Privacy Policy

Effective August 14, 2026

This policy explains what Social Queue Catalyst collects, why, who it is shared with, and how to get it deleted. It covers the Social Queue Catalyst web application and any social platform accounts you connect to it.

Social Queue Catalyst is a social media content and scheduling tool. You connect the accounts you already own, draft and schedule posts, and review how they performed. We are the data controller for the account you hold with us, and we act on your instructions as a processor for the platform data we retrieve on your behalf.

1. Who we are

Social Queue Catalyst (“we”, “us”). Privacy and data requests: [email protected]. General support: [email protected].

2. What we collect

2.1 Account information

Your email address, display name, and a hashed password. Passwords are stored only as a salted hash and are never recoverable in plain text. If you sign in with a third-party provider such as Google, we receive your verified email address, name, and that provider’s user identifier. We do not receive or store your password for that provider.

2.2 Connected social accounts

When you connect an account, the platform gives us access and refresh tokens scoped to the permissions you approved. We store those tokens so scheduled posts can publish and metrics can be retrieved without you signing in each time. We also store the account handle and the platform’s account identifier. We never receive or store your password for any connected platform.

2.3 Content you create

Drafts, scheduled and published posts, captions, hashtags, prompts, brand voice and style settings, uploaded photos and video, generated images, and any brand knowledge you enter to guide generation.

2.4 Performance data

For posts published through the service, we retrieve engagement metrics from the platform: impressions, views, likes, comments, shares, saves, and derived engagement rates. These are stored as periodic snapshots so trends can be shown over time.

2.5 Public platform content

At your direction, the service retrieves publicly available posts and profile information to surface trends, track competitors you nominate, and suggest replies. This is limited to what the relevant platform API exposes for public content and is retrieved under your connected account’s permissions.

2.6 Technical and usage data

Server logs including IP address, timestamps, and requested endpoints, retained for security and troubleshooting. Records of AI generation calls and their cost, so usage can be accounted for. We do not use third-party advertising or cross-site tracking cookies. The only cookie we set is the session cookie described in section 8.

3. TikTok data specifically

Where you connect a TikTok account, we access TikTok data solely to provide features you have asked for:

• Publishing or scheduling video and photo content you have created or uploaded.
• Reading basic profile information for the connected account, to display which account is connected.
• Retrieving performance metrics for content published through the service.
• Retrieving publicly available trend and hashtag information you have asked the service to monitor.

We do not sell TikTok data, use it for advertising or profiling, share it with data brokers, or use it to train machine learning models. TikTok data is not combined with data from other platforms to build a profile of any individual. Where TikTok data is processed by an AI subprocessor, that is limited to the text of your own drafts and captions and is done to produce the output you requested. If you disconnect your TikTok account, tokens are deleted immediately and retrieved TikTok data is deleted within 30 days.

4. How we use data

• To operate the service: drafting, scheduling, publishing, and reporting.
• To generate content you request, including captions and images, using the AI providers listed in section 6.
• To keep your account secure and to investigate abuse.
• To communicate about your account, including service and security notices.
• To meet legal obligations.

Where the law requires a lawful basis, ours is performance of our contract with you for operating the service, our legitimate interest in securing and improving it, and your consent where you have granted a platform permission.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. AI processing

Content generation sends the text of your prompts, drafts, and brand voice settings to the AI providers in section 6. Images you select for captioning or use in a post may be sent to an AI provider to be described or edited. We instruct our providers not to train their models on data submitted through their APIs, and the providers we use offer that commitment for API traffic. We cannot, however, guarantee the internal practices of a third party, so do not enter information into the service that you would not be willing to share with a cloud vendor.

6. Subprocessors

We use the following providers to deliver the service. Each receives only the data needed for its function.

We do not otherwise share your data. We may disclose information where legally compelled, or to protect the rights and safety of our users, and will notify you unless prohibited from doing so.

7. Retention and deletion

• Account records: kept while your account is open, and deleted within 30 days of closure.
• Platform access tokens: deleted immediately when you disconnect an account or close your account.
• Content and media: kept until you delete it, or within 30 days of account closure.
• Performance metrics: retained up to 24 months so year-over-year comparison is possible, then deleted.
• Server logs: retained up to 12 months.
• Backups: purged on their own rolling cycle, no later than 90 days after deletion.

Deleting content in Social Queue Catalyst does not delete anything already published to a social platform. Remove published posts on the platform itself.

8. Cookies

We set one cookie, sqc_session. It holds your signed session token, is marked HttpOnly so scripts cannot read it, and expires after 30 days or when you sign out. It is strictly necessary to keep you signed in. We use no analytics, advertising, or third-party tracking cookies.

9. Security

Passwords are salted and hashed. Sessions use signed tokens in HttpOnly cookies. Third-party sign-in is verified server-side, including token signature, issuer, audience, and expiry. Platform tokens are stored with access restricted to the account that owns them, and each brand’s data is separated so that members of one brand cannot read another’s. Access to production systems is limited to personnel who need it. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing, and to withdraw consent. California residents have rights to know, delete, correct, and to opt out of sale or sharing; we do not sell or share personal information, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

Exercise any of these by emailing [email protected]. We respond within 30 days. We may need to verify your identity before acting, which we will do using the email address on your account. If you are in the EEA or UK you may also complain to your local supervisory authority.

11. International transfers

We and our subprocessors operate in the United States, so data may be transferred to and processed there. Where required for transfers out of the EEA or UK, we rely on Standard Contractual Clauses or an equivalent approved mechanism.

12. Children

The service is for business use and is not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes

We will post any change here with a new effective date. For material changes we will notify account holders by email at least 14 days before the change takes effect.

14. Contact

Privacy and data requests: [email protected]
Support: [email protected]