BFTX Sosmed

Privacy Policy

Last updated: 31 October 2026

BFTX Sosmed ("the Service") is a content scheduling and publishing tool operated by BFTX Creative Agency ("BFTX", "we"), Indonesia. It lets authorized users plan posts and publish videos and photos to the Instagram, TikTok, and YouTube accounts they connect. This policy explains what data the Service handles and how.

1. Who can use the Service

Using the Service requires a login issued by BFTX. A platform account can only be connected by a person who controls it and approves access on the platform's own authorization screen.

2. YouTube API Services

The Service uses YouTube API Services to upload your videos to the YouTube channels you connect and to check their processing status. When you connect a channel, Google shows its own consent screen, and the data Google processes is covered by the Google Privacy Policy. By using the Service with YouTube you also agree to the YouTube Terms of Service.

3. Data we collect

From connected platforms, after you authorize access

• TikTok (Login Kit and Content Posting API): your open ID, display name and avatar (scope user.info.basic); the creator information needed to post (creator nickname and username, available privacy options, interaction settings, maximum video duration); and the status and ID of posts you publish through the Service.
• Instagram (Meta Graph API): your Instagram professional account ID, username, name and profile picture; and the container IDs, media IDs and links of posts you publish.
• YouTube (YouTube API Services): your channel ID, title, handle and thumbnail; and the IDs, links and processing status of videos you upload.
• The access tokens and refresh tokens these platforms issue.

From you

• Content you provide: videos, images, captions, titles, tags, scheduled times and posting settings.
• Service account data: your username and a salted hash of your password.
• Notification settings: if you enable Telegram notifications, the bot token and chat ID you enter.

Cookies

The Service sets one session cookie in your browser to keep you logged in. It does not use advertising or analytics cookies, and it does not let third parties serve ads or place cookies.

Technical logs

Server events such as errors and publishing results. Logs do not contain access tokens or passwords.

4. How we use data

We use data only to provide the Service at your request: to show which account will post, to upload and publish your content at the time you choose, to refresh access tokens, to show publishing status and links, and to send the notifications you enable. Content is sent to a platform only after you schedule it or choose "Post now". We do not sell data, use it for advertising, or build profiles of you or your audience.

5. Sharing

Data is shared only with the services needed to carry out your request: TikTok, Meta (Instagram) and Google (YouTube) receive your content and the settings you choose when it is published; Telegram receives notification messages if you enable them; Cloudflare carries encrypted traffic to the Service. We do not share data with any other third party unless required by law.

6. Storage and security

The Service runs on a server managed by BFTX in Indonesia. Access tokens, refresh tokens and app secrets are stored encrypted. Traffic is protected with HTTPS. Only logged-in users can use the Service, and media files can be reached from outside only through short-lived signed links created for the platforms.

7. Retention and deletion

• Tokens and account data are kept while an account is connected. When you remove an account in the Service, its tokens are deleted. For a YouTube channel, the channel details and the IDs and links of its videos stored in the Service are deleted as well.
• The Service checks every day that its access to each connected YouTube channel is still valid. If you revoke access, the channel is marked as needing to be reconnected; unless you reconnect it, its tokens, channel details, and the IDs and links of its videos are deleted within 7 days of the revocation.
• Content and posting history are kept until you delete the post in the Service. Deleting a post removes its media files from our server. Posts already published stay on the platform until you delete them there.
• To have all your data deleted, email [email protected]. We delete it within 30 days.

8. Your choices

You can disconnect an account at any time in the Service (Accounts → Remove) and revoke access on the platform:

• TikTok: Settings and privacy → Security → Manage app permissions.
• Instagram: Settings → Website permissions → Apps and websites.
• Google / YouTube: the Google security settings page at security.google.com/settings/security/permissions. After you revoke access there, the Service deletes the channel's data as described in section 7.

9. Children

The Service is not intended for or directed to children under 13.

10. Changes

We may update this policy. Changes take effect when published on this page, and the date above is updated.

11. Contact

Questions or complaints about these privacy practices: BFTX Creative Agency · [email protected] · bftx.site