Privacy Policy

Last updated: September 22, 2026

This Privacy Policy explains how AutomationTools.ca("AutomationTools", "we", "us"), available at https://automationtools.ca, collects, uses, stores, shares and deletes information when you use our service to connect your own social media accounts and compose, schedule and publish your own posts and videos.

1. Information we collect

  • Your AutomationTools account: name, email address and password (stored only as a bcrypt hash).
  • Connected accounts: when you connect a platform, the OAuth access token (and refresh token, where the platform issues one), the platform account ID, and the account name or handle shown in your dashboard. Tokens are encrypted at rest with AES-256-GCM.
  • Your content: captions, titles, hashtags, schedules, the media files you upload, and per-post settings you choose (for example YouTube visibility or TikTok privacy).
  • Publishing results: the post or video ID and link each platform returns, and error messages if publishing failed.
  • Essential cookies for login sessions and for completing a platform connection (short-lived, httpOnly). We use no advertising or tracking cookies.

2. How we use information

Only to provide the service you ask for: showing which accounts you connected, publishing the content you create to the accounts you select when you click Publish (or at the time you scheduled), showing you the result, and sending account notifications (for example, "account disconnected"). Optional AI writing suggestions send only the topic or text you type to OpenAI; no platform tokens or platform data are sent to it.

We do not sell data, use platform data for advertising, build profiles of people, read your followers, messages or comments, or perform any automatic engagement (no auto-likes, follows or comments). Data from one platform is never shared with another platform or any third party, except that the content you choose to publish is sent to the platform you chose.

3. Facebook

Connection uses Facebook Login for Business. Permissions: public_profile, pages_show_list, pages_read_engagement, pages_manage_posts, publish_video and business_management.

  • Used for: listing the Pages you manage so you can pick one, reading the Page name and any linked Instagram professional account, and publishing the posts, photos and videos you create to the Page you pick.
  • Stored: the Page access token (encrypted), Page ID and Page name, and the IDs/links of posts you published through us.
  • Revoke: Disconnect in AutomationTools (deletes the stored token and asks Facebook to remove our access), or Facebook Settings > Security and login > Business integrations / Apps and websites.

4. Instagram

Connection uses Instagram API with Instagram Login. Permissions: instagram_business_basic and instagram_business_content_publish. (Instagram accounts linked to a Facebook Page can also be connected through the Facebook connection above, using that Page's token.)

  • Used for: showing your Instagram username and account ID so you know which account is connected, and publishing the Reels and images you create, with your caption, then fetching the post's permalink to show you.
  • Stored: the long-lived access token (encrypted, about 60 days), account ID, username, and IDs/links of posts published through us.
  • Revoke: Disconnect in AutomationTools, or Instagram Settings > Security > Apps and websites.

5. YouTube (Google)

AutomationTools uses the YouTube API Services to let you upload your videos to your YouTube channel. By connecting a YouTube channel or uploading through AutomationTools you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

OAuth scopes requested:

  • https://www.googleapis.com/auth/youtube.upload: upload the video you choose, with the title, description, visibility (public, unlisted or private), category and "made for kids" setting you enter in Compose.
  • https://www.googleapis.com/auth/youtube.readonly: read your channel ID, title and thumbnail so you can pick the channel and see where a video will be uploaded.
  • openid: read the Google account identifier (sub) only, so that when you reconnect one channel we can keep the other channels under the same Google account working. No email address or profile information is requested or read.
  • Stored: access and refresh tokens (encrypted), channel ID and channel title, the Google account identifier used to keep tokens of channels under the same Google account in sync, and the IDs/links of videos you uploaded through us. We do not store your videos' analytics, comments, subscribers or other channel data.
  • Shared: only with Google/YouTube, to perform the upload you requested.
  • Retention: kept while the channel stays connected. Disconnecting deletes the stored tokens immediately and revokes them at Google.
  • Revoke access: Disconnect in AutomationTools, or at any time through the Google security settings page: https://myaccount.google.com/permissions.

AutomationTools' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. LinkedIn

Scopes requested: openid, profile, email (identify the member who connects), w_member_social (post to your own profile if you choose it), rw_organization_admin (list the LinkedIn Pages you are an administrator of, so you can pick one), w_organization_social (publish posts, images and videos to the Page you picked) and r_organization_social (read back the posts published through us).

  • Stored: access token (encrypted, about 60 days), your member ID, the Page or profile URN and name you picked, and IDs/links of posts published through us. We do not store other members' data, comments or followers.
  • Revoke: Disconnect in AutomationTools, or LinkedIn Settings > Data privacy > Permitted services.

7. TikTok

We use TikTok Login Kit and the Content Posting API. Scopes requested: user.info.basic (display name, avatar, open ID), user.info.profile (your @username, to show which account is connected and link to your profile), video.publish (post the video you create directly to your TikTok profile) and video.upload (send a video to your TikTok inbox as a draft, when you choose that option).

  • Used for: each time you open Compose with a TikTok account selected we ask TikTok for your current posting settings (nickname, avatar, allowed privacy levels, whether comments/duets/stitches are allowed, maximum video length). You then choose how to send each post: Post directly to TikTok (video.publish) — you choose the privacy level, interaction settings and any commercial-content disclosure yourself — or Send to TikTok as a draft (video.upload) — only the video is sent to your TikTok inbox and you add the caption and post it yourself in the TikTok app. We send nothing until you click Publish, and we check the status with TikTok to show you the result.
  • Stored: access and refresh tokens (encrypted), open ID, username, display name and avatar URL, and the publish ID/link of posts you made through us. Creator settings are fetched live and not stored.
  • We do not collect your followers, following list, likes, comments, messages or viewing data, and we add no watermarks or promotional text to your content.
  • Revoke: Disconnect in AutomationTools (also revokes the token at TikTok), or in the TikTok app: Settings and privacy > Security > Manage app permissions.

8. Data security and storage

Data is stored on our servers in a PostgreSQL database. Platform tokens are encrypted at rest with AES-256-GCM, passwords are hashed with bcrypt, and all traffic uses HTTPS. Only the service itself uses the tokens, and only to perform the actions described above.

9. Retention and deleting your data

  • One account: click Disconnect next to it on the Accounts or Brands page. The stored tokens are deleted immediately and, for Google/YouTube, Facebook/Instagram and TikTok, we also ask the platform to revoke our access.
  • Everything: Settings > Delete my account and data. This immediately deletes your AutomationTools account, all connected-account tokens, posts, drafts, schedules, brands, templates, campaigns and notifications. Media files you uploaded are removed from our server within 30 days.
  • Or email privacy@automationtools.ca from your account email; we complete requests within 30 days. See also our Data Deletion page.
  • Posts already published on a platform stay there until you delete them on that platform.

10. Your rights

You can access, correct, export or delete your data, and disconnect any account at any time. Contact us for access or export requests.

11. Changes

We will post changes here and update the date above; material changes are also announced by email or in the dashboard.

12. Contact

Privacy questions or requests: privacy@automationtools.ca

Summary of platform policies that apply