Privacy Policy

1. Who we are

Post On Go is a social media management platform developed and operated by Nefrox Consulting, LLC & Nefrox SPA, located at 2600 Lake Ridge Rd, The Colony, Texas, United States. Contact: privacidad@postongo.com.

We act as a data controller for personal data we collect through the Service, consistent with applicable privacy laws including the GDPR where it applies.

2. Data we collect

2.1 Data you provide

• Account: name, email, phone number, and password (stored with bcrypt hashing).
• Business: agency name, timezone, country.
• Billing: payment details processed by Stripe (we do not store full card numbers).
• Content: images, videos, text, hashtags, and other materials you upload or schedule.
• Client CRM data: contact and contract information you enter about your clients.
• Communications: messages sent via contact forms or email.

2.2 Social network data (OAuth)

When you connect a social account, we obtain data through OAuth 2.0 with your explicit consent. We never ask for social network passwords.

• Facebook / Instagram / Threads (Meta): account identifiers, profile info, pages you manage, and access tokens needed to publish and read permitted insights.
• LinkedIn / YouTube / X: profile identifiers and tokens required to publish on your behalf.
• TikTok: username, account ID, avatar, access/refresh tokens, and content metadata required to publish and list authorized videos. Scopes requested: user.info.basic, user.info.stats, video.publish, video.upload, video.list.

2.3 Automatically collected data

• Usage events, device/browser technical data, IP address, and essential cookies/session tokens.

3. How we use data

• Provide account access, scheduling, publishing, analytics, and collaboration features.
• Authenticate users, protect accounts (including optional 2FA), and prevent abuse.
• Send service notifications related to publishing, security, and billing.
• Process payments via Stripe and improve product performance with aggregated analytics.
• Comply with legal obligations.

4. Sharing

We do not sell personal data. We share data only with:

• Social platforms you authorize, solely to publish or retrieve the data needed for the features you use.
• Infrastructure providers (hosting, storage, email) under processing agreements.
• Stripe for payments.
• Authorities when legally required, after reviewing the request and minimizing disclosed data.

5. Meta (Facebook, Instagram, Threads) data

We use Meta APIs only for the purposes described in this policy, store tokens encrypted, and revoke them when you disconnect. You may also revoke access in Facebook Settings → Security → Apps and websites.

6. TikTok data

Post On Go uses the official TikTok for Developers API under TikTok’s developer terms to let users connect their account, publish content, and retrieve basic metrics:

• We request only scopes needed to identify your account, publish/upload content you authorize, and list content for scheduling and reporting (user.info.basic, user.info.stats, video.publish, video.upload, video.list).
• We do not access TikTok direct messages or contact lists.
• TikTok tokens are encrypted at rest and revoked when you disconnect in Post On Go or in TikTok Settings → Privacy → Linked apps.
• We comply with the TikTok API Developer Terms of Service.

7. Data deletion

• In-app: Settings → Account → Delete account.
• By email: privacidad@postongo.com with subject “Data deletion request”.
• We process deletion requests within 30 days, subject to legal retention requirements (e.g. billing records).
• Status / Meta-related deletion info: https://postongo.com/data-deletion.

8. Cookies

We use essential cookies for authentication/session, preference cookies, and anonymized analytics cookies. You can control cookies in your browser; disabling essential cookies may break login.

9. Security

• TLS in transit; bcrypt password hashing; encrypted OAuth tokens at rest; optional 2FA; restricted database access; encrypted backups.

Report vulnerabilities to seguridad@postongo.com.

10. Your rights

Where applicable (including GDPR), you may request access, rectification, erasure, portability, restriction, objection, or withdrawal of consent by contacting privacidad@postongo.com. We respond within 30 days.

11. Retention

• Active account data: while the account remains open.
• After cancellation: generally deleted within 90 days unless a longer legal retention applies.
• Billing records: up to 7 years where required.
• Social tokens: deleted immediately on disconnect.

12. Children

The Service is not directed to anyone under 18. We do not knowingly collect children’s data.

13. International transfers

Data may be processed on servers outside your country. Where required, we use appropriate transfer safeguards.

14. Changes

We may update this policy. Material changes will be announced with reasonable notice. Continued use after the effective date constitutes acceptance.

15. Contact

• Email: privacidad@postongo.com
• Address: Nefrox Consulting, LLC · 2600 Lake Ridge Rd, The Colony, Texas, United States