Privacy policy

Who is responsible

André Frid AB, Sweden, is the controller for the personal data described here. Contact: andre.01.frid@gmail.com.

What we collect

• Sign-in data: your Google account's email address, name and profile picture.
• Connected accounts: for each Facebook Page, Instagram professional account, TikTok account and LinkedIn profile or page you connect — its id, name, username, profile picture, the permissions you granted and the access tokens the platform issues.
• Content: posts you write, media you upload, captions per channel, publish times, and the ids and links of the resulting posts.
• People you tag: names and handles (LinkedIn, Instagram, TikTok, Facebook Page) that you save in order to @mention them.
• Statistics: aggregate numbers the platforms provide for your accounts and posts, such as followers, views, reach, likes, comments and shares.
• AI usage: which assistant and model handled a request, token counts and whether it succeeded — not the text itself.
• Comments and messages: when you use the inbox, comments on posts you published through onair and direct messages to your Facebook Page and Instagram account (author name, handle and id, text and time), and the replies you send.
• Website traffic: if you connect Google Analytics, aggregate sessions, engaged sessions, key events and revenue per post (matched through UTM tags). No data about individual visitors.
• Competitors: public numbers of Instagram professional accounts you choose to follow (followers, post count, likes and comments on recent posts).
• Library, tags and reports: files you save for reuse, hashtag sets, theme and campaign tags, and weekly reports built from the statistics above.
• Settings: language, time zone, brand voice, queue times, UTM settings, report email address and link-in-bio page.
• Technical data: cookies needed to keep you signed in, and server logs with IP address and request details for security and troubleshooting.

Why we use it, and the legal basis

• To provide the service you asked for — signing in, connecting accounts, publishing at the time you choose, and showing statistics (performance of a contract, GDPR art. 6(1)(b)).
• To keep the service secure and working — logs, abuse prevention and error handling (legitimate interest, art. 6(1)(f)).
• To connect a platform account and act on it — based on the permissions you grant on that platform, which you can withdraw at any time by disconnecting.
• To store people you tag — our legitimate interest in letting you mention them correctly; keep only what you need, and remove a person on request.
• To show and answer comments and messages from people who write to your accounts — our legitimate interest in letting you handle them in one place; we keep only what the platforms return for the last 60 days.

We do not sell personal data, show ads, build advertising profiles, or use your content or platform data to train AI models.

Data from Facebook, Instagram, TikTok, LinkedIn and Google

Data received through these platforms' APIs is used only to provide the features you use in onair, within each platform's developer terms (Meta Platform Terms, TikTok Developer Terms, LinkedIn API Terms of Use and the Google API Services User Data Policy, including its Limited Use requirements). It is not shared with third parties except to publish what you ask for, and it is deleted when you disconnect the account.

AI assistants

If you connect Claude (Anthropic), ChatGPT (OpenAI) or Gemini (Google), the text you ask them to write or proofread, the channels it is meant for and your saved brand voice are sent to that provider with the API key you supplied (or the operator's key). Media, platform tokens and statistics are never sent. Each provider processes the request under its own terms. AI can only return suggestions and drafts — it cannot publish or schedule posts. Your API keys are encrypted at rest.

Who we share data with

• Supabase — database, file storage and sign-in (EU region).
• Vercel — hosting of the application.
• Google — sign-in, and Google Analytics if you connect it (read-only). In Studio and on the Brand page, fonts load from Google Fonts, which sees your IP address.
• Resend — sending the weekly report email, if you turn it on.
• Meta, TikTok and LinkedIn — when you connect an account, publish, or we fetch statistics.
• Anthropic, OpenAI or Google — only if you connect that AI assistant and use it.

These act as processors or as independent recipients under their own terms. We share nothing else unless the law requires it.

Transfers outside the EU/EEA

Some providers may process data outside the EU/EEA, for example in the United States. Such transfers rely on the EU Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

How long we keep it

• Account and settings: until you ask us to delete your account.
• Access tokens and API keys: until you disconnect the account or assistant.
• Posts and media: until you delete them, or your account is deleted.
• Statistics: while the account is connected; removed when you disconnect it.
• Inbox items: while the account is connected; removed when you disconnect it.
• Website traffic, competitor numbers and reports: until you disconnect Google Analytics, remove the competitor, or delete your account.
• People you tag: until you delete them.
• AI usage logs: 12 months. Server logs: up to 30 days.

Security

Access tokens and API keys are encrypted with AES-256-GCM and can only be read by the server. Every table is protected by row-level security so you can only reach your own data. Media is stored privately and shared with platforms through short-lived signed links. Access to the app is limited to approved accounts.

Cookies

onair uses only cookies that are strictly necessary: one to keep you signed in, one to remember your language, and a short-lived one that protects the connection flow to each platform. There are no analytics or advertising cookies, so no consent banner is needed.

Your rights

You have the right to access, correct and delete your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Contact andre.01.frid@gmail.com — we answer within 30 days. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).

Changes

We will update this page when our practices change and show the date of the latest version at the top.