Privacy Policy

1. Scope

This policy applies to autopostmd.com, the AutoPostMD application, support interactions, and the related video preparation, scheduling, and publishing services. It does not replace the privacy policies of social platforms you choose to connect.

2. Information we collect

With your permission, public pages use Google Analytics to measure page visits and successful founding-access applications. Analytics is off until you choose Allow analytics. Google may receive a browser identifier, basic device information, your IP address, and the public page visited. We do not send form answers, account information, uploaded content, connected-platform data, URL query strings, or URL fragments to Google Analytics. Analytics is not loaded in the dashboard, login, or authorization flows. Advertising features are disabled. You can decline or withdraw permission using Cookie preferences on any public page; withdrawing removes our analytics cookies. Your choice is remembered in this browser. Essential authentication and security storage is separate.

• Account information: name, email address, authentication information, physician or practice profile, timezone, and preferences.
• Content: videos, audio, transcripts, thumbnails, titles, descriptions, captions, hashtags, edits, and scheduling instructions.
• Connected-platform information: selected account or channel identity, granted permissions, OAuth tokens, token expiration, connection status, provider identifiers, publishing results, and errors.
• Service information: device, browser, IP address, logs, security events, feature interactions, support messages, and diagnostic information.
• Billing information: subscription, invoice, and payment status. Payment-card details are processed by our payment provider and are not stored directly by AutoPostMD.

3. Google and YouTube user data

When you choose to connect YouTube, AutoPostMD uses Google OAuth and the YouTube Data API. The only YouTube scope we request is https://www.googleapis.com/auth/youtube.upload. We do not request youtube, youtube.readonly, or youtube.force-ssl.

Data AutoPostMD may access

• OAuth access tokens, refresh tokens, expiration information, and the permissions Google reports as granted.
• The video file, title, description, tags, and privacy setting you submitted for that upload.
• The video id and watch URL YouTube returns from that upload (videos.insert).

Why AutoPostMD uses that data

• Upload a video you selected to the YouTube channel that completed Google's consent screen.
• Set the title, description, tags, and privacy status on that upload.
• Show the watch URL YouTube returned so you can confirm the post.
• Keep the connection until you disconnect it, revoke access, delete your account, or the credentials expire.

AutoPostMD does not sell Google user data, use it for advertising, or use Google user data to train generalized artificial-intelligence or machine-learning models. Humans do not review Google user data except with your affirmative permission for support, when needed for security or abuse investigation, or when required by law.

AutoPostMD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Instagram

When you choose to connect Instagram, AutoPostMD uses Instagram Login for Business. We access Instagram data only after you grant permission on Instagram's consent screen. instagram_business_basic identifies the professional account. instagram_business_content_publish is used to publish to that account.

Data AutoPostMD may access

• Professional account identity needed to show the destination: Instagram user id, username, and account type (Business or Creator).
• OAuth access tokens, expiration information, and the permissions Instagram reports as granted.
• Publishing results for content you submitted through AutoPostMD, such as container id, media id, processing status, and error messages.

Why AutoPostMD uses that data

• Show the Instagram account you connected.
• Publish the video or photo and caption for that connected account.
• Show whether Instagram accepted, processed, or rejected that publish request.
• Keep the connection until you disconnect it, revoke access, delete your AutoPostMD account, or the credentials expire.

AutoPostMD does not sell Instagram data, use it for advertising, scrape Instagram, read comments or Direct Messages, or request insights permissions. Humans do not review Instagram user data except with your affirmative permission for support, when needed for security or abuse investigation, or when required by law.

Use of Instagram APIs is subject to the Instagram Platform Terms and Meta Platform Terms. You can disconnect Instagram inside AutoPostMD or revoke access in Accounts Center.

Meta data deletion requests are processed at https://api.autopostmd.com/api/v1/meta/data-deletion. Status is shown at autopostmd.com/data-deletion.

5. How we use information

• Create and secure your account and provide the features you request.
• Receive and process uploaded media, prepare editable publishing drafts, and preserve your changes.
• Connect the destinations you authorize and submit content only after your publishing confirmation.
• Schedule jobs, retrieve publishing status, display provider results, and support retries or reconnection.
• Process subscriptions, send service communications, prevent abuse, diagnose failures, and comply with law.

6. When information is shared

We share information only as needed to operate AutoPostMD, follow your direction, protect the service, or comply with law. Recipients may include infrastructure, hosting, storage, database, authentication, email, payment, logging, security, transcription, and AI-processing providers under appropriate service obligations.

Videos and the publishing fields you approve are sent to the social platforms you select. Those platforms process the information under their own policies. We may also disclose information during a business transaction, with your consent, or when legally required.

7. AI-assisted processing

AutoPostMD may send uploaded or transcribed content and limited profile context to contracted AI services to prepare the draft fields you request. Outputs remain editable and are not published until you confirm the campaign.

We do not use Google user data or connected-platform credentials to train generalized AI models. Do not upload protected health information or patient-identifying material to AutoPostMD.

8. Storage, retention, and security

We retain account data, active content, connection credentials, and publishing records while needed to provide the service. When you delete your account or make a verified deletion request, we remove covered information from active systems subject to completion of in-flight publishing, provider revocation, fraud prevention, financial accounting, legal obligations, dispute resolution, and normal backup rotation.

We use safeguards designed to protect information, including encrypted network transport, access controls, private media access, managed service infrastructure, and logging restrictions. No storage or transmission method is completely secure.

9. Your choices and controls

• Edit account and publishing information within AutoPostMD.
• Disconnect a supported platform in connection settings.
• Revoke Google access at Google Account connections .
• Revoke Instagram or Facebook access at Accounts Center .
• Request access, correction, export, or deletion by emailing privacy@autopostmd.com.
• Use the account deletion control when available in your profile. Revocation or AutoPostMD deletion does not remove posts already published to a social platform.

10. Children, changes, and contact

AutoPostMD is intended for adults and is not directed to children under 13. We may update this policy as the service or legal requirements change and will post the revised effective date here.

Privacy questions and requests: privacy@autopostmd.com. General support: support@autopostmd.com.