Privacy policy

Video Automation publishes videos through the platforms' official APIs. Here you can find out which data we process, what we receive from the platforms, how long we keep it and how you can have it deleted.

This privacy policy applies to the website my-video-automation.com (the "website") and to the Video Automation app at my-video-automation.com, including its application programming interface (API) and the connect pages for end customers (the "app"). The German version is the binding one: Datenschutzerklärung.

Last updated: 7 November 2026

1. Controller

The controller responsible for data processing is:

Internet am Dornbusch
Owner: Sajjad Hanifa
Eschersheimer Landstraße 297
60320 Frankfurt am Main
Germany

Phone: +49 69 34 87 77 44
E-mail: info@my-video-automation.com

Video Automation is a service of Internet am Dornbusch.

We are not required to appoint a data protection officer, because the conditions of § 38 BDSG and Art. 37 GDPR are not met in our case. For any questions about data protection, you can contact us directly.

2. Summary

The website and the app run on servers we operate ourselves in a STRATO GmbH data centre in Berlin, Germany. The database is PostgreSQL on the same servers.
We use no analytics or tracking services, no advertising pixels, no social media plugins and no third-party content on the website.
We only set technically necessary cookies and storage entries (section 4).
You connect social media accounts through the platforms' official sign-in flows (OAuth), for Bluesky with an app password. We never learn your platform password. Access tokens are stored encrypted (AES-256-GCM) (section 8).
Uploaded videos and images are kept only for your plan's retention period (3, 7, 14, 30 or 90 days) and are then deleted automatically (section 9).
You can export your data in the app and delete your workspace immediately. How to have data of connected accounts deleted is described on the data deletion page.

3. Hosting and server log files

The website and the app run on servers we operate ourselves in a data centre of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We have a data processing agreement with STRATO under Art. 28 GDPR.

Each time you open a page, your browser sends technical data to the web server. The web server stores this data in log files:

IP address
date and time of access
requested address (URL)
referrer, i.e. the page you came from, if your browser sends it
user agent, i.e. browser and operating system
HTTP status code and amount of data transferred

Purpose: delivering the website and the app, finding and fixing technical errors, and protecting against attacks and misuse. The data is not analysed for statistics or advertising.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is secure and stable operation.

Retention: The log files are not combined with other data. They are rotated and deleted automatically as soon as they are no longer needed for these purposes, unless a specific security incident has to be investigated further.

4. Cookies and local storage in your browser

We only set cookies and storage entries that are technically necessary:

Privacy notice (website): When you close our privacy notice, your browser stores an entry in local storage (localStorage) so that the notice does not appear again on every page.
Session cookie (app): When you sign in to the app, we set a session cookie that recognises you as signed in. It is used only for sign-in, not for analytics. During a sign-in with a second factor or a passkey, another cookie valid for a few minutes may be set briefly.
Language and theme (app): Your browser stores the chosen language (German or English) and theme (light or dark) in local storage so that the app remembers them.

Apart from the session identifier, these entries contain no personal data and are not analysed. You can delete them at any time in your browser settings.

Legal basis: § 25 (2) no. 2 TDDDG, because storing them is strictly necessary to provide the service you requested; for the subsequent processing Art. 6 (1) (b) and (f) GDPR.

5. Contact by e-mail or phone

If you write us an e-mail or call us, we process your contact details and the content of your request in order to handle it. The legal basis is Art. 6 (1) (b) GDPR where a contract or its preparation is concerned, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering requests). Our mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have a data processing agreement with IONOS.

We delete your request once it has been dealt with and no statutory retention obligations apply. If your request leads to a contract, we keep the related business correspondence for the periods required by commercial and tax law (Art. 6 (1) (c) GDPR).

6. Links to other websites

Our pages contain links to websites of other providers, for example to the platforms' privacy policies. As long as you do not click a link, no data is transferred to these providers. Only when you follow a link does the respective operator process your data under its own responsibility.

7. Customer account in the app

When you create and use a workspace in the app, we process the following as controller:

Account data: name, e-mail address, company, password (stored only as a hash), language, theme and time zone, as well as the data of team members you invite, with their role
Contract and billing data: chosen plan, trial period, billing period, number of uploads used, invoices and payment status
Usage and security data: sign-in times, a log of actions in the workspace, your API keys and webhook addresses, and logs of webhook deliveries

Purpose and legal basis: providing the service and performing the contract (Art. 6 (1) (b) GDPR), complying with tax and commercial law obligations (Art. 6 (1) (c) GDPR) and the security of the service (Art. 6 (1) (f) GDPR).

E-mails from the app: sign-in and confirmation e-mails, invitations and notifications are sent through IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

Payment processing via Stripe: You do not need a payment method for the trial. Paid plans are billed through the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). You enter your payment details directly on Stripe's payment page; we do not receive full card or account details. We send Stripe the information needed for the payment (for example company, e-mail address, plan and amount) and receive the payment status and invoices from Stripe. The legal basis is Art. 6 (1) (b) GDPR. Stripe also processes payment data as an independent controller, for example for fraud prevention and to meet legal obligations. In doing so, Stripe transfers data to Stripe, LLC in the USA. According to Stripe, Stripe, LLC complies with the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) and additionally uses standard contractual clauses. More in Stripe's privacy policy: stripe.com/privacy

Retention: If you delete your workspace in the app, we delete the data immediately (section 10). If the contract ends in another way, we delete the account data 30 days after the end of the contract. Invoices and accounting records are kept for the statutory periods (up to 10 years, § 147 AO, § 257 HGB).

Content and data of your end customers: You as the customer are the controller for videos, images, texts and for the data of accounts that your own customers connect through connect links. We process them as your processor under the data processing agreement.

8. Connections to social media platforms

8.1 How a connection works

To let Video Automation publish on your behalf, you connect an account of the respective platform. You sign in on the platform's own page and grant the permissions shown there (OAuth). The platform then sends us an access token and, where provided, a refresh token. We do not receive your platform password. For Bluesky, you instead create an app password and enter it in our app.

A connection can also be made through a connect link that a Video Automation customer creates and passes on to its own customers. The connect page is served from our server; from the Pro plan it shows our customer's name and logo instead of ours (white label). The customer who created the link is the controller for these connections; we process the data on its behalf.

For each connection we store:

the account's identifier at the platform (for example channel ID, user ID or page ID), the display name, the username and the address of the profile picture
access and refresh tokens or the Bluesky app password, encrypted with AES-256-GCM, together with their expiry time and the permissions granted
depending on the platform, the pages, boards or company pages you manage and can choose for posts
for each post: title, description, settings (for example visibility or AI label), scheduled time, status, error messages from the platform, and the ID and address of the published post

We do not read private messages, comments, follower lists or statistics, and we do not use platform data for advertising, profiling or training AI models. We do not sell it and do not pass it on to third parties, except to the platform on which you publish.

Purpose: publishing and scheduling posts on the accounts you connected, and showing the connected account and the result in the app.

Legal basis: Art. 6 (1) (b) GDPR (providing the service you requested). For connections made through connect links, we process the data on behalf of our customer under Art. 28 GDPR.

The platforms as independent controllers: When you publish a post, we send the video, image or text with the post details to the chosen platform. From that moment, the platform processes the content as an independent controller under its own terms and privacy policy. Several platforms are based in the USA or transfer data there; the transfer is made on your instruction in order to publish the post you want.

8.2 YouTube (Google)

We use the YouTube API Services (YouTube Data API v3). We request the permissions to upload videos (youtube.upload) and to read the basic data of your channel (youtube.readonly) so that you can see in the app which channel is connected. With these we receive the channel ID, channel name and profile picture, the tokens and, after an upload, the video ID.

Video Automation's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

By uploading videos to YouTube through Video Automation, you agree to the YouTube Terms of Service. Google's processing is governed by the Google Privacy Policy.

Revoking access: You can disconnect the channel in the app. We then delete the tokens and revoke them at Google. You can also remove access at any time in your Google account at security.google.com/settings/security/permissions. We delete data obtained from the YouTube API no later than 7 days after your deletion request or the disconnection in the app; if we learn of a revocation through Google, we delete it within 30 days at the latest. Stored data from the YouTube API (for example channel name and profile picture) is refreshed or deleted at least every 30 days.

8.3 TikTok

We use TikTok's Login Kit and Content Posting API with the permissions user.info.basic (identifier, display name and avatar), video.publish (direct posting) and video.upload (uploading as a draft to your TikTok inbox). Before each post, we ask TikTok for the settings allowed for your account, for example the available privacy levels and the maximum video length, and show them to you.

Revoking access: Disconnect the account in the app, or remove Video Automation in the TikTok app in the security and permissions settings under connected apps. TikTok notifies us of the removal; we then remove the connected account automatically.

8.4 Meta: Instagram, Facebook and Threads

For Instagram we use the Instagram API with the permissions instagram_business_basic and instagram_business_content_publish (basic data of the professional account and publishing). For Facebook Pages we use Facebook Login for Business with pages_show_list, pages_read_engagement, pages_manage_posts (list of your Pages, Page tokens and publishing) and business_management (access to Pages managed in a business portfolio). For Threads we use the Threads API with threads_basic and threads_content_publish. We receive the account or Page ID, names, usernames, profile picture and the tokens.

Instagram, Facebook and Threads download videos from an address instead of receiving them directly. For this, we make the file temporarily available at an unguessable, signed address on our server (section 9).

Privacy policies: Meta, Instagram, Threads

Revoking access: Disconnect the account in the app, or remove Video Automation in the Facebook settings under "Business integrations" or "Apps and websites", in Instagram under "Apps and websites", or in Threads under website permissions. Meta notifies us of the removal (deauthorization callback); we then remove the account automatically. If you request deletion of your data through Facebook, we delete all connected accounts of your Meta account and create a confirmation code you can use to check the status at my-video-automation.com/data-deletion?code=….

8.5 LinkedIn

For personal profiles we use "Sign In with LinkedIn using OpenID Connect" and "Share on LinkedIn" with the permissions openid, profile and w_member_social; for company pages the Community Management API with w_organization_social and r_organization_admin. We receive the member or organisation ID, names, profile picture and the tokens.

Revoking access: in the app or at LinkedIn under linkedin.com/psettings/permitted-services.

8.6 Pinterest

We use Pinterest API v5 with the permissions user_accounts:read, boards:read, pins:read and pins:write. We receive the username, profile picture, the list of your boards and the tokens.

Revoking access: in the app or in your Pinterest account settings under the apps you have given access.

8.7 X

We use X API v2 with the permissions tweet.read, tweet.write, users.read, media.write and offline.access. We receive the user ID, name, username, profile picture and the tokens.

Revoking access: in the app or at X under x.com/settings/connected_apps.

8.8 Bluesky

You connect Bluesky with your handle and an app password that you create in Bluesky. We store the app password encrypted and receive your identifier (DID), handle, display name, profile picture and session tokens. You never enter your actual Bluesky password in our app.

Revoking access: in the app, or by deleting the app password in Bluesky under Settings, Privacy and security, App passwords.

9. Uploaded videos and images

Videos, images and thumbnails that you upload or pass to us by URL are stored on our servers in Germany so that we can publish them at the chosen time. We keep them for no longer than your plan's retention period and then delete them automatically:

Plan	Media retention
Trial	3 days
Starter	7 days
Pro	14 days
Business	30 days
Agency	90 days

Because Instagram, Facebook and Threads (and other platforms where needed) fetch videos from an address, a file is reachable during this time at an unguessable, signed address. The address is not published anywhere and is only sent to the platform on which you publish. Once the file is deleted, the address no longer works.

The details of a post (title, description, status, address of the published post) remain in the history until you delete the post, the connected account or the workspace. We do not delete videos that have already been published on a platform; you can do that at the platform yourself.

10. Data export and deletion

Export: In the app you can download the data of your workspace as a JSON file.
Disconnecting an account: When you disconnect a connected account, we delete its tokens immediately and revoke them at the platform where the platform offers this.
Deleting the workspace: When you delete your workspace, we delete it immediately together with all connected accounts, tokens, posts, media, API keys and webhooks. Only invoice data that we are legally required to keep is excluded.
Deletion through the platform: How to have data deleted through Meta, TikTok or Google is described on the data deletion page.
By e-mail: An informal message to info@my-video-automation.com is enough.

11. Recipients and transfers to third countries

Within our company, only the people who need your data for the purposes described receive it. External recipients are:

STRATO GmbH, Berlin (data centre of the website and the app, processor)
IONOS SE, Montabaur (e-mail delivery and mailboxes, processor)
for paid plans, Stripe Payments Europe, Limited, Dublin (payment processing, section 7)
the platforms on which you publish (YouTube/Google, TikTok, Meta, LinkedIn, Pinterest, X, Bluesky), as independent controllers, and only with the content and details needed for the respective post (section 8)

We do not sell data and do not pass it on for advertising purposes.

Our own processing takes place in Germany. Transfers to third countries can occur at Stripe (section 7) and at the platforms, which under their own privacy policies may also process data in the USA or other countries outside the EU. The transfer to a platform takes place because you want to publish a post there (Art. 49 (1) (b) GDPR, where there is no adequacy decision).

12. Your rights

Under the GDPR you have the following rights towards us:

Access to the data we process about you (Art. 15 GDPR)
Rectification of incorrect data (Art. 16 GDPR)
Erasure of your data (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation.

If you connected your account through the connect link of one of our customers, that customer is your point of contact. If you contact us anyway, we forward your request to the customer and help to resolve it.

For any request, an informal message to the contact details in section 1 is enough.

13. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)
Wilhelmstraße 7
65185 Wiesbaden, Germany
datenschutz.hessen.de

14. Obligation to provide data

You are not legally or contractually obliged to provide personal data. Without account data, however, we cannot provide the app, and without connecting an account we cannot publish there. Without the technically transmitted data (section 3), the website and the app cannot be displayed.

15. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

16. Changes to this privacy policy

We update this privacy policy when the website, the app, the connected platforms, the technology used or the legal situation changes. The version published here applies.

Last updated: 7 November 2026