Privacy Policy

Hexagon Intergalactic Ltd (Hexagon Intergalactic Oy) is the controller of the data described here.

• Business ID 3270318-1, VAT ID FI32703181
• Lakkalantie 178, 54590 Kaitjärvi, Finland
• Email: heikki@hexagon.fi

Hexagon Postiz is our own installation of Postiz, open-source social media scheduling software, running on a server we operate. We use it to publish our own videos, images and texts to our own YouTube, Instagram, Facebook and TikTok accounts, and to see how those posts perform.

Hexagon Postiz is not a public service. Only we can sign in to it. No one else can create an account in it or connect their own social media account, so the only platform accounts it holds data for are our own.

• Access tokens. When we connect one of our accounts, the platform gives Hexagon Postiz an access token and, where the platform uses one, a refresh token. They let the tool act for that account only, within the permissions listed below.
• Account details: the account's ID, name, username and profile picture, so that we can tell the connected accounts apart. For YouTube, Google also returns the name and email address of the Google account used to connect.
• Our posts: the videos, images, titles, captions and comments we publish, and their scheduled times.
• Statistics of our own accounts and posts: counts such as views, watch time, likes, comments, shares, saves and followers.

Hexagon Postiz does not collect the content of other people's comments or messages, or the profiles of the people who view, like or follow our accounts. It receives counts only.

We use this data only to publish our own content to our own accounts, to check that publishing worked, and to report on how our posts perform. The statistics are read by us and by the AI assistants that prepare our internal reports. They concern only our own accounts and posts.

We do not sell this data or use it for advertising. We do not use it to develop, improve or train AI or machine-learning models. We do not disclose it to anyone except the service providers named on this page that process it for us, or where the law requires it.

• Hexagon Postiz and its database run on a computer we operate ourselves. Each token is used only in requests to the platform that issued it.
• Connections to Hexagon Postiz pass through Cloudflare, which carries the encrypted traffic to our server.
• To publish a post, the platform fetches the media file from our server at an address that cannot be guessed. These files are our own content.
• We keep tokens and account details while the account is connected, and posts and statistics while we use the tool. Daily database backups are kept for 14 days, and weekly backups of the media files for four weeks.

Hexagon Postiz uses TikTok Login Kit and the TikTok Content Posting API for our own TikTok account. It requests these scopes:

• user.info.basic and user.info.profile: the account's ID, display name, username and avatar, to show which account is connected.
• user.info.stats: the account's follower, following, like and video counts.
• video.upload and video.publish: to upload our videos and publish them on our account.
• video.list: to list our own videos and read their view, like, comment and share counts.

TikTok's own handling of data is described in the TikTok Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en. Access can be removed at any time in the TikTok app's settings for connected apps.

Hexagon Postiz uses YouTube API Services to upload videos to our own YouTube channel and to read that channel's statistics. It requests these Google OAuth scopes:

• userinfo.profile and userinfo.email: the name and email address of the Google account, to identify the connected account.
• youtube, youtube.force-ssl, youtube.upload and youtubepartner: to upload videos to our channel and manage their details and comments.
• youtube.readonly and yt-analytics.readonly: to read our channel's videos and statistics, such as views, watch time, likes, and subscribers gained and lost.

Anyone whose YouTube account is connected to Hexagon Postiz agrees to the YouTube Terms of Service: https://www.youtube.com/t/terms. Google's own handling of data is described in the Google Privacy Policy: https://policies.google.com/privacy.

Hexagon Postiz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Access can be revoked at any time on the Google security settings page: https://security.google.com/settings/security/permissions.

Hexagon Postiz uses Meta's Instagram API and Facebook Login for Business for our own Instagram accounts and our own Facebook Page. We use these permissions to list our Page and Instagram accounts, publish posts, add comments to our own posts, and read the statistics of our own posts and accounts:

• Instagram login: instagram_business_basic, instagram_business_content_publish, instagram_business_manage_comments and instagram_business_manage_insights.
• Facebook login: pages_show_list, pages_manage_posts, pages_manage_engagement, pages_read_engagement, read_insights, business_management, instagram_basic, instagram_content_publish, instagram_manage_comments and instagram_manage_insights.

Meta's own handling of data is described in the Meta Privacy Policy: https://www.facebook.com/privacy/policy. Access can be removed in Facebook's settings under Business integrations, or in Instagram's settings under Website permissions › Apps and websites.

To stop Hexagon Postiz's access to an account at once, revoke it in the platform's settings as described above. A revoked token no longer works.

To have data held in Hexagon Postiz, or sent to us through this website, deleted, email heikki@hexagon.fi. We delete it within one month. Backups that still contain it expire within the retention times above.

• Hosting: the site is hosted by Vercel, which processes the technical data of each request, such as your IP address and browser type, to deliver the site.
• Visitor statistics: Vercel Web Analytics counts page views without cookies.
• Videos: the videos on the site are streamed by Mux. Mux collects playback data, such as loading times and playback errors, to measure streaming quality, and can store an identifier for this in a cookie in your browser.
• Language: a cookie can remember the language version of the site you use.
• Contact form: when you send a message, we receive your name, email address and message by email, sent through Amazon Simple Email Service. We use them only to answer you and keep the message as long as the matter needs.
• Instagram images: the home page shows recent images from our own Instagram account, which our server fetches from Instagram.
• Shop: our shop at shop.hexagon.fi runs on Shopify and has its own privacy policy.

We handle this data on the basis of our legitimate interest in running our own social media accounts and website and in answering messages sent to us (GDPR Article 6(1)(f)).

You have the right to access your data, to have it corrected or deleted, to object to or restrict its use, and to receive it in a portable format. Email heikki@hexagon.fi. You can also lodge a complaint with the Finnish Data Protection Ombudsman: https://tietosuoja.fi/en.

When Hexagon Postiz or the website changes how data is handled, we update this page and the date at the top.