Privacy policy

What this covers

This policy describes the PostByAgent website and invited development tests. Customer social connections are not open. The public workflow preview uses fictional content and simulated outcomes.

PostByAgent provides infrastructure for publishing content supplied by you and your agent. Your agent provider and each connected social platform handle data under their own policies. Questions about this policy can be sent to support@postbyagent.ai.

Data used in invited tests

• Identity and access. Clerk handles sign-in and delegated agent authorization. PostByAgent uses account identifiers, Business membership and permissions to control access. A verified account email may be retrieved for operational contact.
• Social connections. When a test integration is enabled, provider authorization supplies account identifiers, granted permissions and access credentials. Credentials are encrypted on the server. PostByAgent does not ask for your social-platform password.
• Content and publishing. Uploaded files, captions, destination choices, schedules and publication outcomes are stored to execute and inspect your requests. Media is stored in private Google Cloud storage; authorized provider transfers use temporary access. This is not end-to-end encryption.
• Performance. Enabled analytics retrieve supported native social measurements. The current YouTube implementation fetches counters on request, rather than keeping a history of those measurements.
• Operations and contact. Technical request and failure information helps operate the service. Messages you send to our support inbox are handled through Resend. Controlled development tests send missed-publication notices to the verified Owner contact. Reconnection notices are not enabled.
• Billing tests. The implemented Stripe integration is restricted to sandbox billing. Live customer payments are not enabled by this website.

How data is used and shared

Data is used to authenticate access, execute requested publishing work, report results and supported analytics, investigate failures and respond to requests. Google Cloud hosts the application, PostgreSQL database and media storage. Clerk handles identity, Resend handles the established email inboxes, and Stripe handles sandbox checkout in invited tests.

Content and necessary account information are sent to the social destinations you choose. Your agent receives the results of operations it is authorized to request. Do not grant an agent access unless you trust its provider and configuration.

This website does not add advertising pixels or visitor analytics. Invited sign-in and connected-platform flows can use their providers’ cookies and session storage for authentication.

Where data is processed

Sandbox Software Pty Ltd is based in New South Wales, Australia. Our Google Cloud application, database and media resources are located in the United States. Using the service can therefore involve processing outside Australia. This location describes our Google Cloud resources; Clerk, Resend, Stripe, your agent provider and social platforms handle data through their own services and locations under their own policies.

Retention and your requests

The implemented upload cleanup makes unused media eligible after thirty days, or thirty days after its last use. Pending, processing and unresolved work can protect an upload from ordinary cleanup. This rule is not a universal deadline for deleting account or social API data.

Publication records, social credentials and support correspondence have separate handling. Database recovery keeps a rolling set of automated backups, plus seven days of transaction logs. On-demand database backups also exist and remain until manually deleted; the automated schedule does not set their expiry. Production media storage keeps deleted objects recoverable for seven days. Removing active data does not immediately remove these copies.

See data deletion for the available request channel and the distinction between our stored data and posts on a social platform. Treatment of recovery and operator-held copies remains under review, so we cannot confirm erasure of every copy. Customer account-data deletion is not yet available.

Google and YouTube

Enabled YouTube connections use YouTube API Services. Their data is used for the publishing, account-status and supported analytics operations you authorize. See the Google Privacy Policy and YouTube Terms of Service.

You can review or revoke Google access through Google security settings. Revoking access and requesting removal of stored data are separate actions; contact support@postbyagent.ai about stored data. A revocation can stop future access without removing a video already on YouTube.