Privacy Policy

Æthelstan (“Æthelstan”, “we”, “us”) is an operated agent that creates, schedules, publishes and measures social media content on the accounts you connect to it. This policy explains what data we handle to do that, why, how we protect it, and the choices you have. Æthelstan is operated by Ezra Reichel; you can reach us any time at ezra@gtmos.run.

Who this covers

This policy is for our customers — the businesses and creators whose accounts Æthelstan operates — and for the people whose information reaches us through those connected accounts. For the platform data we process on your behalf, you are the data controller and Æthelstan acts as your processor; for your own account and billing details, we are the controller.

What we collect

• Account & onboarding information — the brand details, voice, audience, goals and contact information you give us so the agent can work as yours.
• Connected-account access — the authorization (OAuth) tokens you grant when you connect Instagram, Facebook, TikTok or LinkedIn. These let Æthelstan publish and read performance on your behalf, within the scope you approve. We never see or store your platform passwords.
• Content & performance data — the posts we publish for you, and the metrics we read back from each platform (views, likes, comments, saves, shares, follower counts and similar), used to measure and improve what we make.
• Link-hub analytics — when we host a link hub for you, we count clicks on it (with basic bot-filtering) to report where your audience went. This is first-party measurement; we do not track people across other websites.

How we use it

We use this information solely to provide the service to you: to research, generate, schedule, publish and measure content on your connected accounts, to report honestly on performance, and to support and improve the product for your account. We do not sell your data, and we do not use platform data for advertising or for any purpose other than operating your service.

Platform data

Our access to and use of information from the platforms you connect is governed by each platform’s terms, and we handle that information only as described here:

• Information received from Meta (Instagram and Facebook) is used and stored in compliance with the Meta Platform Terms and Developer Policies.
• Information received from LinkedIn is used in compliance with the LinkedIn API Terms of Use.
• Information received from TikTok is used in compliance with the TikTok Developer Terms of Service.
• Where we read public YouTube metrics for measurement, that use complies with the YouTube Terms of Service and the Google Privacy Policy.

Who we share it with

We share data only with the service providers we need to run Æthelstan, each bound to use it only to provide their service to us:

• The platforms you connect — Meta, LinkedIn, TikTok, and Google/YouTube — to publish and measure your content.
• Google Cloud — hosting and key management (encryption), in a London (EU/UK) region.
• Supabase — our managed database, hosted in a London (EU/UK) region.
• Anthropic — the Claude models we use to generate and analyse content.
• AI generation providers used by the Studio engine (for generated video, imagery, voice or music), only when you have that engine enabled.

We may also disclose information if required by law, or as part of a business transfer, in which case we will tell you.

How we protect it

Data is encrypted in transit and at rest. Connected-account tokens are additionally envelope-encrypted with Google Cloud KMS, so a copy of the database alone cannot be used to post as you. Access to production systems is limited to what is needed to operate the service.

How long we keep it

We keep your information for as long as your account is active. When you disconnect a platform, we delete its stored access tokens. When your account ends, we delete the personal data we hold for it within 30 days, except where we must retain something to meet a legal obligation. You can request deletion sooner at any time — see Data Deletion.

Your rights

Depending on where you are, you may have the right to access, correct, delete, export, restrict or object to our use of your personal data, and to withdraw consent. To exercise any of these, email ezra@gtmos.run and we will respond within the time the law requires. If you are in the UK or EU, you also have the right to complain to your data protection authority.

Children

Æthelstan is a business product and is not directed to children. We do not knowingly collect personal data from children.

Changes

If we change this policy we will post the new version here with an updated date, and, for material changes, let customers know directly.

Contact

Questions about this policy or your data: ezra@gtmos.run.