Privacy policy

Last updated October 21, 2026

The operator of this site has not yet entered its name and contact address, so this page is a template and is not shown to search engines. Set NEXT_PUBLIC_LEGAL_NAME and NEXT_PUBLIC_CONTACT_EMAIL and rebuild.

This policy explains how the operator of this Publaro service ("we") handles personal data when you use Publaro, a service for scheduling and publishing social media posts. It was last updated on October 21, 2026.

Who is responsible

the operator of this Publaro service is the controller of the personal data described here. You can reach us using the contact details on this site.

If you use Publaro through a company or an agency, that organization decides what is posted and who can see it. For the content and the connected accounts of its workspaces it is the controller and we act on its behalf.

What we collect

Account details: your name, email address and language, and a password stored only as a salted hash (scrypt). If you use single sign-on, the identity your provider sends us.
Security details: whether two-factor authentication is on, recovery codes (stored hashed), and your signed-in devices.
Your content: posts, drafts, comments on posts, media you upload, brand settings, saved captions and any facts you give for AI writing.
Connected accounts: the name, handle and identifier of each social account you connect, and the access tokens the platform gives us. Tokens are encrypted (AES-256-GCM) before they are stored, and we never see your platform passwords.
AI requests: the instructions you give and the text or images generated, kept so you can see your history and so usage can be counted.
Billing: your plan and the identifiers of your subscription. Card details are entered with, and held by, our payment provider (Stripe); we do not receive them.
Usage and security records: the actions taken in your organization (an audit log with the time, the action and an IP address and browser type) and counts used to apply plan limits.
Short-link clicks, if you use link tracking: the time, the kind of device, the website the visitor came from and the country. A visitor is recognised only by a one-way hash made with a salt that changes every day, so a person cannot be followed from one day to the next. IP addresses are not stored with clicks.
Messages you send us, and the emails we send you (for example to verify your address, reset a password or tell you a post failed).

Why we use it

To provide the service you asked for: signing you in, publishing posts to the platforms you connected, running your calendar, approvals and inbox, and applying your plan. (Performing our contract with you.)
To keep the service secure and reliable: preventing abuse, detecting fraud, limiting rates, recording who did what, and fixing faults. (Our legitimate interest in running a safe service.)
To bill you and meet tax and accounting rules. (Contract and legal obligation.)
To send service messages. We do not send marketing email unless you ask for it. (Contract; consent where the law requires it.)
To improve the product using counts and error reports, not the content of your posts. (Legitimate interest.)

We do not sell personal data, and we do not use your content to train AI models.

We use service providers who process data for us, only for the purposes above:

Hosting and database providers, who store the service and its backups.
Object storage (an S3-compatible service) for your uploaded media.
An email provider, to deliver our messages.
Stripe, to take payments and manage subscriptions.
An AI provider, when you use AI features: Anthropic by default, or the provider whose key you connect yourself (for example OpenAI or Google). Your instructions and the text you ask it to work on are sent to that provider; with your own key, your agreement with that provider applies.
The social platforms you connect. When you publish, the post, its media and your instructions go to them, and their own privacy policies apply to what they do with it.

We also disclose data when the law requires it, or to protect the rights and safety of our users and of us. If the business is sold or merged, personal data may move to the new owner under the same commitments.

International transfers

Our providers and the platforms you connect may process data outside your country. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

While your account is open, we keep your content and settings so you can use them.
When you delete your account or organization, it is hidden at once and its data is permanently deleted after 30 days, unless a different period is stated in your agreement. Billing records (amounts, dates and identifiers, with no personal content) are kept longer for tax and dispute purposes.
Short-link click records are kept for 90 days and then reduced to daily totals.
Copies in backups are removed as the backups rotate out.
Media you delete is removed from storage; failed or abandoned uploads are cleared automatically.

Your rights

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, withdraw consent, and complain to your data protection authority.

Download a copy of your data from Settings. It is a machine-readable file.
Delete your account from Settings. The deletion schedule is above.
For anything else, contact us using the contact details on this site. We will answer within the time the law requires.

Cookies and similar storage

Publaro uses only the storage it needs to work. It has no advertising cookies and no third-party analytics scripts, so there is no cookie banner to accept.

A sign-in cookie that keeps you signed in. It cannot be read by scripts on the page and is sent only to our own service.
A language cookie and a time zone cookie, so pages are shown in your language and your time.
Your theme choice (light or dark) and a few interface choices, kept in your browser's local storage on your device.
Short-lived cookies used while you connect a social account or sign in through your company's identity provider, to make sure the response belongs to your request.

Security

Platform tokens are encrypted before they are stored, passwords are hashed with a memory-hard function, sessions rotate and can be ended from any device, and two-factor authentication is available. Connections to the service use HTTPS. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Children

Publaro is for people who are at least 16 years old, or the age of digital consent in their country if that is higher. We do not knowingly collect data from younger children.

Changes

When we change this policy in a way that matters, we will tell you by email or in the app before it takes effect. The date at the top shows the latest version.

Contact

the operator of this Publaro service.