We collect only the minimum information required to provide our services.

1.1 Personal Information

We may collect the following personal data:

Name — used to personalize your account and communication.

Email Address — used for account creation, security notifications, billing, and support.

Payment Information — processed securely by third-party payment providers (Stripe). We do not store full credit card details.

Authentication & Access Tokens — OAuth tokens provided by Instagram, Facebook, WhatsApp Business, YouTube, Pinterest, TikTok, and other supported platforms to enable publishing and scheduling features.

Account Preferences & Settings — such as language, connected accounts, and configuration.

We do NOT collect sensitive personal information including but not limited to: health data, biometric data, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, genetic data, Social Security numbers, or precise geolocation. If we ever need to collect any such data in the future, we will update this policy and obtain your explicit consent before doing so.

1.2 Non-Personal Information (Cookies & Analytics)

We may collect non-personal technical information such as:

IP address

Browser type

Device type

Operating system

Pages visited

Session duration

Cookies and tracking identifiers

This data helps us maintain platform security, improve performance, and analyze usage patterns. We do NOT use cookies for third-party advertising or cross-site behavioral tracking.

1.3 Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under the GDPR:

Contractual Necessity — Processing required to provide the services you have signed up for (e.g., publishing posts, scheduling content, managing connected accounts).

Legitimate Interest — Processing for platform security, fraud prevention, and improving our services, where such interests do not override your fundamental rights.

Consent — Processing based on your explicit consent, including connecting social media accounts via OAuth and receiving optional communications. You may withdraw consent at any time.

Legal Obligation — Processing required to comply with applicable laws and regulations.

We use your data strictly for:

Creating, scheduling, publishing, and managing social media posts that you explicitly request

Authenticating your account with supported social media platforms

Displaying your connected accounts and media

Providing customer support

Sending transactional emails (billing notices, login alerts, etc.)

Processing payments

Improving and securing our platform

We never post content without your manual action. We never sell, rent, or trade your data with any third parties.

Chat Cron works with the following trusted third-party service providers to deliver our core functionality. Each provider is bound by contractual obligations requiring them to protect your data, use it only at our direction, and delete it when we cease using their service:

Stripe — Payment processing. Your payment data is handled directly by Stripe under their own Privacy Policy (https://stripe.com/privacy). We never store full card details.

Amazon Web Services (AWS) — Cloud infrastructure and encrypted data storage.

Google Cloud Platform — Supplementary cloud infrastructure where applicable.

Vercel / our hosting provider — Web application hosting and content delivery.

SendGrid / transactional email provider — Sending system emails (billing, login alerts, etc.).

Sentry — Error monitoring and crash reporting (anonymized technical data only).

None of these providers are permitted to sell, share, or use your data for their own commercial purposes. We do not share your data with advertising networks, data brokers, or any analytics companies beyond anonymized platform performance metrics.

Chat Cron uses the Meta Graph API and Instagram Graph API to enable post scheduling and publishing features for Facebook Pages and Instagram Business/Creator accounts. This section is maintained in full compliance with Meta's Platform Terms, Developer Policies, and Data Use Policy.

Our application uses the Meta Graph API and requests only the minimum permissions necessary:

pages_show_list — Retrieves the list of Facebook Pages the user manages, for scheduling purposes.

pages_read_engagement — Reads basic engagement data on the user's own Facebook Page posts for analytics display.

pages_manage_posts — Creates, schedules, and publishes posts on the user's Facebook Page on their explicit request.

pages_manage_metadata — Reads Page settings and metadata necessary for scheduling functionality.

instagram_basic — Accesses the user's Instagram Business or Creator account ID and basic profile information.

instagram_content_publish — Publishes photos, videos, carousels, and Reels to the user's Instagram Business or Creator account on their explicit request.

instagram_manage_insights — Reads the user's own Instagram account performance insights for analytics display. (Optional — requested only if the user enables analytics.)

business_management — Accesses the user's Meta Business Suite to link Facebook Pages and Instagram accounts correctly.

publish_video — Uploads and publishes video content to the user's Facebook Page.

We do not request any permission beyond what is listed above. All permissions are requested through the official Meta Login (OAuth 2.0) flow and must be explicitly approved by the user.

Meta User ID & Access Token — Used for authentication and Graph API access. Retained until account disconnection. Stored using AES-256 encryption.

Facebook Page ID & Page Access Token — Used for publishing to the user's Facebook Page. Retained until account disconnection. Stored using AES-256 encryption.

Instagram Business Account ID — Used for publishing to the user's Instagram account. Retained until account disconnection.

Basic Profile Information (username, profile picture, page name) — Used for account identification and UI display. Not stored permanently beyond session use.

Post Metadata (caption, media, scheduled time, hashtags) — Used for scheduling and publishing. Retained only until the post is published or deleted by the user.

Page Insights & Post Performance Data — Used for analytics display within Chat Cron. Retained for 30 days only, then permanently deleted.

IMPORTANT: Meta Platform Data is never used for advertising, profiling, or any purpose beyond core Chat Cron functionality.

When you connect your Facebook or Instagram account, we use the Meta Login (OAuth 2.0) protocol exclusively.

Token storage: Meta access tokens and page tokens are stored using AES-256 encryption on secure cloud servers with strict role-based access controls. Tokens are never exposed to client-side code or third parties.

Token rotation: Short-lived access tokens are exchanged for long-lived tokens where applicable and are rotated securely and never stored beyond their expiry.

Your Facebook or Instagram password is never requested, collected, or stored under any circumstances.

Revoking access: You can revoke our access at any time via Facebook Business Integrations Settings:

👉 https://www.facebook.com/settings?tab=business_tools

Chat Cron strictly commits to the following:

Meta Platform Data is used solely for core application functionality (scheduling, publishing, analytics display).

We do not transfer, sell, share, or disclose any Meta user data to third parties, except as required by applicable law.

We do not use Meta Platform Data to make decisions that affect users' eligibility for credit, housing, employment, education, insurance, or other legally protected classifications.

We do not use Meta Platform Data to profile, discriminate against, or disadvantage people based on race, ethnicity, color, national origin, religion, age, sex, sexual orientation, gender identity, family status, disability, or medical or genetic condition.

We do not combine Meta Platform Data from one user's account with another user's data.

We do not combine Meta Platform Data with data from other services or third-party data sources.

We do not use Meta Platform Data to train machine learning models or algorithms.

We do not scrape or extract data from Meta platforms beyond authorized Graph API calls.

We do not attempt to reverse-engineer the Meta API, circumvent rate limits, or bypass access controls.

We do not store Meta Platform Data on devices beyond what is strictly necessary for the active user session.

We do not use Meta user data to perform, facilitate, or provide tools for surveillance.

Before any content is sent to Meta platforms, you must expressly confirm the publish or schedule action.

Chat Cron displays a preview of the content (caption, media, scheduled time) before submission so you can review and edit it.

Chat Cron will never publish, edit, or delete posts on your Facebook Page or Instagram account without your explicit, individual action.

Chat Cron will never follow or unfollow accounts, send messages, react to content, or interact with other users' content on your behalf without your explicit action.

All publishing actions are genuine, user-initiated, and individually confirmed. Automated or bot-based posting is strictly prohibited.

Chat Cron will never add promotional watermarks or branding to your content without your consent.

In compliance with Meta's Platform Terms, Chat Cron provides a mandatory data deletion mechanism:

Users can request full deletion via the app: Settings → Connected Accounts → Facebook / Instagram → Disconnect & Delete Data

Users can also request deletion via email at: [email protected]

Meta users may also trigger a data deletion request directly from their Facebook account settings. Chat Cron honors all such requests within 30 days.

Data Deletion Callback URL: https://chatcron.com/meta/data-deletion

Status Check URL: https://chatcron.com/meta/data-deletion/status

Upon a valid deletion request, all Meta-related OAuth tokens, Page IDs, Instagram Account IDs, post metadata, and analytics data associated with the requesting user are permanently and irreversibly deleted from our systems within 30 days.

In the event of any unauthorized access, disclosure, or compromise of Meta Platform Data, Chat Cron will:

Immediately suspend access to the affected Meta accounts and API connections.

Notify Meta within 24 hours of becoming aware of the incident via Meta's Developer support channels.

Take immediate steps to contain and remedy the breach.

Cooperate fully with Meta and provide all reasonably requested information.

Notify affected users promptly in accordance with applicable data breach notification laws.

Meta Platform Terms — https://developers.facebook.com/terms/

Meta Developer Policies — https://developers.facebook.com/devpolicy/

Meta Developer Data Use Policy — https://developers.facebook.com/terms/dfc_developer_data_use_policy/

Instagram Platform Policy — https://developers.facebook.com/docs/instagram/policy/

Meta Business Tools Terms — https://www.facebook.com/legal/businesstech

Meta Privacy Policy — https://www.facebook.com/privacy/policy/

Chat Cron uses the WhatsApp Business API (Cloud API) via Meta to enable WhatsApp Business message scheduling and sending features. This section is maintained in full compliance with Meta's Platform Terms, WhatsApp Business Solution Provider policies, and applicable data protection regulations.

We request the following permissions:

whatsapp_business_messaging — Used to send approved message templates and responses to customers on behalf of the connected WhatsApp Business Account, at the user's explicit request.

whatsapp_business_management — Used to manage the user's WhatsApp Business Account settings, message templates, and phone number configurations within Chat Cron.

WhatsApp Business API access is available only for verified WhatsApp Business Accounts. Chat Cron does not support or enable messaging via personal WhatsApp accounts.

WhatsApp Business Account ID & Phone Number ID — Used for account identification and API access. Retained until account disconnection.

Meta System User Access Token — Used for WhatsApp Business Cloud API authentication. Stored using AES-256 encryption. Retained until account disconnection.

Message Template Content (text, parameters) — Used for scheduling and sending approved WhatsApp message templates. Retained only until the message is sent or deleted by the user.

Message Delivery Status — Used to confirm successful message delivery. Not stored beyond the confirmation window.

IMPORTANT: Chat Cron does not store the content of end-user messages received via WhatsApp (i.e., replies from customers). Chat Cron only processes outbound message templates sent at the explicit direction of the business user.

Only Meta-approved message templates may be sent through Chat Cron's WhatsApp integration. No freeform messages are sent outside of approved 24-hour customer service windows.

Chat Cron will never send spam, bulk unsolicited messages, or messages to users who have not opted in.

All messages must comply with WhatsApp's Business Messaging Policy and WhatsApp Commerce Policy.

Automated sending is only permitted for pre-approved message templates within WhatsApp's approved use cases. All scheduling actions are initiated by a real, authenticated business user.

WhatsApp Business API data is used solely for scheduling, sending approved message templates, and delivery status tracking.

We do not share, sell, or disclose any WhatsApp user data to third parties, except as required by law.

We do not use WhatsApp data for advertising, profiling, or audience targeting.

We do not store or process message content from end-users (inbound messages) in any form.

We do not use WhatsApp data to train machine learning models or algorithms.

Via the app: Settings → Connected Accounts → WhatsApp Business → Disconnect

Via Meta Business Suite: https://business.facebook.com/settings/

Upon disconnection, all WhatsApp Business Account tokens, Phone Number IDs, message templates, and associated data are immediately and permanently deleted from our systems within 30 days.

WhatsApp Business Solution Provider Terms — https://www.whatsapp.com/legal/business-solution-provider-terms/

WhatsApp Business Messaging Policy — https://www.whatsapp.com/legal/business-policy/

WhatsApp Commerce Policy — https://www.whatsapp.com/legal/commerce-policy/

Meta Platform Terms — https://developers.facebook.com/terms/

WhatsApp Privacy Policy — https://www.whatsapp.com/legal/privacy-policy/

Chat Cron uses YouTube API Services to enable video publishing and channel management features. This section is maintained in full compliance with the YouTube API Services Terms of Service and Google API Services User Data Policy.

IMPORTANT NOTICE — Google API Services Limited Use Disclosure:

Chat Cron's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means:

Google user data is used only to provide or improve user-facing features that are prominent in Chat Cron's interface.

Google user data is never transferred to third parties except as necessary to provide Chat Cron's core features, and only with user consent.

Google user data is never used or transferred for serving ads, including retargeting, personalized, or interest-based advertising.

Google user data is never used to determine creditworthiness or for lending purposes.

Google user data is never sold, licensed, or rented to any third party.

Humans do not read Google user data except: (a) with user's affirmative consent, (b) for security purposes such as investigating abuse, (c) when aggregated and anonymized for internal operations, or (d) when required by law.

Google user data is never used to train generalized machine learning or AI models.

We request only the minimum OAuth scopes necessary:

https://www.googleapis.com/auth/youtube.upload — Used exclusively for uploading videos to the user's YouTube channel on their explicit request.

https://www.googleapis.com/auth/youtube.readonly — Used for reading channel information and video status for display purposes only.

https://www.googleapis.com/auth/youtube.force-ssl — Used for reading comment threads and publishing authorized replies to YouTube comments the user chooses to manage.

https://www.googleapis.com/auth/yt-analytics.readonly — Used for accessing channel analytics to display performance reporting within the app.

We do not request any scope beyond what is listed above. Users explicitly select the privacy setting (public, private, or unlisted) for every video upload. Chat Cron will never change the privacy status of a video without the user's explicit consent.

Google OAuth Refresh Token — Used for authentication and YouTube API access. Retained until account disconnection. Stored using AES-256 encryption.

Channel Name & ID — Used for account identification and UI display. Retained until account disconnection.

Video Metadata (title, description, tags) — Used for scheduling and publishing. Retained until deleted by the user.

Video Privacy Settings — Used for publishing management per user preference. Retained while the video is active.

Channel Statistics (views, subscribers) — Used for performance reporting. Retained for 30 days only.

IMPORTANT: Your YouTube channel data is never permanently stored in our databases. Only your API credentials (OAuth tokens) are retained — stored using AES-256 encryption on secure, access-controlled cloud infrastructure.

When you connect your YouTube account, we use the Google OAuth 2.0 protocol exclusively.

Requested permissions: Only the minimum scopes listed in Section 4.3.1 are requested.

Token storage: OAuth refresh tokens are stored using AES-256 encryption. Tokens are never exposed to client-side code or third parties.

Token rotation: Access tokens are automatically rotated and never stored beyond their expiry.

Your Google/YouTube password is never requested, collected, or stored under any circumstances.

Revoking access: You can revoke access at any time via Google Security Settings:

👉 https://security.google.com/settings/

YouTube API data is used solely for core application functionality (scheduling, publishing, analytics display).

User data is never shared with third parties for advertising, profiling, or monetization purposes.

YouTube API data is never combined with external data sources beyond basic metrics computation.

We do not use YouTube data to train machine learning models or algorithms.

Automated/bot publishing of any kind is forbidden. All video publishing actions must be initiated by a real, authenticated user.

Publishing without user consent is strictly prohibited.

Rate limiting policy: Users are prohibited from publishing more than one video per account within a 1-minute or 15-minute window. Violations result in immediate account suspension.

Chat Cron is strictly an 18+ platform. Users under 18 are not permitted to register. Any account found to belong to a user under 18 will be immediately suspended and all data permanently deleted.

You are solely responsible for all content you upload or publish through Chat Cron. Chat Cron acts solely as a scheduling and publishing tool and has no editorial control over user-uploaded content. Any content that violates YouTube's Community Guidelines, applicable laws, or third-party rights is the sole responsibility of the uploading user.

Via the app: Settings → Connected Accounts → YouTube → Disconnect

Via Google: Revoke access at https://security.google.com/settings/

Upon disconnection, all YouTube OAuth tokens are immediately and permanently deleted. All personal data deletion requests are processed within 30 days.

Chat Cron complies with the U.S. COPPA Act, the EU GDPR regulation, and all applicable laws regarding protection of minors. When managing content designated as "Made for Kids" on YouTube, our platform adheres to YouTube's specific data handling restrictions for such content.

YouTube API Terms of Service — https://developers.google.com/youtube/terms/api-services-terms-of-service

YouTube Developer Policies — https://developers.google.com/youtube/terms/developer-policies

Google API Services User Data Policy — https://developers.google.com/terms/api-services-user-data-policy

Google Privacy Policy — https://policies.google.com/privacy

YouTube Terms of Service — https://www.youtube.com/t/terms

Chat Cron uses the Pinterest API to enable Pin scheduling and publishing features. This section is maintained in full compliance with the Pinterest Developer and API Terms of Service and Pinterest Developer Guidelines.

Our application uses the Pinterest API strictly for:

Scheduling and publishing Pins to the user's Pinterest boards on their explicit request.

Displaying the user's boards and profile information within the Chat Cron interface.

Accessing campaign analytics related to the user's own account for performance reporting.

We do NOT use the Pinterest API for:

Scraping or automated data extraction from Pinterest.

Accessing or storing data from other Pinterest users' accounts.

Combining Pinterest data with third-party data sources or other users' data.

Providing platform-wide insights, benchmarking, or competitor research.

Any advertising targeting outside of Pinterest's own advertising platform.

Pinterest OAuth Access Token — Retained until account disconnection. Stored using AES-256 encryption.

User's Pinterest Profile ID & Username — Used for account identification and UI display. Not stored permanently; retrieved fresh via API each session.

Board Names & Board IDs — Used for Pin scheduling selection. Not stored permanently; retrieved via API on demand.

Pin Metadata (title, description, link, image) — Retained only until the Pin is published or deleted by the user.

Campaign Analytics — Retained for 30 days.

We use Pinterest's official OAuth 2.0 authorization flow exclusively. Your Pinterest password is never requested, collected, or stored. Tokens are stored with AES-256 encryption and never exposed to third parties.

Revoking access: 👉 https://www.pinterest.com/settings/security

Pinterest Data is used solely to provide scheduling and publishing services.

We do not share, sell, or disclose any Pinterest Data to third parties, except as required by law.

We do not combine Pinterest Data across users or with third-party data sources.

We do not use Pinterest Data for advertising targeting or to train machine learning models.

All actions performed on Pinterest through Chat Cron require your explicit, individual authorization. Chat Cron will never create, save, edit, or delete Pins, follow or unfollow accounts, send messages, or make comments on Pinterest without your explicit action.

All published Pins will include a proper link back to their source on Pinterest where applicable.

Chat Cron will not alter, filter, or obscure any Pinterest content.

You are solely responsible for ensuring that content you publish complies with Pinterest's Community Guidelines and all applicable laws.

In the event of any unauthorized access to Pinterest Data, Chat Cron will promptly notify Pinterest (within 2 business days for EEA users), take immediate remediation steps, investigate the incident, and cooperate fully with Pinterest.

Via the app: Settings → Connected Accounts → Pinterest → Disconnect

Via Pinterest: Revoke access at https://www.pinterest.com/settings/security

Upon disconnection, all Pinterest OAuth tokens are immediately and permanently deleted within 30 days.

Pinterest Developer and API Terms of Service — https://developers.pinterest.com/terms/

Pinterest Developer Guidelines — https://policy.pinterest.com/developer-guidelines

Pinterest Privacy Policy — https://policy.pinterest.com/privacy-policy

Pinterest Community Guidelines — https://policy.pinterest.com/community-guidelines

Pinterest Terms of Service — https://policy.pinterest.com/terms-of-service

Chat Cron uses the TikTok API to enable video scheduling and publishing features. This section is maintained in full compliance with the TikTok Developer Terms of Service, TikTok Developer Guidelines, and TikTok Data Sharing Agreement.

For the purposes of GDPR and applicable data protection laws:

Chat Cron acts as an independent Data Controller with respect to the personal data of its own users (i.e., the business users who have Chat Cron accounts). We determine the purposes and means of processing our users' data.

TikTok acts as an independent Data Controller with respect to TikTok end-user data on its own platform.

When Chat Cron receives TikTok Developer Services Data (such as TikTok User IDs and OAuth tokens) via the TikTok API, Chat Cron acts as a Controller and processes this data only for the limited purpose of enabling scheduling and publishing features for our users, in accordance with TikTok's Developer Data Sharing Agreement and applicable Controller-to-Controller Standard Contractual Clauses (SCCs).

Chat Cron is not a joint controller with TikTok with respect to TikTok end-user data. Our relationship with TikTok is governed by the TikTok Developer Terms of Service and the TikTok Developer Data Sharing Agreement.

Our application uses the TikTok Content Posting API strictly for:

Scheduling and publishing videos to the user's TikTok account on their explicit, individual request.

Displaying the user's TikTok account information within the Chat Cron interface.

Checking post publication status after a video has been submitted for publishing.

We do NOT use the TikTok API for:

Accessing, reading, or storing content from other TikTok users' accounts.

Automated or bot-based publishing of any kind.

Scraping or automated data extraction from TikTok.

Combining TikTok data with third-party data sources.

Any advertising targeting or audience profiling.

Competing with or replicating TikTok's own services.

TikTok OAuth Access Token — Retained until account disconnection. Stored using AES-256 encryption.

TikTok User ID & Display Name — Used for account identification and UI display. Retained until account disconnection.

Video Metadata (title, description, hashtags, privacy settings) — Retained only until the video is published or deleted by the user.

Post Publication Status — Used to confirm successful delivery. Not stored beyond the confirmation.

IMPORTANT: Chat Cron does not store TikTok user data beyond what is strictly necessary for scheduling and publishing.

We use TikTok's official OAuth 2.0 authorization flow exclusively. TikTok OAuth tokens are stored using AES-256 encryption. API credentials (client_secret) are never shared with any third party and are never embedded in open-source projects. Your TikTok password is never requested, collected, or stored.

Revoking access: 👉 https://www.tiktok.com/settings/

In full compliance with TikTok's Content Posting API Guidelines:

Before any content is sent to TikTok, you must expressly consent to the upload by confirming the publish action.

You must manually select the privacy/visibility setting for each post (Public, Friends, or Private). There is no default pre-selected value.

You must manually choose interaction settings (Allow Comment, Duet, Stitch) for each post. None are enabled by default.

Chat Cron displays a preview of the content before publishing.

Chat Cron will never add promotional watermarks or branding to your TikTok content.

All publishing actions are genuine, user-initiated, and individually confirmed. Automated posting is strictly prohibited.

Prior to audit completion:

Up to 5 users may post within a 24-hour window per API client.

All user accounts must be set to private at the time of posting.

Content is published in SELF_ONLY viewership mode.

After audit completion:

Publishing restrictions are lifted in accordance with TikTok's approved usage limits.

A 24-hour active creator cap applies per API client.

Chat Cron will keep users informed of the current audit status.

If you are publishing commercial or branded content through Chat Cron to TikTok, you are responsible for enabling TikTok's commercial content disclosure toggle. Chat Cron will display the required TikTok consent declarations prior to publishing:

For branded content: "By posting, you agree to TikTok's Branded Content Policy and Music Usage Confirmation."

For your own brand promotions: "By posting, you agree to TikTok's Music Usage Confirmation."

Note: If branded content disclosure is enabled, the "Only Me" (private) visibility option will be automatically disabled, as required by TikTok's policy.

TikTok Developer Services Data is processed only for scheduling and publishing functionality.

We do not share, sell, or disclose any TikTok user data to third parties, except as required by law.

We do not combine TikTok data across users or with third-party data sources.

We do not use TikTok data to build user profiles or for advertising.

We do not use TikTok data to train machine learning models or algorithms.

We do not superimpose any brand name, logo, or watermark on any user content.

We implement appropriate technical and organizational security measures to protect TikTok Developer Services Data.

In the event of any compromise of systems that may affect TikTok user data or API access, Chat Cron will:

Immediately disconnect from TikTok Developer Services.

Promptly report the compromise to TikTok.

Take immediate steps to remedy the issue.

Cooperate fully with TikTok and respond immediately to any security or compliance-related communication.

Via the app: Settings → Connected Accounts → TikTok → Disconnect

Via TikTok: Revoke access at https://www.tiktok.com/settings/

Upon disconnection, all TikTok OAuth tokens and associated data are immediately and permanently deleted within 30 days.

TikTok Developer Terms of Service — https://www.tiktok.com/legal/page/global/tik-tok-developer-terms-of-service/en

TikTok Developer Guidelines — https://developers.tiktok.com/doc/our-guidelines-developer-guidelines

TikTok Content Posting API Guidelines — https://developers.tiktok.com/doc/content-sharing-guidelines

TikTok Data Sharing Agreement — https://www.tiktok.com/legal/page/global/tiktok-data-sharing-agreement/en

TikTok Privacy Policy — https://www.tiktok.com/legal/page/global/privacy-policy/en

TikTok Branded Content Policy — https://www.tiktok.com/legal/page/global/bc-policy/en

We take data protection seriously and use industry-standard security practices:

AES-256 encrypted storage for all OAuth access tokens

HTTPS/TLS for all communication

Encrypted backups

Role-based access control

Strict data-minimization practices

Regular security audits and vulnerability assessments

Access logging and monitoring for all systems handling user data

Although no method of storage or transmission is 100% secure, we take all commercially reasonable steps to safeguard your data against unauthorized access, alteration, or disclosure.

We retain your data only for as long as your account is active.

You may request:

Full data deletion

Disconnection of social media accounts

Removal of OAuth tokens

Closure of your account

Upon deletion:

All stored personal data is removed

All connected account data is purged

All OAuth tokens are revoked

All scheduled or draft posts are deleted

You can request deletion via email: [email protected]

For Meta (Facebook & Instagram) users, a data deletion request can also be submitted directly at:

We do not sell or share your data with third parties except:

When required to deliver core functionality (e.g., Meta APIs, YouTube API, Pinterest API, TikTok API, WhatsApp Business API)

When required by law or legal obligation

With trusted service providers listed in Section 3 who must follow strict confidentiality agreements

We do not share, sell, or monetize user data.

Chat Cron is intended exclusively for users aged 18 and above. We do not knowingly collect any data from users under the age of 18. If we become aware that a user under 18 has created an account, that account will be immediately suspended and all associated data permanently deleted.

If you are located in the European Union or European Economic Area (EEA), your data may be transferred to servers outside the EU/EEA, including the United States. We rely on the following GDPR-compliant legal mechanisms for such transfers:

Standard Contractual Clauses (SCCs) as approved by the European Commission, for transfers to third countries that do not have an adequacy decision.

Adequacy decisions issued by the European Commission where applicable.

Your explicit consent, where required and applicable.

We follow GDPR-compliant practices including:

Data minimization — We collect only what is strictly necessary.

User consent — Processing is based on a valid legal basis (see Section 1.3).

Right to access — You may request a copy of your personal data.

Right to rectification — You may request correction of inaccurate data.

Right to erasure ("Right to be Forgotten") — You may request deletion at any time.

Right to restriction of processing — You may request limits on how we process your data.

Right to data portability — You may request a machine-readable copy of your data.

Right to object — You may object to processing based on legitimate interests.

Secure transfer protocols — All transfers are encrypted using HTTPS/TLS.

You may contact us for GDPR-related requests at: [email protected]

If you are located in the EU/EEA and believe your data protection rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority (DPA).

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know — You have the right to request disclosure of the categories and specific pieces of personal information we collect, the categories of sources from which we collect it, the purposes for which we use it, and the categories of third parties with whom we share it.

Right to Delete — You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.

Right to Correct — You have the right to request correction of inaccurate personal information.

Right to Opt Out of Sale or Sharing — Chat Cron does NOT sell or share your personal information for cross-context behavioral advertising. There is no "Do Not Sell or Share" opt-out mechanism required because we do not engage in such practices.

Right to Limit Use of Sensitive Personal Information — Chat Cron does NOT collect or process sensitive personal information as defined under CPRA (e.g., Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, health data, sexual orientation, or financial account details). No opt-out mechanism for sensitive data is required.

Right to Non-Discrimination — We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, contact us at: [email protected]

We will respond to verifiable consumer requests within 45 days as required by law.

Chat Cron uses cookies and similar tracking technologies to maintain your session, remember preferences, and analyze platform performance. You may control cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality.

We do not use cookies for third-party advertising, cross-site tracking, or behavioral profiling.

We may update this Privacy Policy periodically. If changes are significant, we will notify you via email or in-app notifications at least 14 days before the changes take effect. By continuing to use the service after changes are posted, you agree to the updated terms. Previous versions of this Privacy Policy are available upon request.

If you have any questions, requests, or concerns regarding this Privacy Policy, please contact us:

📧 Email: [email protected]

🌐 Website: https://chatcron.com

🏢 Legal Entity: Chat Cron (İbrahim Bozabalı)

By using Chat Cron, connecting your social media accounts, or interacting with our platform, you consent to the data practices outlined in this Privacy Policy.