store the identifier and status TikTok returns for each upload so you can see that it was delivered.
We also store the access and refresh tokens TikTok issues, encrypted, so that we can deliver your approved drafts without asking you to sign in every time. If direct publishing is offered later, it will require your separate permission (video.publish). We would then also fetch your TikTok username, nickname and available privacy settings before each post so that you can choose them, and store your choices for that post.
What we do not do: we never send anything to TikTok that you have not approved, we do not read your TikTok videos, followers, messages, likes or analytics, we do not sell TikTok data or use it for advertising, and we do not use TikTok data to train AI models.
Storage and retention: TikTok data is stored in our database at Supabase in the EU (Stockholm, Sweden). It is kept while the TikTok account is connected. When you disconnect TikTok, or ask us to delete it, we revoke our access with TikTok where possible and delete the tokens and your TikTok profile data (open_id, display name, avatar) within 24 hours. The delivery history of individual posts (time and TikTok’s upload identifier, without profile data) stays with the post in your workspace until you delete the post or your account.
How to revoke access: disconnect TikTok under connected accounts in PostSwipe, or in the TikTok app go to Profile → Menu (☰) → Settings and privacy → Security & permissions → Apps and services, choose PostSwipe and remove access. You can also email [email protected]. TikTok’s own processing is described in TikTok’s Privacy Policy.
4. Why we use data, and our legal basis
- To provide the Service (create your account, generate suggestions, show them to you, schedule and deliver approved posts to accounts you connect, support): performance of our contract with you or the business you represent (GDPR Art. 6(1)(b)), and our legitimate interest in providing the Service to business customers (Art. 6(1)(f)).
- To improve your suggestions: your Yes/No decisions and reasons are used to make the next suggestions for your workspace better (Art. 6(1)(b) and (f)).
- Security and preventing misuse: logs and technical data (Art. 6(1)(f)).
- Beta waitlist: your consent (Art. 6(1)(a)).
- Legal obligations such as bookkeeping if you buy something from us (Art. 6(1)(c)).
We do not sell personal data and do not use it for advertising or profiling with legal or similarly significant effects.
5. Service providers we use
We use carefully selected providers that process data on our behalf under data processing agreements:
- Supabase: database, sign-in and file storage. Our project is hosted in the EU (AWS eu-north-1, Stockholm).
- Cloudflare: hosting of our websites, content delivery, DNS and protection against attacks. Cloudflare operates a global network, so requests may be handled at the location closest to you.
- AI generation providers (for example Higgsfield and other image, video and text model providers): receive the material and instructions needed to generate a suggestion.
- Email delivery: to send sign-in links, codes and service messages.
Scheduling and delivery of posts to the platforms is handled by PostSwipe’s own publishing service, which we operate ourselves on infrastructure we control. It is not a third-party service.
When you connect a social media platform (for example TikTok, Instagram, Facebook, LinkedIn or YouTube), we send the posts you approve to that platform. The platform is then an independent controller for its own processing under its own privacy policy.
6. Transfers outside the EU/EEA
We store our database in the EU. Some providers (for example Cloudflare and certain AI providers) may process data outside the EU/EEA, for example in the United States. In that case we rely on the EU Commission’s adequacy decision (such as the EU–U.S. Data Privacy Framework) or standard contractual clauses, together with additional safeguards where needed.
7. How long we keep data
- Account data and content: while your account is active. Content you delete is removed within 30 days. When an account is closed, its data is deleted within 30 days.
- Connected account tokens and profile data: deleted within 24 hours after you disconnect the account (see TikTok data above).
- Logs and technical data: up to 90 days, unless needed longer to investigate a security incident.
- Backups: deleted data can remain in encrypted backups for up to 30 days before being overwritten.
- Accounting records: seven years, as required by Swedish law, if you have bought something from us.
8. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict or object to processing, to data portability and to withdraw consent at any time. Email [email protected] and we will respond within one month.
You can also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
10. Beta waitlist
If you join the beta waitlist on postswipe.se we store your email address, when you signed up and from which page, technical information from the browser (browser type and referring page), and a one-way hashed value of your IP address used only to stop misuse. We use it only to invite you to the PostSwipe beta and send information about it. The legal basis is your consent, which you can withdraw at any time. We keep the data until the beta has ended or until you ask us to delete it.
11. Children
PostSwipe is a service for businesses and is not intended for anyone under 18.
12. Security
Data is encrypted in transit (HTTPS) and at rest, access tokens for connected accounts are stored encrypted, and access within PrimeTech is limited to what is needed to run and support the Service.
13. Changes
We may update this policy. Material changes will be announced by email or in the Service before they take effect. The date at the top shows when it was last updated.
14. Contact
PrimeTech Solutions Sweden AB
Corporate identity number 559491-3427
Gothenburg, Sweden
Email: [email protected]