Umbrella Posts ("the Service", "we", "us") is a social media scheduling platform operated by Umbrella Media. The Service is offered to marketing agencies, content creators, and brand operators who plan and publish short-form video content across multiple TikTok and Instagram accounts. This policy explains what information we collect, how we use it, and the choices available to Customers and the end users whose social media accounts they manage through the Service.
Account holders (Customers). When you create a Customer account we collect your username, hashed password, email address (optional), and the role and permission settings assigned to your team members.
Connected TikTok accounts. When a Customer connects
a TikTok account through the TikTok Login Kit, the Service receives
that account's open_id, basic profile information
(display name, avatar URL), and OAuth access and refresh tokens
scoped to video.upload, video.publish,
and user.info.basic. These tokens are stored encrypted
at rest and are used solely to publish content the Customer has
scheduled for that same account.
Connected Instagram accounts. When a Customer connects an Instagram Business or Creator account through the Instagram Graph API, the Service receives the IG Business Account ID and OAuth tokens scoped to content publishing. These are stored and used solely to publish content the Customer has scheduled for that account.
Customer Content. Video files, captions, schedule metadata, and any other content uploaded to the Service by a Customer.
Operational logs. Standard request logs (IP address, timestamp, route, HTTP status) used for security monitoring and debugging.
user.info.basic, which TikTok account was authorized for a given connection.We do not sell, rent, or share personal information with third parties for advertising or profiling. We do not use Customer Content or social account data to train machine learning models.
We share information only as follows:
OAuth tokens are kept while the connection is active and rotated automatically before expiry. Customer accounts and the workspaces they own are retained for as long as the Customer continues to use the Service, and are deleted on request. Publication history is retained as part of the Customer's account record so the Customer can review what was posted.
The Service is hosted on infrastructure that enforces TLS encryption in transit. OAuth tokens and Customer passwords are stored encrypted or hashed at rest. Access to a Customer workspace requires authenticated login and is subject to role-based access controls defined by the Customer.
Customers may request access to, correction of, or deletion of the personal information held in their account by contacting us at the address below. The owner of any connected TikTok or Instagram account may revoke the connection at any time from within the TikTok or Instagram app (Settings → Apps).
The Service may process information in countries other than the Customer's country of residence. By using the Service the Customer consents to such transfers.
The Service is not directed at and is not intended for use by anyone under 18.
We may update this policy from time to time. We will post the updated policy at this URL with a new "Last updated" date. Continued use of the Service after the change constitutes acceptance of the updated policy.
For questions about this policy, contact us at viralize.ias@gmail.com.