Last updated: 28/10/2026
01Data controller
HEALTH GUM COMPANY
Trading name: Postvanta
Registration number: 833 254 667
Registered office: Paris, France, European Union
Email : contact@postvanta.app
HEALTH GUM COMPANY, which operates the Postvanta service, is the data controller for your personal data within the meaning of the General Data Protection Regulation (GDPR) and the French Data Protection Act.
02Data collected
Data you provide directly
- Email address and login credentials
- Profile information (name, handle, avatar)
- Imported content (videos and associated metadata)
- Payment information (processed by our secure providers)
Data collected automatically
- IP address and browsing data
- Browser type and operating system
- Pages visited and session duration
- Service usage data (credits, actions performed)
03Purposes of processing
Your data is processed for:
- Provide and improve our AI optimisation services
- Manage your account and credits
- Process your payments securely
- Communicating with you about your account
- Ensure security and prevent fraud
- Comply with our legal obligations
04Legal basis
Your data is processed on the basis of:
- Performance of the contract: necessary to provide our services
- Consent: for marketing communications and non-essential cookies
- Legitimate interest: service improvement and security
- Legal obligation: retention of billing data
05Retention period
Your data is retained only for as long as strictly necessary for the purposes described. In general:
- Account data: account lifetime + 3 years
- Billing data: 10 years (statutory obligation)
- Login logs: 12 mois
- Cookies : 13 mois maximum
When your account is deleted, your personal data is erased or anonymised within 30 days, unless a legal obligation requires otherwise.
06Data sharing
We never sell your personal data. It may be shared only with:
- Payment providers: for secure transaction processing
- Hosting providers: for secure data storage
- Services d'analyse : anonymised data only
- Competent authorities: only on legal request
All our processors are located in the European Union or provide GDPR-compliant guarantees.
07Security
We implement technical and organisational measures to protect your data:
- SSL/TLS encryption of all communications
- CSRF protection and rate limiting on all actions
- Secure password hashing
- Least-privilege access to data
- Continuous security monitoring and alerts
08Your rights
Under the GDPR you have the following rights:
- Right of access: obtain a copy of your data
- Right to rectification: correct any inaccurate data
- Right to erasure: request deletion of your data
- Right to data portability: receive your data in a structured, machine-readable format
- Droit d'opposition : object to the processing of your data
- Right to restriction: request restriction of processing
To exercise your rights, contact us at contact@postvanta.app. We will respond within 30 days.
You may also lodge a complaint with the CNIL (CNIL, the French data protection authority).
09Third-party platform integrations
Postvanta uses the official APIs of several social platforms to enable content publishing. The notices below are required by each platform.
Postvanta uses YouTube API Services. By using our service to connect your YouTube account, you agree to be bound by the YouTube Terms of Service.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Our application is verified by Google. Below is the exact list of OAuth scopes enabled for Postvanta:
OAuth Scope requested:
https://www.googleapis.com/auth/youtube.upload— allows uploading and publishing videos to your YouTube channel on your behalf. This is the only Google/YouTube scope we request.
We do not request any other Google scopes. We do not access Gmail, Google Drive, Google Calendar, your contacts, or any other Google service.
You may revoke Postvanta's access to your YouTube account at any time by visiting Google Security Settings.
For information on how Google handles your data, please refer to the Google Privacy Policy.
Postvanta uses the TikTok API to enable users to publish content directly to their TikTok accounts. By connecting your TikTok account, you authorize Postvanta to act on your behalf as permitted by the TikTok Terms of Service and TikTok API Terms of Service.
When you connect your TikTok account, we use OAuth 2.0 authentication. We do not access your password. We only receive the permissions you explicitly authorize. Below is the exact list of TikTok products and scopes enabled for Postvanta:
Products enabled:
- Login Kit — enables secure OAuth 2.0 account connection
- Content Posting API — enables direct video publishing to your TikTok account
OAuth Scopes requested:
user.info.basic— access to your TikTok username, display name, and open_id (unique account identifier), used solely to identify your account within our platformvideo.publish— allows publishing videos directly to your TikTok feed on your behalfvideo.upload— allows uploading video files to TikTok's servers prior to publishing
We do not request any other scopes. We do not access your followers, messages, liked videos, comments, or any other TikTok data beyond what is listed above.
Important — TikTok Direct Post limitation: Due to TikTok API restrictions, videos published through Postvanta are not posted directly to your feed. They are sent to your TikTok inbox as a draft and must be manually reviewed and confirmed by you before being published. This is a TikTok platform requirement and not a limitation of our service.
The data collected through TikTok's API is used solely to enable content publishing. It is not sold, rented, or shared with third parties for advertising or any other purpose.
You can revoke access to our application at any time from your TikTok account settings under Settings → Privacy → Apps that can access your account.
For information on how TikTok handles your data, please refer to the TikTok Privacy Policy.
Postvanta uses the Instagram Graph API, provided by Meta Platforms, Inc., to enable users to publish content directly to their Instagram professional or creator accounts. By connecting your Instagram account, you agree to Meta's Platform Terms and Developer Policies.
We use OAuth 2.0 to authenticate your Instagram account. We do not access your password. Our application is verified by Meta. Below is the exact list of permissions enabled for Postvanta:
OAuth Permissions requested:
instagram_basic— access to your Instagram account ID and username, used solely to identify your accountinstagram_content_publish— allows publishing photos, videos, Reels and Stories to your Instagram account on your behalf
We do not request any other Instagram or Meta permissions. We do not access your direct messages, followers, following list, insights, or any personal Meta profile data.
We may access the following data: your Instagram account ID and username, solely to enable publishing. URLs of content published through our platform may be stored for your reference.
You can revoke access at any time from Instagram Settings → Security → Apps and Websites.
For information on how Meta handles your data, please refer to the Meta Privacy Policy.
Postvanta uses the Facebook Graph API, provided by Meta Platforms, Inc., to enable users to publish content to their Facebook Pages. By connecting your Facebook account, you agree to Meta's Platform Terms and Developer Policies.
We use OAuth 2.0 to authenticate access to your Facebook Page. We do not access your personal profile. Our application is verified by Meta. Below is the exact list of permissions enabled for Postvanta:
OAuth Permissions requested:
pages_show_list— allows listing the Facebook Pages you manage, used to let you select which Page to connectpages_manage_posts— allows creating and publishing posts (photos, videos) on your Facebook Page on your behalfpages_read_engagement— allows reading basic engagement data on your Page, used solely to confirm successful publicationpublish_video— allows uploading and publishing video content to your Facebook Page
We do not request any other Facebook permissions. We do not access your personal profile, friends list, private messages, ads account, or any personal Facebook data.
We may access the following data: your Page ID, Page name, and Page access token, solely to enable content publishing on your Page. We do not access your personal profile data.
You can revoke access at any time from Facebook Settings → Security and Login → Apps and Websites.
For information on how Meta handles your data, please refer to the Meta Privacy Policy.
Postvanta uses the LinkedIn API to enable users to publish content to their LinkedIn profile or company page. By connecting your LinkedIn account, you agree to LinkedIn's User Agreement and API Terms of Use.
We use OAuth 2.0 to authenticate your LinkedIn account. We do not access your password. Our application is verified by LinkedIn. Below is the exact list of OAuth scopes enabled for Postvanta:
OAuth Scopes requested:
r_liteprofile— access to your LinkedIn first name, last name, and member URN (unique identifier), used solely to identify your account within our platformr_emailaddress— access to your primary LinkedIn email address, used for account identification onlyw_member_social— allows creating and publishing posts (text, images, videos) on your LinkedIn profile or company page on your behalf
We do not request any other LinkedIn scopes. We do not access your connections, messages, job applications, endorsements, or any other LinkedIn data.
We may access the following data: your LinkedIn member URN (unique identifier), first name, and last name, solely for account identification and publishing purposes. URLs of content published through our platform may be stored for your reference.
You can revoke access at any time from LinkedIn Settings → Privacy → Permitted Services.
For information on how LinkedIn handles your data, please refer to the LinkedIn Privacy Policy.
All OAuth tokens are encrypted and stored securely on our servers hosted within the European Union. They are never shared with third parties. You can disconnect any platform individually at any time from your Postvanta account settings.
10Cookies
We use cookies to:
- Cookies essentiels : site operation and authentication
- Cookies analytiques : understanding how the service is used (with your consent)
You can manage your cookie preferences at any time through your browser settings.
11Modifications
We reserve the right to modify this policy at any time. In the event of a material change, you will be informed by email or by a notification on the platform. The last-updated date is shown at the top of this page.
12Contact
For any question about your data
🔧 api@postvanta.app (questions techniques / API)
📍 Paris, France — European Union
HEALTH GUM COMPANY — Postvanta — N° 833 254 667