Privacy Policy

Last updated: March 19, 2026

Sarah Office ("we", "our", or "us") operates a content management platform that allows users to publish content across social media platforms including TikTok, Instagram, YouTube, Facebook, and LinkedIn. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

1. Information We Collect

We collect the following types of information:

• Account credentials — OAuth tokens issued by third-party platforms (TikTok, Google, Meta, LinkedIn) when you authorize our application. We store these tokens securely to perform publishing actions on your behalf.
• Content you upload — Videos, images, and text that you submit through our platform for publication. This content is temporarily stored and deleted after successful publishing.
• Usage data — Logs of publishing activity, task status, and error reports for operational purposes.
• Contact information — If you contact us directly, we may retain your name and email address.

2. How We Use Your Information

• To publish content to social media platforms on your behalf using the permissions you have granted.
• To send you status notifications about your publishing tasks via Telegram or other configured channels.
• To maintain and improve the reliability of our service.
• To comply with legal obligations.

3. TikTok Integration

When you connect your TikTok account, we use the TikTok Login Kit and Content Posting API. We request only the permissions necessary to publish video content on your behalf (video.publish, video.upload). We do not access your TikTok messages, followers, or any data beyond what is necessary for posting. TikTok data is governed by TikTok's Privacy Policy.

4. Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

• Third-party platforms — TikTok, Google (YouTube), Meta (Instagram, Facebook), LinkedIn — solely to perform publishing actions you request.
• Infrastructure providers — Google Firebase, used for secure data storage and hosting.
• Payment processor — Creem (Creem.io), our Merchant of Record, who handles payment processing, invoicing, and tax compliance. Creem processes billing data according to their own privacy policy.
• Law enforcement — Only when required by applicable law or valid legal process.

5. Data Retention

Media files (videos and images) are deleted from our servers within 24 hours of successful publication. OAuth tokens are retained until you revoke access or disconnect the platform in your account settings. You may request deletion of all your data at any time by contacting us.

6. Security

We implement industry-standard security measures including encryption in transit (HTTPS/TLS), encrypted storage, and access controls. OAuth tokens are stored securely and never exposed publicly. However, no system is completely secure, and we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent and revoke OAuth access at any time through the connected platform's settings.
• Lodge a complaint with a data protection authority.

8. Children's Privacy

Our service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by updating the "Last updated" date above.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: support@sarahoffice.com