Privacy Policy | PublishBuddy

Methodize Media Pty. Ltd. (ABN 66 603 423 758) ("Company," "we," "our," or "us"), the operator of PublishBuddy, has created this Privacy Policy to explain how we collect, use, disclose, protect, and otherwise handle Personal Information when you engage with our website, https://publishbuddy.com (the "Site"), as well as related subdomains, applications, browser extensions, APIs, and other services (collectively, the "Service"). It also explains your rights and the choices available to you regarding your Personal Information, and how to contact us with any privacy-related questions.

We handle Personal Information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"), and, where applicable, the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). Region-specific rights are set out in Section 11.

In some cases we process Personal Information on behalf of our business customers while they use the Service (for example, information about their audiences). In those cases we generally act as a processor (or service provider), and the relevant business customer is the controller responsible for that processing. Please review that customer's privacy policy to understand how they handle your data.

By registering, accessing, or using the Service, you acknowledge this Privacy Policy and our Terms of Use, found at https://publishbuddy.com/terms. Capitalised terms not defined here have the meaning given in our Terms of Use.

1. Personal Information We Collect

"Personal Information" means any information that identifies or can reasonably be linked to an individual. We collect Personal Information from the sources described below. Where information is required to provide a feature, not providing it may limit your access to that feature.

We do not seek to collect sensitive information or special-category data (such as information about your health, race, religion, political opinions, sexual orientation, or biometric data) and ask that you do not provide it through the Service. We will only collect such information where you choose to provide it and we have a lawful basis to do so, or as required or permitted by law.

2. Personal Information You Provide

Account Registration

To create and run your account, we collect:

Email address
Password (stored only as a hash)
Name, if you add it or sign in with Google or Apple
Your Google or Apple account ID, if you sign in with them
Time zone and time format settings
Profile photo, if you add one
Your notification settings

Customer Support Interactions

When you contact our support team, we may collect information relevant to your inquiry, including:

Emails, chat transcripts, and support tickets submitted through our platform
The content of your messages, which may include account details, error reports, or troubleshooting steps
Any follow-up communications between you and our support representatives
Technical logs and diagnostic data associated with reported issues

This information is used to troubleshoot, resolve support requests, and improve our customer service.

Purchases and Transactions

When you make a purchase or subscribe to the Service, we collect the details needed to process your payment securely, including:

Payment method information such as card type, last four digits, and expiry date (full card numbers and security codes are handled directly by our PCI-DSS-compliant third-party payment processors and are not stored by us)
Billing details, including name, address, and zip/postal code
Purchase history, subscription details, and transaction records
Invoicing and receipt-related communications

We do not store complete payment card details. Payments are processed by compliant third-party providers, and your billing information is used only for processing payments, refunds, and fraud prevention.

Social Media Account Information

To enable integration with social media platforms, facilitate content posting, and provide engagement metrics, we may collect and store information related to your linked social media accounts, including:

Social media handles
Account IDs
Profile usernames
Email address
Time zone
API access and refresh tokens (used to authenticate and authorise interactions with connected accounts, stored encrypted in our database)
Content publishing permissions granted to the Service
Engagement data such as likes, shares, and comments
Follower counts and audience demographics
Insights and analytics provided by social media platforms

We use this data to schedule, publish, and analyse content across your connected accounts, and only as needed to provide the Service. We do not sell this information.

Content You Create

We collect and store the content you upload, draft, schedule, or publish through the Service (including text, images, video, captions, and prompts you submit to AI features), so that we can provide, secure, and improve the Service.

Business Engagements

If you engage with us as a customer, vendor, or business partner, we may collect additional professional contact details, including:

Company name
Job title/position
Business email address
Office phone number
Business address
Industry and company size
Communication history
Contractual agreements and transaction records

This information helps us manage business relationships, provide service agreements, process invoices, and coordinate projects.

3. Information Obtained from Connected Social Media Accounts

Facebook

If you link a Facebook page or profile, we may obtain:

Profile image
Display name
Username/Page ID
Authentication tokens
Published posts
Engagement statistics (clicks, likes, shares, impressions, and interactions)

X (formerly Twitter)

By linking an X account, we may access:

Profile image
Display name
Username/Profile ID
Authentication tokens
Tweets sent through the Service
Engagement data (likes, retweets, shares, impressions)

Instagram

If you integrate your Instagram profile, we may retrieve:

Profile image
Display name
Username/Profile ID
Authentication tokens
Posts published via our platform
Engagement insights (likes, shares, impressions, and interactions)

Bluesky

If you connect a Bluesky account, we may access:

Profile image
Display name
Username/Profile ID
Authentication tokens
Posts published via our platform
Engagement insights (likes, shares, impressions, and interactions)

For linked Pinterest accounts, we may collect:

Profile image
Display name
Username/Profile ID
Authentication tokens
Pins published
Engagement analytics (likes, re-pins, shares, impressions)

When a LinkedIn account is connected, we may access:

Profile image
Display name
Username/Profile ID
Authentication tokens
Posts and engagement details (clicks, likes, shares, impressions)

TikTok

If you connect a TikTok profile, we may collect:

Profile image
Display name
Username/Profile ID
Authentication tokens
Posted content
Engagement metrics (likes, shares, impressions, and interactions)

Google Business Profiles

For linked Google Business Profiles, we may obtain:

Profile image
Display name
Username/Profile ID
Authentication tokens
Published posts
Engagement data (clicks, likes, shares, impressions)

YouTube

When you link a YouTube channel, we may retrieve the information below. Our use of information from YouTube APIs is also subject to the YouTube Terms of Service and the Google Privacy Policy.

Profile image
Display name
Profile ID
Authentication tokens
Existing videos and engagement metrics

Threads

If a Threads account is connected, we may collect:

Profile image
Display name
Username/Profile ID
Authentication tokens
Posted content and engagement details (likes, shares, impressions, interactions)

If you connect a Telegram channel, we may collect:

Display name and channel/chat ID
Your Telegram user ID, to check that you're an admin of the channel
Posted content and related delivery information

We collect this information solely to deliver the Service and do not share it with external parties beyond what is necessary for Service functionality, as described in Section 7.

You can remove a connected account from the Service at any time. When you do, we delete its posts from the Service and stop using its access tokens. Removing it does not revoke those tokens with the platform. To revoke our access, also remove PublishBuddy in the platform's settings for connected apps. For Bluesky, delete the app password you created for us. For Telegram, remove our bot from your channel's admins. We do not delete the tokens when you remove the account; ask us at [email protected] to delete them. We keep the analytics we collected for the account as described in Section 9.

4. Information Automatically Collected from Your Use of the Service

Log Data

When you use the Service, our systems automatically collect certain details that your browser or device transmits, which may include:

IP Address: The Internet Protocol (IP) address assigned to your device at the time of access.
Browser Type and Configuration: Information about your web browser, such as its type, version, and settings.
Pages Visited and Usage Activity: A record of the pages you access, the duration of your visits, and your navigation sequence.
Timestamps and Access Information: The date and time you interact with the Service, including session duration and activity logs.
Referral Data: The URL of the webpage that referred you to the Service, if applicable.
System Performance Metrics: Error reports and diagnostic details to help troubleshoot technical issues.

Mobile Applications

When you use our mobile applications, we may collect device-related information such as device type and model, operating system and version, unique or advertising device identifiers, app version, crash and diagnostic data, and, if you enable them, push notification tokens used to deliver notifications. With your permission, the app may access certain device features (such as the camera, photo library, or storage) so you can upload and manage content. You can manage these permissions and disable push notifications through your device settings.

Cookie Policy

Cookies are small text files placed on your device when you visit a website. This section explains the cookies and similar technologies we use on our website (publishbuddy.com) and in the PublishBuddy app (app.publishbuddy.com).

Strictly necessary. These keep the Service working and secure, so they do not need your consent. They sign you in to the app and keep you signed in, and remember your cookie choice. Our free tools may also use Cloudflare Turnstile, only when you run a tool, to check that the request comes from a person. If you block these, parts of the Service will not work, and you will not be able to sign in.

Analytics. We use Google Analytics to understand how people find and use our website and app, for example which pages they visit, where they came from and whether they sign up. It sets cookies named _ga and _ga_C6WJBPHC4Y, which last up to 2 years. In the EEA, the UK and Switzerland, and anywhere else the law requires consent, we only set them after you accept analytics cookies in our banner. Elsewhere we set them when you visit, and you can turn them off at any time. If your browser sends a Global Privacy Control signal, we treat it as a refusal. We keep your choice in a cookie for publishbuddy.com and its subdomains, so it also applies in the app. We do not use Google Analytics for advertising.

Microsoft Clarity. On our website and in the app we also use Microsoft Clarity, which records how visitors scroll, click and move around a page, so we can see where pages confuse people. Clarity masks text you type into forms, and in the app it masks all text on the page, including your posts and messages. It sets cookies named _clck (up to 1 year) and _clsk (1 day), and Microsoft may set its own MUID cookie. Clarity follows the same choice as Google Analytics: it only runs where that choice allows it, and rejecting analytics cookies turns it off and deletes its cookies. Microsoft processes this data under the Microsoft Privacy Statement. We do not use Clarity for advertising.

Advertising. On our website (not in the app) we use the Meta pixel, a small script from Meta Platforms that tells Meta which of our pages you visit. We use it to measure our ads on Facebook and Instagram and to show our ads to people who have visited our website. It sets a cookie named _fbp (90 days), and a _fbc cookie (90 days) when you arrive from one of our ads. Meta may also read cookies it set on its own sites, such as fr, and may link this data to your Facebook or Instagram account. In the EEA, the UK and Switzerland, and anywhere else the law requires consent, the pixel only runs after you choose Accept all in our banner. Elsewhere it runs when you visit, and you can turn it off at any time. If your browser sends a Global Privacy Control signal, we treat it as a refusal. For the data the pixel collects and sends, Meta and we are joint controllers; Meta processes it under the Meta Privacy Policy. This choice is separate from analytics: you can accept analytics and still turn the pixel down.

Other companies' scripts. When you sign in with Google or Apple, or connect a social account, that company's sign-in page or script runs and may set its own cookies under its own privacy policy. The app also loads Facebook's script, which it uses to connect Facebook Pages, and Facebook may set or read its own cookies under its own privacy policy.

Emails. Our emails may include a small image that tells us whether an email was opened or a link was clicked. You can block it by turning off images in your email app.

Your choices. Use or "Do Not Sell or Share My Personal Information" at the bottom of any page of our website, or in the account menu or under the sign-in form in the app, to change your choice at any time. When you reject analytics cookies, we delete the Google Analytics and Clarity cookies. When you reject advertising cookies, we turn the Meta pixel off and delete the _fbp and _fbc cookies. You can also block or delete cookies in your browser settings, or use the Google Analytics Opt-out Browser Add-on.

Some browsers offer a "Do Not Track" or Global Privacy Control signal. Where required by applicable law (such as for California residents), we treat recognised opt-out preference signals as a valid request to opt out of the "sale" or "sharing" of Personal Information.

Links to Other Websites

The Service may include links to external websites operated by third parties. These links are provided for convenience and do not imply endorsement. We do not control these third-party sites and are not responsible for their privacy practices, content, or security. We encourage you to review the privacy policies of any third-party websites you visit. Any interaction with those sites is solely between you and the third party.

5. How We Use Your Personal Information

We use the Personal Information we collect for operational, administrative, and legal purposes, including:

Service Provision and Account Management: To create and manage accounts, authenticate identity, and enable access to functionality, including scheduling and publishing to your connected accounts.
Communication and Customer Support: To send service-related communications such as account verification, system updates, technical notices, security alerts, and support responses.
Payments and Transactions: To process payments, issue receipts, manage billing, and prevent fraud.
Personalisation and Improvements: To analyse usage and tailor and improve the Service.
AI Features: To generate and deliver AI-assisted output you request (see Section 6).
Marketing and Promotional Messaging: To send promotional messages about features, updates, and offers, where permitted. You can opt out at any time.
Security, Fraud Prevention, and Compliance: To detect and prevent fraud, unauthorised access, and security incidents, and to comply with legal obligations.
Business Intelligence and Research: To analyse aggregated data to understand engagement, optimise the Service, and develop new features.

6. AI and Automated Processing

Some features use artificial intelligence to generate content, suggestions and analytics. To deliver them, we send the relevant inputs, such as your prompts, drafts, chat messages and connected-account data, to third-party AI providers that run those features for us. We also use AI to analyse the images and videos in posts we import from your connected accounts, to power features such as post insights and visual search. We do not use your content to train AI models, and we do not offer an option to do so. Each provider processes the inputs we send under its terms for business API customers. Our current AI providers are Anthropic, OpenRouter (which passes each request to the company that hosts the chosen model, such as OpenAI), Google (Gemini) and fal.ai. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

7. How We Share Your Personal Information

We do not sell your Personal Information for money. We may share it with the following categories of recipients:

Service Providers and Processors: Vendors who help us operate the Service, including cloud hosting and storage, payment processing, email and communications, analytics, AI providers, customer support, and security. These parties are bound by contract to protect your information and use it only on our instructions.
Third-Party Platforms: When you direct us to publish content or retrieve analytics, we exchange the necessary information with the relevant social media platform via its APIs.
Other Users in Your Workspace: If you use team or collaboration features, your information and content may be visible to other authorised members of your workspace or Organisation.
Legal Compliance and Protection: Where required by law or to respond to lawful requests (such as subpoenas or court orders), or to protect our rights, users, or the public, and to prevent fraud or harm.
Business Transfers: In connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to the recipient honouring this Privacy Policy.
Affiliates: With our corporate affiliates to help provide and improve the Service, consistent with this Privacy Policy.
Advertising Partners: Meta Platforms receives information about your visits to our website through the Meta pixel, where your cookie choice allows it, as described in our Cookie Policy. U.S. privacy laws may treat this as "sharing" for cross-context behavioural advertising or as targeted advertising, and you can opt out as described in Section 11.
Aggregated or De-Identified Data: Information that cannot reasonably be used to identify you may be shared for analytics or business purposes.

8. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area or the United Kingdom, we process your Personal Information on one or more of the following legal bases:

Contract: To provide the Service and perform our agreement with you (for example, account management, publishing, and billing).
Legitimate Interests: To secure, operate, analyse, and improve the Service, prevent fraud, and conduct direct marketing, where not overridden by your rights.
Consent: For non-essential cookies, certain marketing, and any optional processing, which you may withdraw at any time.
Legal Obligation: To comply with applicable laws, such as tax, accounting, and lawful requests.

9. Data Retention

We retain Personal Information only for as long as necessary to fulfil the purposes described in this Privacy Policy, including providing the Service, complying with legal, tax, and accounting obligations, resolving disputes, and enforcing our agreements. When information is no longer required, we delete or de-identify it, or securely store and isolate it until deletion is possible (for example, in backups). If you close your Account, we will delete or de-identify your Personal Information within a reasonable period, except where we are required or permitted by law to retain it.

Statistics we collect about your connected accounts, such as reach and engagement, are deleted once they are more than 2 years old.

10. How We Protect Your Personal Information

We use a combination of technical, administrative, and physical safeguards designed to protect Personal Information against unauthorised access, loss, misuse, alteration, or destruction.

Access tokens for your connected accounts are encrypted in our database, and our website, app and API redirect every plain HTTP request to HTTPS. We use firewalls, access controls, and monitoring to restrict access, and we conduct security reviews to identify and address vulnerabilities. Personnel with access to Personal Information are bound by confidentiality obligations and operate under role-based access controls so that data is available only to those who need it.

No method of transmission or storage is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will investigate, take steps to contain it, and notify affected individuals and relevant regulators (such as the Office of the Australian Information Commissioner) as required by applicable law, including the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

11. Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your Personal Information:

Access and request a copy of the Personal Information we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of your information, subject to legal and operational requirements.
Restrict or object to certain processing.
Withdraw consent where processing is based on consent.
Request portability of your information in a structured, commonly used format where legally required.

To exercise these rights, contact us at [email protected]. We may need to verify your identity before responding, and we will not discriminate against you for exercising your rights. We reply within one month of receiving your request. If a request is complex, or we receive many at once, we may need up to two more months; if so, we will tell you why within the first month. You can opt out of marketing at any time using the unsubscribe link in our emails or your account settings.

Australia

We handle Personal Information in accordance with the Privacy Act 1988 (Cth) and the APPs. If you have a privacy concern, contact us first. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

EEA and United Kingdom

If you are in the EEA or UK, you have the rights described above under the GDPR. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office). Where we transfer your data outside the EEA or UK, we rely on appropriate safeguards as described in Section 12.

California

If you are a California resident, the CCPA/CPRA gives you the right to know what Personal Information we collect, use, and disclose; to request access and deletion; to correct inaccurate information; to opt out of the "sale" or "sharing" of Personal Information; and to limit the use of sensitive Personal Information. We do not sell your Personal Information for money. Our website uses the Meta pixel, which sends identifiers (such as cookie IDs and IP address) and internet activity (such as the pages you visit on our website) to Meta Platforms, and this may count as "sharing" for cross-context behavioural advertising under the CPRA. In the preceding 12 months we have shared these two categories with Meta for advertising. We do not knowingly sell or share the Personal Information of anyone under 16. To opt out, use the "Do Not Sell or Share My Personal Information" link at the bottom of any page of our website and choose Reject all or Analytics only, or turn on Global Privacy Control in your browser.

In the preceding 12 months, we have collected the following categories of Personal Information (as defined by the CCPA/CPRA): identifiers (such as name, email, username, and IP address); commercial information (such as subscription and transaction records); internet or other electronic network activity (such as usage and log data); geolocation data (such as city and approximate location derived from IP address); professional or employment-related information (for business contacts); and audio, electronic, or visual information (such as content and media you upload). We collect this information from the sources, and use and disclose it for the business purposes, described in this Privacy Policy.

You may exercise these rights by contacting us at [email protected], and you may use an authorised agent. We will verify your request and will not discriminate against you for exercising your rights.

Other U.S. States

If you are a resident of a U.S. state that has enacted a comprehensive consumer privacy law (such as Virginia, Colorado, Connecticut, Texas, Oregon, Utah, and others), you may have rights similar to those described above, including the right to access, correct, delete, and obtain a portable copy of your Personal Information, and to opt out of targeted advertising, the sale of Personal Information, and certain profiling. We do not sell your Personal Information for money. Our website uses the Meta pixel for targeted advertising, as described in our Cookie Policy; to opt out, use the "Do Not Sell or Share My Personal Information" link at the bottom of any page of our website, or turn on Global Privacy Control in your browser. To exercise any applicable rights, contact us at [email protected]. Where a law provides a right to appeal a decision about your request, you may do so by replying to our response, and we will inform you of the outcome.

12. International Data Transfers

We operate globally, and your Personal Information may be transferred to, stored, or processed in countries outside your jurisdiction, including Australia and the United States, where our service providers operate. When we transfer Personal Information internationally, we put appropriate safeguards in place to comply with applicable data protection laws. For transfers from the EEA or UK, these safeguards may include the European Commission's Standard Contractual Clauses (and the UK Addendum) or transfers to countries recognised as providing adequate protection.

13. Children's Privacy

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect Personal Information from anyone under 18. If we become aware that we have collected Personal Information from a minor without appropriate authorisation, we will take prompt steps to delete it.

Parents or legal guardians who believe a child has provided us with Personal Information should contact us at [email protected] so we can investigate and take appropriate action. We also comply with applicable laws protecting minors, including the Children's Online Privacy Protection Act (COPPA) in the United States and the GDPR's protections for children in the EU/UK.

14. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or technology. We will communicate significant updates by email, through the Service, or by a prominent notice on our website, and the "Last updated" date above will reflect the most recent revision.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after an update takes effect signifies your acceptance of the revised policy. If you do not agree with any changes, you should discontinue use of the Service and may contact us regarding the deletion of your data, where applicable.

15. Contact Information

If you have any questions, requests, or complaints about this Privacy Policy or our handling of your Personal Information, please contact us at:

Methodize Media Pty. Ltd. (ABN 66 603 423 758)
Attn: Privacy Officer
Sydney, Australia
Email: [email protected]