Privacy Policy – Postdesk
Last updated: October 10, 2026
Who we are
Postdesk is a service of BMK Automations (in formation), the Netherlands. The Chamber of Commerce number and address will be added here once the registration is complete. Contact: w26076779@gmail.com.
What Postdesk does
Postdesk lets customers upload videos and photos, schedule them and publish them on their own TikTok, Instagram and YouTube accounts. Each customer only sees their own brands, accounts and posts.
What data we process
- Your account: your name, email address, a hashed password (never the password itself), your plan and billing period, and the status of your sign-up.
- Security: the network your login comes from (shortened or hashed), a cookie that recognises your device, and a log of logins and important changes. If you turn on an extra login code: your phone number or authenticator key, stored encrypted.
- Connected social accounts: the access tokens that let Postdesk publish for you, stored encrypted. From TikTok we retrieve the display name, username and posting settings of the connected account (for example which visibility options are allowed), because TikTok requires these to be shown before posting. From YouTube the channel name; from Instagram the username and account ID.
- Your content: the videos, photos and captions you upload, your schedule, and the result of each post (published or failed, and why).
We do not collect data from your viewers or followers, and we do not use your data for advertising.
Why
To provide the service you signed up for (performance of the contract), and to keep Postdesk secure and prevent abuse (legitimate interest).
Who receives data
- The platform you choose to publish on: TikTok, Instagram (Meta) or YouTube (Google), through their official APIs. Only the content and settings you choose are sent.
- Our hosting provider Railway (railway.com), which runs our servers in the United States. Your data is therefore stored outside the European Union.
- If you choose login codes by text message: the text message provider, which receives only your phone number and the code.
- The pages load fonts from Google Fonts, which means your browser contacts Google.
We never sell your data and never share access tokens with anyone.
How long we keep it
- Your account and connected accounts: as long as your account exists.
- Uploaded files: until they have been published or removed from your queue; loose uploads are deleted after 3 days.
- The security log has a fixed maximum size; old entries drop off automatically. Entries contain a user code and a shortened network address, not your content.
Deleting your account
You can delete your account yourself at any time, under Accounts (or on the waiting screen before your account is active). Your account, connected accounts and tokens, brands, scheduled posts, uploads and posting history are then deleted immediately. You can also revoke Postdesk’s access at any time in the settings of TikTok, Instagram or your Google account.
Your rights
You have the right to access, correct and delete your data, to object, and to receive your data. Email us at w26076779@gmail.com; we respond within 30 days. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Cookies
Postdesk only uses cookies that are needed for the service: your login session, recognising your device for the extra login code, and your language choice. No tracking or advertising cookies.
Platform terms
Publishing to TikTok is subject to TikTok’s Terms of Service and Privacy Policy. Publishing to Instagram is subject to Meta’s Platform Terms. Postdesk uses YouTube API Services; by using it you agree to be bound by the YouTube Terms of Service, and Google’s use of data is described in the Google Privacy Policy. You can revoke access via the Google security settings.
Changes
Changes are published on this page with a new date at the top.