Privacy Policy

Last updated: 9 October 2026

This policy explains what personal data Storm Studios Social handles, why, and what choices you have. We have tried to write it in plain English.

1. Who we are

Storm Studios Social is a social media publishing tool operated by INTELIGENCIA ARTIFICIAL LTD. INTELIGENCIA ARTIFICIAL LTD is the controller of the personal data described in this policy. You can contact us at contact@storm-studios.co.uk.

2. What we collect and why

a. Authorization data from connected platforms

When an account owner connects a social account through a platform's official authorization screen, we receive and store:

• the platform account identifier (for example, the TikTok open_id);
• the display name or username and the avatar URL;
• the scopes (permissions) that were granted;
• OAuth access and refresh tokens, which are stored encrypted at rest.

We use this data only to publish content that the user has prepared. We never see or store the account owner's password for the platform.

b. Content you write or upload

Post text, images, videos, alt text, cover images and schedule times. We use this to prepare, check, store, schedule and publish your posts.

c. Team login

For team members who sign in: a username and a salted password hash (we do not store the password itself). We set one strictly necessary session cookie to keep you signed in. We do not use advertising cookies or analytics cookies.

d. Basic server logs

Our servers record IP address, user agent and timestamps of requests. We keep these for security and abuse prevention.

3. How we use data, and what we do not do

• We do not sell personal data.
• We do not use data from connected accounts for advertising, and we do not use it to train AI models.
• We do not post anything unless the user has prepared and approved it.
• When AI-assisted text adaptation is enabled, the post text that the user wrote is sent to the AI provider solely to produce the adapted wording. Tokens, credentials and other account data are not sent.

4. TikTok

We use TikTok Login Kit and the Content Posting API only to let the account owner publish or upload videos they have approved. Data received from TikTok is used only for that purpose.

TikTok's own handling of your data is described in TikTok's Privacy Policy. You can revoke our access at any time in the TikTok app's security and permissions settings (Settings and privacy, then Security & permissions, then Apps and services).

5. Other platforms

For Instagram, Facebook, LinkedIn, X, YouTube, Pinterest, Threads and any other platform we support, the same principles apply: we use the access you grant only to publish content you have prepared and approved. Each platform lets you review and remove connected apps in its own account or security settings, and doing so revokes our access. Please see the platform's own privacy policy for how it handles your data.

6. Retention

• Platform tokens are deleted when an account is disconnected, or within 30 days of a deletion request.
• Content is deleted when a client workspace is removed, or on request.
• Server logs are kept for up to 90 days.

7. Sharing

We share data only with:

• our hosting provider, which stores and processes data on our behalf;
• the social platforms themselves, at the user's direction, when a post is published or scheduled;
• an AI text provider, only when AI-assisted adaptation is enabled and only for the post text, as described above.

We do not share personal data with any other third parties.

8. Security

Platform tokens are encrypted at rest. Connections to the service use HTTPS. Access to data is limited to authorized members of our team. No system is perfectly secure, but we take reasonable steps to protect the data we hold.

9. International transfers

Our hosting provider and the social platforms may process data in countries other than your own. Where personal data is transferred across borders, we rely on the safeguards available under applicable law, such as an adequacy decision or standard contractual clauses, where they apply. Contact us if you would like more information.

10. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, and withdraw consent at any time. You also have the right to complain to your local data protection supervisory authority. To exercise any of these rights, email contact@storm-studios.co.uk.

11. Children

Storm Studios Social is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make a material change, we will take reasonable steps to let connected account owners know.

13. Disconnecting and deleting your data

You can disconnect and ask us to delete your data at any time:

1. Revoke Storm Studios Social's access in the platform itself (in the platform's security or connected apps settings). For TikTok, use the TikTok app's security and permissions settings.
2. And/or email contact@storm-studios.co.uk from the email address associated with the account, with the subject "Data deletion request".

We will confirm your request and complete it within 30 days.