Privacy Policy

This Privacy Policy explains how Typing Ltd (“Typing”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data processed through the Typing.media web application (“the Platform”). It applies to all authorised users of the Platform.

We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy is publicly accessible at a non-geoblocked URL and is crawlable by Meta’s and TikTok’s review systems.

Typing Ltd is the data controller for personal data processed through the Platform.

Registered address: London, England | Email: legal@typing.media

3.1 User Account Data. We collect your name, email address, role, access permissions, login activity, and session data when you access the Platform.

3.2 Social Media Account Data (Instagram). When you connect an Instagram account to the Platform, we collect and store: OAuth access tokens and refresh tokens issued by Instagram; Instagram Business/Creator account identifiers and usernames; and the permissions (“scopes”) granted to the Platform. We use this data exclusively to publish scheduled content to your authorised accounts via the Instagram Graph API. We do not collect or store your Instagram password. We do not use Instagram platform data for advertising, profiling, eligibility determinations, surveillance, or any purpose prohibited by Meta’s Developer Data Use Policy.

3.3 Social Media Account Data (TikTok). When you connect a TikTok account to the Platform, we collect and store: OAuth access tokens and refresh tokens issued by TikTok; TikTok account identifiers and display names; and the permissions (“scopes”) granted to the Platform. This data is used exclusively to publish scheduled content to your authorised TikTok accounts via the TikTok Content Posting API. We do not collect your TikTok password, and do not use TikTok data for any purpose beyond direct content publishing as authorised by the account holder.

3.4 Google Drive Data. The Platform connects to Google Drive to access content assets including media files, campaign briefs, and supporting materials. We access only files that are explicitly shared with or within the Platform’s designated Drive folders. We do not access, store, or transmit Google Drive content to any third party. Access is restricted to authorised team members within Typing Ltd.

3.5 Claude Code (Anthropic). The Platform’s development and maintenance uses Claude Code, an AI-powered coding assistant provided by Anthropic. Claude Code is used exclusively for software development tasks (code generation, debugging, codebase maintenance). No personal data, OAuth tokens, social media account credentials, or user content is transmitted to Claude Code or to Anthropic’s systems. Claude Code interacts only with the Platform’s source code.

3.6 Content Data. The Platform processes content (posts, captions, media files, scheduling metadata) that you create or upload. This data is processed solely to schedule and publish content on your behalf to the connected social media accounts.

3.7 Technical and Usage Data. We collect standard technical data including IP addresses, browser type, device information, page access logs, and activity timestamps. This is used for security monitoring and platform integrity.

We process personal data to:

• (a) authenticate users and provide access to the Platform;
• (b) connect to Third-Party Platforms using OAuth tokens and publish content on your behalf;
• (c) store and refresh OAuth tokens to maintain scheduling functionality;
• (d) access relevant Google Drive files for content management;
• (e) monitor usage and detect security incidents;
• (f) comply with legal obligations.

We do not use personal data for advertising, profiling, or any purpose unrelated to the operation of the Platform.

The Platform uses the Instagram Graph API, which requires the following specific disclosures:

• (a) We use the Instagram Graph API to publish content (photos, videos, Reels, Stories, captions) to authorised Instagram Business/Creator accounts.
• (b) We use the following Instagram API permissions: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_insights.
• (c) Data obtained via the Instagram Graph API is used solely for content scheduling and publishing. It is not sold, rented, shared with third parties, used for surveillance, or used to build user profiles.
• (d) OAuth access tokens are encrypted at rest and in transit. They are not shared beyond what is technically necessary to communicate with the Instagram Graph API endpoints.
• (e) Users may revoke the Platform’s access to their Instagram accounts at any time via Instagram Settings > Apps and Websites, which will immediately invalidate all stored tokens.
• (f) We retain Instagram API data only for as long as necessary to fulfil the purposes above. Upon account disconnection or user request, all associated tokens and account identifiers are deleted within 30 days.
• (g) This privacy policy is accessible at a publicly available, non-geoblocked URL that can be crawled by Meta’s systems.

The Platform uses the TikTok Content Posting API. The following disclosures apply:

• (a) We use TikTok’s Content Posting API (Direct Post) to publish video and photo content to authorised TikTok accounts on behalf of users.
• (b) All content is published with the explicit knowledge and authorisation of the account holder. The Platform does not post content without user direction.
• (c) The Platform does not add watermarks, promotional branding, or commercial text to content published via TikTok’s API.
• (d) TikTok OAuth tokens are stored encrypted and used solely for content publishing. They are not shared with any third party.
• (e) Users may revoke the Platform’s access to their TikTok accounts at any time via TikTok Settings > Security > Authorised Apps.
• (f) We comply with TikTok’s Developer Terms of Service and Developer Guidelines throughout the duration of the integration.
• (g) This privacy policy URL is disclosed in the TikTok Developer Portal app configuration as required by TikTok’s App Review Guidelines.

We process personal data on the following legal bases:

• (a) Legitimate interests — operating the Platform and providing scheduling services;
• (b) Contractual necessity — processing necessary to perform employment or contractor agreements with Typing Ltd;
• (c) Legal obligation — processing required under applicable law.

OAuth tokens: retained until revoked by the user or until Platform access is terminated, then deleted within 30 days. Usage logs: retained for up to 12 months. Content scheduling data: retained for the duration of Platform access. Upon request, all personal data associated with a user account will be deleted within 30 days.

Users and connected social media account holders may request deletion of their data at any time by emailing legal@typing.media. This includes deletion of OAuth tokens, account identifiers, and any associated content data. Requests will be processed within 30 days. This mechanism satisfies Meta’s and TikTok’s requirements for user data deletion.

We implement appropriate technical and organisational measures to protect personal data, including: encryption of OAuth tokens at rest and in transit; role-based access controls; regular security reviews; and secure credential management practices. We will notify affected users and relevant authorities of any data breach in accordance with UK GDPR requirements.

We do not sell or rent personal data. We share personal data only:

• (a) with Meta and TikTok, to the extent necessary to operate the API integrations described above;
• (b) with Google, to the extent necessary to operate the Google Drive integration;
• (c) with service providers acting as processors on our behalf, bound by appropriate data processing agreements;
• (d) where required by law or regulatory authority.

We do not use third-party advertising networks, analytics trackers, or data brokers. All third-party integrations are limited to those described in this policy: Instagram Graph API, TikTok Content Posting API, Google Drive API, and Claude Code (Anthropic) for development purposes only.

Some Third-Party Platforms (including Meta and TikTok) may process data outside the UK or EEA. Where this occurs, we rely on the relevant platform’s Standard Contractual Clauses or other appropriate safeguards recognised under UK GDPR. Claude Code (Anthropic) is used exclusively for development-side code operations and does not receive personal data.

As a data subject you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; object to or restrict processing; and lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any right, contact: legal@typing.media. We will respond within 30 days.

This privacy policy is hosted at a publicly accessible, non-geoblocked URL and is accessible to Meta’s automated crawlers, in compliance with Meta Platform Terms updated February 2025. The URL is registered in the Privacy Policy field of our Meta app dashboard.

We may update this Privacy Policy. We will notify authorised users of material changes. Continued use of the Platform following notification constitutes acceptance of the updated policy.

Data Controller: RE:Typing Ltd | Email: ben@typing-ltd.com | Website: typing.media