Privacy Policy

1. Introduction

PulsePeak Management ("we", "our", "us") is a social media content management platform that helps content creators schedule and publish content across Instagram, TikTok, YouTube, and other platforms. This Privacy Policy explains what information we collect from you, how we use it, who we share it with, and what choices and rights you have.

2. Information We Collect

2.1 Account Information

When you sign in to our dashboard, we collect your name, email address, and authentication identifiers via our authentication provider (Clerk).

2.2 Platform Authorization Data

When you connect a social media account to PulsePeak, we receive and store the following from the respective platform's API:

• TikTok: Open ID, display name, avatar URL, follower count, and OAuth refresh token (used to publish content on your behalf via the Content Posting API)
• Instagram / Meta: Business Account ID, Page ID, and access token (used to publish content via the Instagram Graph API)
• YouTube: Channel ID and OAuth refresh token (used to upload Shorts via the YouTube Data API)
• Google Drive: File and folder metadata for videos and images you authorize us to access

2.3 Content

Video and image files that you upload, schedule, or authorize us to access via Google Drive for the purpose of publishing to your connected social media accounts.

2.4 Usage Data

Logs of publishing activity, scheduling actions, content performance metrics (views, engagement) retrieved from connected platforms, and standard server logs (IP address, timestamps).

3. How We Use Your Information

We use the data we collect solely to:

• Authenticate you and provide access to the dashboard
• Publish content to your authorized TikTok, Instagram, and YouTube accounts at the times you have scheduled
• Retrieve and display your TikTok profile information (display name, avatar, follower count) so you can verify the connected account
• Display content performance metrics (views, likes, follower growth) in the dashboard
• Send transactional notifications about publishing status
• Diagnose errors and improve the reliability of our service

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We share data only in the following circumstances:

• With platforms you authorize: When you connect TikTok, Instagram, YouTube, or Google Drive, we send content and metadata to those platforms via their official APIs solely for the purpose of publishing or retrieving information you have requested.
• With service providers: We use Convex (database and serverless functions), Vercel (web hosting), and Clerk (authentication). These providers process data on our behalf under standard data processing agreements.
• For legal compliance: If required by law, court order, or to protect the rights, safety, or property of PulsePeak, our users, or the public.

5. Data from TikTok

When you authorize PulsePeak to access your TikTok account via TikTok Login Kit and the Content Posting API, we receive the following scopes:

• user.info.basic – your TikTok Open ID, display name, and avatar URL, used to identify the connected account in the dashboard
• video.upload – allows us to upload video drafts to your TikTok account
• video.publish – allows us to publish videos directly to your TikTok profile at scheduled times

We use this access exclusively for the publishing functionality you have configured in the dashboard. We do not access your TikTok messages, private content, or any data outside the granted scopes. You can revoke this access at any time from your TikTok account settings or by disconnecting the integration in the PulsePeak dashboard.

6. Data Storage and Security

Your data is stored on infrastructure operated by Convex (database) and Vercel (web hosting), both located in the United States with industry-standard security controls. Access tokens and refresh tokens are stored as encrypted environment variables and database fields. Content files remain in your own Google Drive — we do not store copies of your videos or images on our servers.

7. Data Retention

We retain your account information and authorization tokens for as long as your account is active. When you delete your account or disconnect a platform integration, we delete the corresponding tokens and account data within 30 days. Publishing activity logs are retained for up to 12 months for diagnostic purposes.

8. Your Rights

Under GDPR and applicable privacy laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for any platform integration at any time
• Export your data in a portable format
• Lodge a complaint with a data protection authority

To exercise these rights, contact us at the email address below.

9. Children's Privacy

PulsePeak Management is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top of this page reflects the most recent revision. Material changes will be communicated to you via email or an in-dashboard notice.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: max@pulsepeak-mgmt.com
• Company: PulsePeak Management