Legal
Privacy Policy
Last updated
The short version: Pubrivo stores what you write and upload, and the keys needed to post it. It reads nothing back from the social networks beyond the name and picture of each account you connect and, on YouTube if you allow it, the numbers on videos Pubrivo published. It runs no analytics, sets no tracking cookies, and sends your posts to no AI model.
This policy describes how Chokedee Mechai Chokechai Mewua Soft Co., Ltd. (บริษัท โชคดีมีชัย โชคชัยมีวัวซอฟต์ จำกัด) (411/314 Pracha Uthit Road, Huai Khwang Subdistrict, Huai Khwang District, Bangkok 10310, Thailand) — “Pubrivo”, “we” — handles personal data. We are the data controller.
Pubrivo is operated from Thailand and is subject to the Personal Data Protection Act B.E. 2562 (PDPA). Where the EU General Data Protection Regulation applies to you, we apply it too. GDPR is the stricter of the two on nearly every point, so we have written this policy to the GDPR standard and applied it to everyone.
What personal data we collect
Listed in full, because the PDPA requires it:
| Category | Specifically |
|---|---|
| Account | Name, email address, and a hash of your password. We never store the password itself. |
| Workspace | Workspace name and who belongs to it. |
| Invitations | An address a Member invites, who invited it, and when. |
| Session | One signed cookie that keeps you logged in, and one that remembers which of your workspaces you last chose to work in. |
| Requests for an email link | When someone asks for a verification or password-reset link, or changes the email address on their account, the IP address the request came from, counted so that one connection cannot ask for more than five an hour. |
| Connected channels | The account identifier, display name and profile picture each network returns for a channel you connect. We keep our own small copy of the picture to show beside the channel. For YouTube, the channel’s ID, name and picture, which we read again about once a day. For X, the account’s ID and handle only, and no picture. |
| Video counts | On YouTube, if you allow it: for each video Pubrivo published to your channel, the views, likes, comments, shares, minutes watched, average view duration and percentage, and subscribers gained that YouTube reports, in total and by day. Nothing about any other video, and nothing about who your viewers are. |
| Access credentials | Access and refresh tokens for the networks you connect, the permissions granted, and their expiry. Encrypted before they are stored. For a Facebook Page, also which Business portfolio holds it. |
| API keys | For each key a Member makes so a script or tool can use Pubrivo’s API in their workspace: its name, who made it, when it was last used, and a hash of the key. A key can list the workspace’s channels and posts, schedule posts at least fifteen minutes ahead and cancel them — and publish immediately only if the Member allowed it — and each post it makes is labelled with its name. Any Member of the workspace can revoke any key. The key itself is shown once and never stored. |
| Authorized apps | For each app a Member approves — such as an AI assistant — the app's name, the address it returns to, which workspace it may act in, who approved it, when it was last used, and its access and refresh tokens (stored hashed). An approved app can list the workspace's channels and posts, schedule posts at least fifteen minutes ahead, and cancel posts that have not gone out — and publish immediately only if the Member allowed it; each post it makes is labelled with its name. Any Member of the workspace can revoke it, which deletes its approval and tokens at once. |
| Webhooks | For each web address a Member's key or approved app registers to hear when posts publish or fail: the address, which events it hears, who registered it, and a signing secret (encrypted before it is stored). For each event sent: a copy of the post as the API shows it, and whether the address accepted it. |
| Content | Post text, the per-network variants of it, scheduled times, and any media you upload or point us to by web address (we fetch it, and keep the address it came from) — including whatever personal data you choose to put in them. |
| Publishing records | Each attempt to publish, its outcome, and the identifier the network returned for a successful post. |
| Billing | A Stripe customer is created for your workspace at registration using your name and email, including on the Free plan. We keep its identifier, any subscription identifier, your plan, and for each payment its amount, its date and the country of the bank that issued the card — kept as evidence of where a customer is, for tax. A VAT or tax number, if you give one, is held by Stripe on your billing details.Card details go to Stripe directly and never reach us. |
| A log of the transactional emails we send you, correspondence about data requests, and whether our email provider has stopped delivering to your address, and why, so we can tell you. | |
| Waitlist | If you ask to be told when a plan you cannot buy yet becomes available: your email address, which plan you asked about, and anything you tell us about how you would use it. |
What we never collect
- We read back only the numbers on what we published, and only on YouTube. If you allow it, Pubrivo reads the counts YouTube reports for the videos it published to your channel (YouTube and Google). On every other network no likes, views, comments or reach is fetched, shown or stored, and on none do we read follower counts or audience data. Beyond what posting itself needs — the account’s name, and on TikTok the posting options its owner allows — whether a post went out is the only thing we learn.
- We never send your content to an AI model. Pubrivo fits a draft to each network using fixed rules — counting, trimming a title it proposes, applying each network’s limits. Nothing is generated and nothing leaves our systems to be processed.
- No analytics and no tracking cookies. We run no analytics product on this site or in the app, set no advertising or tracking cookies, and operate no tracking pixels.
- We never sell personal data, and never share it for advertising.
Why we process it, and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running the service you signed up for — storing drafts, scheduling, publishing | Performance of a contract |
| Billing and tax records | Contract, and legal obligation for retention |
| Transactional email — verification, password resets, publish failures, plan changes | Contract |
| Emailing an invitation to the address a Member gives us | Legitimate interests — the person invited has no agreement with us yet |
| Showing you the numbers YouTube reports on the videos we published for you | Performance of a contract |
| Keeping accounts secure and preventing abuse | Legitimate interests |
| Telling you when a plan you asked about becomes available | Consent |
Under the PDPA the corresponding bases are contractual necessity and legitimate interest. The waitlist is the one exception: it runs on consent, and you can withdraw it at any time by emailing [email protected], which removes your entry. For everything else we do not rely on consent, so there is no consent to withdraw — closing your account is the equivalent action.
Access to your social accounts
Connecting a channel gives Pubrivo a token that lets it post on your behalf. These tokens areencrypted by the application before they are written to the database, so a copy of the database alone does not yield working credentials.
On every network we ask only for the permissions publishing needs. On Facebook that includes seeing which Business portfolio holds each Page you grant, so we can name it while you choose Pages. On YouTube it includes read access, because without it Google will not tell us which channel you connected; we use it to read that channel’s name and ID and nothing else (YouTube and Google). On X it includes reading your profile and posts, which X asks for alongside posting; we use it when you connect, and once a day after, to read the account’s ID and handle, so a handle you change on X shows here too, and never read your timeline, your followers or anyone’s posts. Pubrivo reads no comments on any network, and no post’s counts except on YouTube, where you can also allow it to read the numbers on the videos it published for you. If that changes, this page changes first, with what is stored and for how long.
You can stop Pubrivo posting at any time by disconnecting the channel in Pubrivo, or by removing Pubrivo in the network’s own settings — either one stops us posting. What each one does.
YouTube and Google
Pubrivo uses the YouTube API Services to publish the videos you schedule to a YouTube channel you connect. Google’s handling of your data is described in the Google Privacy Policy, and using Pubrivo with YouTube means agreeing to the YouTube Terms of Service (our terms say so too).
When you connect a channel, Google asks you to grant these permissions. We use them like this:
| Permission | What Pubrivo does with it |
|---|---|
| Manage your YouTube videos | Uploads each video you schedule, at its scheduled time, with the title and description you approved, as a public video, carrying your answer to YouTube’s “made for kids” question. Nothing else: we never edit, delete or list your videos. |
| View your YouTube account | Reads the connected channel’s ID, name and profile picture, when you connect it and again about once a day, so what you see in Pubrivo stays current and we notice if our access has ended. With the permission below, it also reads the view, like and comment counts of the videos Pubrivo published. We read no other video, no comments’ text and no subscribers. |
| View YouTube Analytics reports for your YouTube content | For each video Pubrivo published to the channel, and no other: reads its views, likes, comments, shares, minutes watched, average view duration and percentage, and subscribers gained, in total and by day — daily for its first 28 days, then about once a month — and shows them beside the post in Pubrivo. They are shown as YouTube reports them: we work out no rates, scores or totals of our own from them, and never combine them with another customer’s. We read no channel-wide reports, nothing about who your viewers are, and no revenue. |
What we keep from YouTube: the channel’s ID and name, a small copy of its profile picture, the encrypted access and refresh tokens, for each video we uploaded, the ID YouTube gave it and its link, and, if you allowed it, the numbers above for those videos. It is used only to publish what you scheduled and to show you where it went and how it was received. We share it with no one: it is stored with our hosting provider (Railway), never sold, never used for advertising, and no person at Pubrivo looks at it except to investigate a problem you report or as the law requires.
Pubrivo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can end Pubrivo’s access in two ways. Disconnect the channel in Pubrivo(how): within seconds we ask Google to revoke our access and delete the stored tokens, our copy of its picture and the numbers we read on its videos. We keep the channel’s ID and name, and the ID and link of each video we published, as the record of what we sent for you. The one exception is a channel still connected in another Pubrivo workspace: revoking would cut that workspace off too, so we delete this workspace’s tokens and leave Google’s permission in place for the other. Or remove Pubrivo on Google’s security settings page: Google does not tell us, but we renew each channel’s access at least hourly and check it daily, and the first renewal or check that finds our access gone deletes the stored tokens and the numbers we read on its videos.
Deleting what Pubrivo stores never touches YouTube. Videos already published stay on your channel until you delete them there, in YouTube Studio. Questions or complaints about how Pubrivo handles your YouTube data go to [email protected].
How long we keep it
| What | How long |
|---|---|
| Account, workspace, posts and publishing records | While your account is open, then deleted when you close it |
| Authorized apps | Until revoked, or until the account that approved it is deleted |
| Webhooks | Until deleted, or until the Member who registered it leaves the workspace. Each delivery's record, with its copy of the post, is deleted 30 days after it was accepted or given up on |
| API keys | Until revoked, or until the workspace or the account that made the key is deleted |
| Access and refresh tokens | Deleted 30 days after you disconnect the channel; at once if you reconnect it, close your account, or remove Pubrivo in Instagram’s, Threads’ or TikTok’s settings. YouTube’s are deleted at once when you disconnect, and as soon as Google stops honouring them |
| A YouTube channel’s ID and name, and the ID and link of each video we uploaded | While your account is open, as our record of what we published and where; deleted when you close it or ask us to delete everything. Disconnecting keeps them, so reconnecting the same channel brings its history back |
| The numbers YouTube reports on a video we published | While the channel stays connected, read again at least every 30 days to confirm our access still works and the video still exists. Deleted when you disconnect the channel, when our access ends, when the video is gone from YouTube, or once we have gone 30 days unable to confirm them |
| Our copy of a channel’s profile picture | Deleted when you disconnect the channel, and replaced whenever the network shows us a new one. A YouTube channel’s is also deleted once we have gone 30 days without being able to read it again |
| What a network told us a connection was granted — permissions, expiry, Business portfolio | While your account is open |
| Uploaded media — your original file | As long as the post that uses it |
| Media we re-encode for a specific network | Deleted 48 hours after the post reaches a final state |
| Files you upload but never publish | Deleted 24 hours after upload |
| Transactional email logs | 90 days; 30 days for an email saying a channel was disconnected, since it names the channel. What an email said, including any verification, password-reset or invitation link, is deleted as soon as we have sent it or given up on sending it; only who it was for, its subject and when are kept |
| Password-reset links | Until used, and deleted within a minute of expiring an hour after they are sent |
| IP addresses counted for email-link requests | An hour, in memory only — never written to disk |
| Undeliverable address | While it is true. Checked every 15 minutes, and gone at the first check after our email provider unblocks the address or you change it |
| Invitations never accepted | Deleted 30 days after they expire |
| Waitlist entries | Until the plan launches and we have told you, or until you ask to be removed |
| Correspondence about a data request, and the log of requests | Two years — the PDPA requires us to keep this record |
| Invoices and billing records | As long as tax law requires |
Who else processes it
Pubrivo runs on four external services. There are no others, and this list is edited whenever that changes.
| Provider | What it does | Where |
|---|---|---|
| Railway | Runs the application, the publishing worker and the database | United States |
| Cloudflare R2 | Stores uploaded media, and serves it to the networks when they fetch it to publish; stores and serves our copy of each channel’s profile picture | Stored in one region; served through Cloudflare’s worldwide network |
| Stripe | Customer records from registration (name and email), subscriptions and payments — holds card details, which we never see | United States |
| Brevo | Sends transactional email | European Union only |
Each is bound by a written processing agreement, as PDPA s.40 requires. When you publish, the content you asked us to publish goes to the social network you chose — that is the point of the product, and from then on that network’s own privacy policy governs it. Likewise, a webhook sends a copy of each post that publishes or fails to the address a Member of your workspace registered; whoever runs that address is responsible for it from then on.
Sending data abroad
Pubrivo is operated from Thailand and its providers are outside it. Where personal data is transferred internationally we rely on the EU Standard Contractual Clauses, which the Thai regulator’s notification names as a valid safeguard. Storage and transit through a cloud provider that cannot itself access the data is not treated as a transfer under Thai law.
Your rights
You can ask us to:
- give you a copy of your personal data, in a portable format;
- correct anything inaccurate or incomplete;
- delete your data;
- stop or restrict a particular use, or object to it;
- explain where we got something, if you did not give it to us directly.
You can also complain to a supervisory authority — in Thailand, the Personal Data Protection Committee; in the EU, your national authority.
How to make a request
Three channels, because Thai law requires more than email:
| Channel | How |
|---|---|
| [email protected] | |
| Post | 411/314 Pracha Uthit Road, Huai Khwang Subdistrict, Huai Khwang District, Bangkok 10310, Thailand |
| In person | By appointment at the address above — write or email to arrange one |
We answer within 30 days, and may extend once by a further 30 days where a request is complex — we will tell you before the first 30 days are up if we need to. We will ask you to verify your identity first. Requests are free where we can fulfil them electronically; if a request requires printing or posting we may charge the actual cost, and we will tell you the amount before doing any work. We keep a record of requests, including any we refuse and why, for two years.
Deleting your data
There are two things you may want, and they are different:
Disconnect a channel
In Pubrivo, open Channels, choose the channel’s menu, andDisconnect channel. We stop posting to it at once and cancel whatever was still scheduled to it, and delete our copy of its profile picture. We keep its stored token, encrypted, for 30 days — only so we can investigate a problem with the channel, never to post — and then delete it.
Disconnecting in Pubrivo does not remove Pubrivo from the network itself. To end our access on the network’s side as well, remove Pubrivo where that network lists the apps connected to your account — on Facebook, Business Integrations in your settings; on Instagram, Threads, TikTok and X, the apps connected to your account in their settings. Instagram, Threads and TikTok tell us when you do this, and we delete the stored token at once; on Facebook a token you removed there no longer works, and we delete it when its 30 days are up. X does not tell us: the token stops working, the channel asks to be reconnected, and the token is deleted 30 days after you disconnect it, or at once if you reconnect.
YouTube is different on both counts. Disconnecting a YouTube channel in Pubrivo also revokes our access at Google, and deletes the stored token within seconds rather than after 30 days. Removing Pubrivo on Google’s security settings page ends our access too, and we delete the stored token within a day.
Posts already published stay on the network — they belong to your account, not to us.
Delete your account and everything in it
Email [email protected] from the address on your account, or write to us at the postal address above, and ask us to delete your account. We verify that the request is yours, then delete your account, your workspaces where you are the only member, your posts, your uploaded media and your stored tokens. For a connected YouTube channel we also ask Google to revoke Pubrivo’s access, within seconds of the deletion.
Posts you wrote in a workspace you share with others belong to that workspace — they stay when you leave it or close your account.
We complete deletion within 30 days, and within 7 days for anything we received from YouTube, and confirm by email when it is done. Two things survive, and only these: billing records we are required by tax law to keep, and the log of your data request itself, which the PDPA does not permit us to delete. Backups are overwritten on their own cycle and are never restored to bring deleted data back.
Cookies
Two cookies: one keeps you signed in, and one remembers which of your workspaces you last chose to work in, set only when you choose one. Both are essential to the service, so there is no consent banner to click — there is nothing optional to consent to. We set no analytics, advertising or tracking cookies of any kind.
Security and breaches
Access tokens are encrypted before storage, passwords are hashed, traffic is encrypted in transit, and access to production data is limited to those who need it.
Media is the exception. A network can only publish a file it can fetch, so uploaded files are served from web addresses that are not listed anywhere and cannot practically be guessed. Anyone given one of those addresses could open the file.
If a breach occurs that puts your data at risk we notify the Thai Personal Data Protection Committee within 72 hours, and notify you directly where the risk to you is high. Our breach coordination contact is the company’s director, reachable at [email protected].
Children
Pubrivo is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has an account, tell us and we will delete it.
Changes to this policy
When what we do changes, this page changes with it, and the date at the top moves. If a change materially affects your rights we email account holders rather than relying on you noticing.
Contact
Chokedee Mechai Chokechai Mewua Soft Co., Ltd. (บริษัท โชคดีมีชัย โชคชัยมีวัวซอฟต์ จำกัด)
Company registration no. 0105566236269
411/314 Pracha Uthit Road, Huai Khwang Subdistrict, Huai Khwang District, Bangkok 10310, Thailand
[email protected]