Privacy Policy

This Privacy Policy explains how Expansio Scheduler ("we", "our", "the Service") collects, uses, and protects information when you use our social media scheduling tool.

1. Information we collect

• Account information: the email address and password you sign up with, and your workspace/business name.
• Connected platform data: when you connect a Facebook Page, Instagram Business account, LinkedIn profile, YouTube channel, or Google Business Profile location, we receive and store an access token (and, for Google accounts, a refresh token) issued by that platform, along with basic profile information (page/channel name and ID) needed to publish on your behalf.
• Content you provide: captions, images, and videos you upload or write to be published to your connected accounts, and the schedule you set for them.
• Usage and performance data: basic engagement metrics (reach, likes, comments, clicks) that the connected platforms make available for posts published through the Service.
• Comments: if you use the inbox, we read recent comments on your Facebook Page, Instagram and YouTube posts (comment text, the commenter's public name, and time) and store them so you can reply to and moderate them. We only read comments on accounts you connected, and only send replies you write or approve.
• Link page statistics: if you publish a link page, we count how many times it is opened and each link is clicked, as daily totals. We do not store visitor identities, IP addresses or cookies for this.
• AI assistant: if you add your own AI provider key, the text you ask the assistant to work on (and, for image descriptions, the image link) is sent to that provider under your account and their terms. Your key is stored encrypted.

2. How we use this information

We use the information above solely to operate the Service: authenticating you, publishing the content you create to the platforms and accounts you've explicitly connected, at the times you schedule, and showing you performance data for those posts. We do not use your content, comments or connected-account data to train AI models, and we do not sell your data to third parties.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we share information

We share information only with the social platforms themselves (as required to publish content you schedule), with infrastructure service providers under confidentiality obligations, or when required by law.

4. Data security

Access tokens for your connected accounts are encrypted at rest (AES-256-GCM) and are never displayed in plaintext. Passwords are hashed with Argon2.

5. Data retention and deletion

You can disconnect any connected account at any time, which revokes our stored token for it. To delete your account and all associated data, email info@expansio.in from your account address with the subject "Delete my data" (see also the data deletion page); we will delete your data within 30 days, and backups within a further 14 days, except where legally required to retain it.

6. Your choices

You can revoke our access to your Facebook, Instagram, LinkedIn, or Google/YouTube account at any time directly from that platform's own security/app settings.

7. Children's privacy

The Service is intended for users aged 18 and over. We do not knowingly collect information from children.

8. Changes to this policy

We may update this policy from time to time and will post the updated version here.

9. Contact

info@expansio.in