← Back to home

Legal

Privacy Policy

Transparency around how Palactix handles your data.

Privacy Policy – Palactix
Last updated: December 3, 2025

1. Introduction

Welcome to Palactix ("Company," "we," "us," or "our"). We provide a white-label social publishing platform and services ("Service") to agencies for planning, scheduling, and managing content across platforms like Instagram, TikTok, LinkedIn, X (Twitter), and Facebook. Our Service allows agencies to use their own developer app credentials (BYO keys) for OAuth authentication, ensuring clients see only the agency's branding on consent screens.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. By using Palactix, you consent to these practices. If you do not agree, please do not use our Service.

Palactix is based in India and complies with applicable global privacy laws, including GDPR (EU/EEA) and CCPA (California). For EU/EEA users, we act as a data processor when handling connected platform data on your behalf.

2. Data We Collect

We collect data necessary to provide our Service, including:

  • Personal Information: Name, email address, agency name, profile picture URL, and billing details (e.g., address for payments) when you create an account or subscribe.
  • Account Credentials: Hashed passwords for email/password logins. For OAuth logins (e.g., Google), we receive your email and profile per that provider's policy.
  • BYO App Credentials: App IDs, secrets, and OAuth tokens you provide for connected platforms (e.g., Meta, TikTok). These are encrypted at rest using AES-256 and used only to authenticate and publish on your behalf. We do not access or store plaintext credentials.
  • Connected Platform Data: With your explicit consent, access tokens, profile IDs, usernames, and content metadata from connected social accounts. This enables publishing, scheduling, and basic analytics (e.g., post status).
  • Payment Information: Transaction IDs, billing address, and payment method metadata via our processor (Paddle). We do not store full card numbers.
  • Usage & Technical Data: IP address, browser/device info, pages visited, clicks, and timestamps (via cookies and analytics). This helps improve the Service and detect abuse.
  • Uploaded Media: Images, videos, or content you upload for publishing (stored temporarily, deleted after posting unless you specify otherwise).
  • Other Data: Any information you provide via support tickets or integrations.

We do not collect sensitive data (e.g., health, political opinions) unless you voluntarily share it.

3. How We Use Your Data

We use data solely to deliver the Service:

  • Manage accounts, subscriptions, and payments.
  • Authenticate and publish content using your BYO credentials (e.g., OAuth tokens for Instagram posts).
  • Provide features like scheduling, client folders, and token refresh.
  • Process integrations with social platforms (e.g., Meta Graph API) on your behalf.
  • Send service updates, billing info, or support responses.
  • Analyze usage for improvements (aggregated, anonymized data only).
  • Detect/prevent fraud or abuse (e.g., rate limiting to avoid platform bans).
  • Comply with legal obligations (e.g., tax reporting).

We do not sell your data or use it for advertising. Token usage is logged for transparency (e.g., "Token used for post at 2:15 PM") but not shared without consent.

4. Cookies & Tracking Technologies

We use essential cookies for authentication (HttpOnly, secure) and optional analytics cookies (e.g., Google Analytics for usage trends). You can manage preferences in your browser settings. Disabling cookies may limit functionality (e.g., login).

  • Essential: Session management, security.
  • Analytics: Aggregated usage data (opt-out available).

5. Data Sharing & Disclosure

We share data only as needed:

  • Service Providers: Encrypted with partners like Paddle (payments), cloud hosts (storage), and social APIs (publishing). They are bound by contracts to protect data.
  • Connected Platforms: Tokens and content metadata are sent to platforms (e.g., Instagram) for publishing, per your consent and their policies (e.g., Meta's Data Use Policy). We do not share your agency data with platforms.
  • Business Transfers: In mergers/acquisitions, data may transfer with notice.
  • Legal: To comply with laws, subpoenas, or protect rights/safety.
  • With Consent: Only if you explicitly agree (e.g., integrations).

We never sell data or share for marketing.

6. Data Retention

  • Personal/account data: As long as your account is active + 30 days post-deletion.
  • Tokens/credentials: Deleted immediately on revocation or account closure.
  • Logs: 90 days for security, then anonymized.
  • Media: Deleted after posting unless you choose storage.

We delete data when no longer needed or upon request.

7. Data Security

We use AES-256 encryption for credentials/tokens, HTTPS everywhere, and access controls (e.g., role-based). Tokens are isolated per agency. Regular audits and monitoring detect breaches. No system is 100% secure—we notify affected users if a breach occurs.

8. Children's Privacy

Our Service is for users 13+ (or local minimum age). We do not knowingly collect children's data. Contact us if you believe we have.

9. Your Rights

Under GDPR/CCPA, you have rights to access, correct, delete, object, or port data. Submit requests to [email protected]. We respond within 30 days. EU users: Our DPO is at [email protected].

10. Changes to This Policy

We update this policy as needed, with notice via email or site. Continued use = acceptance.

11. Contact Us

Questions? Email [email protected].
For EU GDPR: [email protected].