Privacy Policy
This policy explains what data the Publisher application (“Publisher”, “the Service”) collects, why it collects it, who it is shared with, how long it is kept and how you can have it deleted.
1. Who we are
The Service is operated by Heliom Labs LLC (“Heliom Labs”, “we”, “us”), a company incorporated in New Mexico, United States.
Registered address: 8206 Louisiana Blvd NE, Ste A #7492, Albuquerque, NM 87113, USA
Contact for any privacy request: contact@helliomlabs.com
2. What Publisher does
Publisher lets a creator upload a video once and publish it to their own accounts on Instagram, TikTok, YouTube, Facebook and Snapchat. We act only on the accounts you have explicitly connected, and only for the publications you have explicitly confirmed.
3. Data we collect
| Category | What it is | Why we need it |
|---|---|---|
| Account data | Email address, display name, and — where you sign in with Discord — your Discord user identifier and avatar. | To create your account, sign you in, and recognise members of our community who are entitled to a free trial month. |
| Social connection data | Access and refresh tokens issued by Google/YouTube, Meta (Instagram, Facebook), TikTok and Snap, plus the username, profile picture, account type and account identifier of each connected account. | To publish on your behalf, and to show you which account a video is about to be posted to before you confirm. |
| Content you submit | The video files, captions, titles, descriptions, hashtags, thumbnails and scheduling instructions you provide. | To transmit them to the platforms you selected. |
| Publication records | Date, destination platform, outcome (success or error), and the identifier or URL of the resulting post. | To show you the result of each publication and to support you when a platform rejects a video. |
| Billing data | Subscription status, plan, payment dates, and a transaction reference from our payment provider. | To manage your subscription. We never see or store your card number or mobile money PIN — those are handled entirely by the payment provider. |
| Technical data | IP address, browser and device type, and error logs. | Security, fraud prevention, and diagnosing failures. |
4. What we never do
We do not sell, rent, or trade your personal data or your content.
We do not use your content, or data obtained through any platform API, to train machine-learning or artificial-intelligence models.
We do not use your data for advertising, ad targeting, or profiling.
We do not read, download or analyse content from your connected accounts beyond what is strictly needed to publish what you asked us to publish and to report the result.
We do not publish anything without your explicit, per-publication confirmation.
5. Google and YouTube API Services
Publisher uses YouTube API Services. By connecting a YouTube account you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data.
Publisher's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
We request the narrowest scope that allows us to upload a video to your channel. We do not read your watch history, your subscriptions, or your analytics.
You can revoke Publisher's access to your Google account at any time at myaccount.google.com/permissions. Data retrieved through the YouTube API and stored by us is deleted within 30 days of revocation, except where we are required to keep a record for accounting or legal reasons.
6. Meta, TikTok and Snap
When you connect an Instagram, Facebook, TikTok or Snapchat account, the corresponding platform authenticates you directly; we never see your password. We store only the tokens and the public account details listed in section 3.
You can disconnect an account from inside Publisher at any time, or revoke access from the platform itself — in Instagram and Facebook under Settings › Apps and websites, in TikTok under Settings › Security › Manage app permissions.
7. Where your data is stored, and for how long
- Videos are stored only for as long as the publication requires. For an immediate publication, the file is deleted once every selected platform has accepted or rejected it, and in all cases within 7 days. For a scheduled publication, the file is kept until the scheduled time, then deleted on the same basis.
- Access tokens are stored encrypted and are deleted as soon as you disconnect the account, or within 30 days of your account being closed.
- Publication records and billing records are kept for as long as your account is open, and afterwards only where accounting law requires it.
- Technical logs are kept for 90 days.
Data is hosted with our infrastructure providers in the European Union and the United States. Transfers outside the European Economic Area are covered by the European Commission's Standard Contractual Clauses.
8. Who we share data with
We share only what is necessary, and only with providers acting on our instructions:
- The social platforms you selected — to publish your content, at your request.
- Our hosting and video delivery providers — to store and transmit files.
- Our payment providers (FedaPay, PawaPay) — to take and verify payment.
- Public authorities — only where we are legally compelled, and only to the extent required.
9. Legal bases (GDPR)
- Performance of a contract — creating your account, connecting platforms, publishing your videos, billing.
- Legitimate interest — security, fraud prevention, and diagnosing failures.
- Legal obligation — accounting and tax records.
- Consent — for anything optional, which you may withdraw at any time.
10. Your rights
You may request access to your data, correction, deletion, restriction, portability, or object to a processing. Write to contact@helliomlabs.com and we will answer within 30 days. If you are in the European Union, you may also lodge a complaint with your national supervisory authority.
Deleting your account and your data
You can delete your account from Publisher's settings, or by emailing contact@helliomlabs.com from the address associated with your account. Deletion removes your account data, your connected-account tokens and any stored video within 30 days. Content already published on a social platform is no longer under our control — you must delete it on that platform yourself.
11. Security
Connections use TLS. Tokens are encrypted at rest. Access to production systems is restricted and logged. No system is perfectly secure; if a breach affects your data we will notify you and the competent authority as required by law.
12. Children
Publisher is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, write to contact@helliomlabs.com and we will delete it.
13. Changes to this policy
We may update this policy. The effective date at the top always reflects the current version, and we will notify you by email of any change that materially affects your rights.