Watchpost Platform Disclosures

1. About this page

1.1 XYZ Sdn Bhd (Company Registration No. 202601000000), of Malaysia ("Watchpost", "we"), makes here the disclosures each Platform requires from apps using its APIs. This page forms part of our Terms of Service and our Privacy Policy, our notice under s.7 of the Personal Data Protection Act 2010 ("PDPA").

1.2 Precedence. If our documents give different deletion periods, the shorter applies. Each Platform's own terms, linked below, prevail over our summaries.

1.3 Languages. This page is published in English. Our Privacy Policy is published in English and Bahasa Malaysia (PDPA s.7(3)). If a translation of any of our documents differs from the English text, we apply the meaning more favourable to you, as Privacy Policy clause 1.4 provides.

2. Definitions

2.1 Capitalised terms not defined here have the meanings in our Terms of Service. "Tokens" and "Cached Platform Data" have the meanings in our Data Deletion Instructions. Also:

3. Commitments for every Platform

3.1 Permission first. We connect an account only after you approve on the Platform's consent screen. We request only the Scopes your features need.

3.2 A person decides. We publish only what a Member composed and scheduled or approved, to the account and at the time the Member chose. We change it only as far as a Platform's formatting requires. Watchpost never writes posts, and never automatically likes, follows, reposts, messages or replies to anyone (Meta Developer Policies 1.7; YouTube API Services Developer Policies III.C; X Automation Rules).

3.3 Limited use. We use Platform Data only for the features you see in Watchpost. We never sell, license or buy it, or use it for advertising, profiling individuals, eligibility decisions, surveillance, identity matching, re-identification or AI training. We collect it only through official APIs, within your Scopes (PDPA s.130).

3.4 Security. Tokens are encrypted at rest and never logged or displayed. We report incidents affecting Platform Data to the Platform, to you and to regulators as required (PDPA ss.9 and 12B).

3.5 Your controls (PDPA ss.10 and 38; GDPR Art. 17):

(a) Disconnect in Watchpost. We delete the Tokens immediately and the Cached Platform Data within 24 hours.

(b) Revoke at the Platform (Data Deletion Instructions clause 5). We check connections at least every 24 hours. We delete the Tokens and the Cached Platform Data within 7 days of the revocation, and at once after a Meta data deletion request.

(c) Content your team created stays until you delete it. Deleting it in Watchpost does not remove published posts from a Platform.

3.6 Platform decisions. A Platform may restrict features, audit us or suspend our access without notice (Terms clause 15.4). Agencies must hold each Client's authorisation (Terms clause 15.2).

3.7 Platform limits and fair use. Each Platform limits how much can be published through its API, for each account or for our whole application. When a limit is reached, the post waits and is published automatically when the Platform allows it; if it still cannot be published 72 hours after its scheduled time, we mark it as failed with the reason (Terms clause 21.3). To protect the applications all our customers share, we watch for spam-like use under our fair-use rule (Acceptable Use Policy clause 11A). Those checks count activity and never read the meaning of your posts.

3.8 Recent posts on connection. When you connect an account on Facebook, Instagram, Threads, TikTok or YouTube, we import its most recent posts (up to 50), with their captions, links and the counts the Platform returns, so that your analytics and best times work at once. We do not import from X or Google Business Profile.

4. Google API Services: Limited Use

4.1 Watchpost's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

4.2 What this means. For Google User Data, we:

(a) use it only to provide or improve user-facing features prominent in Watchpost: sign-in, publishing to YouTube and Business Profile, and your analytics;

(b) transfer it only where those features need it (for example, to YouTube, or to our service providers under written contract), for security purposes such as investigating abuse, or to comply with the law. In a merger, acquisition or asset sale, we transfer it only after obtaining your explicit prior consent;

(c) never use it for advertising (including retargeted, personalised or interest-based advertising), sell it, use it for credit or lending decisions, or use it to develop, improve or train generalised AI or machine-learning models; and

(d) let no person read it, unless you give affirmative agreement for specific data (for example, by asking support to check a video), reading is necessary for security or legal compliance, or the data is aggregated and anonymised for internal operations.

5. Google Sign-In

5.1 We receive your Google account ID, name, email address and picture, and use them only to create your Account and sign you in.

6. YouTube API Services

6.1 Watchpost uses YouTube API Services. By using YouTube features in Watchpost, you agree to be bound by the YouTube Terms of Service (opens in a new tab). The Google Privacy Policy (opens in a new tab) explains how Google handles data.

6.2 What we access and why.

6.3 Sharing. Members see YouTube data according to their role. Otherwise we share it only with Google when publishing, with our service providers under written contract (see the categories on our Sub-processors page), and with authorities where the law requires. We store it on servers we operate or control. Our service providers may process it in other countries, under the safeguards the law requires (Privacy Policy section 9).

6.4 Storage and deletion (Developer Policies III.E.4). We refresh or delete stored YouTube API data once it is older than 30 days. We delete YouTube data within 24 hours of a disconnect in Watchpost, and within 7 days of a revocation at Google.

6.5 Revoking access. You can revoke Watchpost's access at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

6.6 Uploads. Each upload is clearly a YouTube action and starts only on a Member's instruction. You set the title, description and privacy status (public, unlisted or private), and we do not change them afterwards unless you ask. Until Google completes its compliance audit of our API project, YouTube makes uploads through Watchpost private whatever you choose; the Service tells you while this applies. Google also gives our whole API project a shared daily upload quota; when it is used up, uploads wait until it resets at midnight Pacific Time (3:00 pm or 4:00 pm Malaysia time), and on busy days each Workspace has a fair share (clause 3.7).

6.7 Other disclosures. We show YouTube's metrics as YouTube reports them and label our own calculations, such as best time to post (Developer Policies III.E.3). Watchpost shows no third-party ads. Our Cookie Policy lists every cookie: strictly necessary ones, plus our payment processor's fraud-prevention cookies on billing pages. YouTube privacy questions: [email protected].

7. Google Business Profile

7.1 What we access. With the Business Profile management Scope, we access the locations you manage (name, address, categories, photo and posting eligibility); the posts you publish (updates, events and offers); up to about 18 months of performance metrics, such as profile views, calls, direction requests and website clicks; and each location's rating and review count.

7.2 How we act. We act only for locations you own or are authorised to manage, and publish each post only on a Member's specific instruction. Watchpost does not reply to reviews, answer questions, or create or edit listings. Any future feature of that kind will act only on your prior, specific and express instruction.

7.3 Storage. We store retrieved content securely and delete it once it is older than 30 days. We never cache it to avoid Google's usage tracking (Business Profile API policies (opens in a new tab)).

8. Meta: Facebook Pages and Instagram

8.1 What we access. For the Facebook Pages you select, and Instagram professional (Business or Creator) accounts connected through Facebook Login or Instagram Login, we access their IDs, names, avatars and Tokens; what you publish, with links and comment summaries; the most recent posts (up to 50) when you connect (clause 3.8); and insights, including aggregate audience data.

8.2 Meta Platform Terms summary. The Meta Platform Terms (opens in a new tab) and Developer Policies (opens in a new tab) apply, and Meta's Privacy Policy (opens in a new tab) covers Meta's own processing. Under the Platform Terms, we:

(a) process Meta Platform Data only for your features, and never sell it, profile people without valid consent, make eligibility decisions, carry out surveillance or re-identify anyone (s.3(a));

(b) share it only with our service providers under written contract, as you direct, or as the law requires (s.3(c));

(c) delete it when it is no longer needed, when you ask or close your Account, when Meta asks, or when the law requires (s.3(d));

(d) keep industry-standard safeguards and report incidents to Meta (s.6); and

(e) act as a "Tech Provider" for Agencies: we keep each Client's data separate, process it only for that Agency and Client, and promptly pass on Meta's messages about a user's request (s.5(b)).

8.3 Your rights.

(a) Deletion. Disconnect the account, follow our Data Deletion Instructions, or remove Watchpost in your Facebook or Instagram settings. In the last case, Meta sends us a deletion request and gives you a confirmation code and a link to a status page on our website, where you can check the progress of the deletion.

(b) Other rights. Your rights of access, correction, withdrawal, portability and complaint are in Privacy Policy section 13 (PDPA ss.30–38 and 43A; GDPR Arts. 15–22). If you live outside Malaysia, you also keep the rights your local law gives you, and you may contact us at [email protected] to use them.

(c) Support and security. Support and vulnerability reports: [email protected] (subject "Security" for vulnerabilities), or our Contact page (Developer Policies 1.8; Platform Terms s.6(a)).

9. Threads

9.1 Threads is a Meta product, so clauses 8.2 and 8.3 apply. We access your profile ID, name, picture and Tokens, what you publish, and its insights.

9.2 Replies. We use reply permissions only to publish your thread's follow-up posts, apply your reply controls and act on replies you choose. Watchpost never replies automatically.

9.3 Limits. Meta allows each profile 250 API-published posts and 1,000 replies per rolling 24 hours. At a limit, the post waits and is published automatically when a slot opens, or is marked as failed with the reason after 72 hours (clause 3.7).

10. TikTok Content Posting

10.1 The TikTok Developer Terms of Service (opens in a new tab) apply. The TikTok Partner Privacy Policy (opens in a new tab) governs the data TikTok receives.

10.2 What we access. We access your account ID, name, username, avatar, and follower, like and video counts; your videos' views, likes, comments and shares; and, when you connect, your most recent videos (up to 50) with their public counts (clause 3.8). Before each post, we fetch your nickname, privacy options, interaction settings and maximum video length.

10.3 Your posting choices (TikTok Content Sharing Guidelines).

(a) The composer shows "Posting to {nickname} (@username)" and a preview of exactly what will be posted.

(b) You must choose who can view each post from the options TikTok allows your account. Nothing is pre-selected.

(c) Comments, Duet and Stitch stay off until you turn them on. They are greyed out if disabled in TikTok.

(d) You may post directly or send a draft to your TikTok inbox.

(e) After publishing, it may take a few minutes for the content to process and be visible on your profile.

(f) We add no watermark or Watchpost branding.

10.4 Commercial content disclosure. Off by default. Turn it on if the post promotes a brand, product or service, and choose one or both labels:

Watchpost shows "By posting, you agree to TikTok's Music Usage Confirmation (opens in a new tab)". For Branded content it shows "By posting, you agree to TikTok's Branded Content Policy (opens in a new tab) and Music Usage Confirmation." Choosing Schedule or Post makes that declaration, and you are responsible for its truth (Terms clause 16.3(d); AUP clause 4.3).

10.5 AI-generated content label. Off by default. When on, TikTok labels the post as AI-generated by the creator. Turn it on wherever TikTok's rules require. Once applied, it may not be removable.

10.6 Until TikTok audits Watchpost. TikTok keeps posts made through Watchpost private, may require your account to be private, limits how many accounts can post each day, and blocks Branded content. The composer warns you meanwhile.

10.7 TikTok data. TikTok's API cannot delete posts; delete them in TikTok. We build no profiles or databases of TikTok users. If TikTok ends our access, we delete all TikTok data, including from our servers. If a compromise affects it, we disconnect and report to TikTok immediately.

11. X

11.1 We use the X API under the X Developer Agreement (opens in a new tab) and Developer Policy (opens in a new tab), and follow the X Rules and Automation Rules (opens in a new tab).

11.2 Automation statement. Watchpost is a scheduling tool, not a bot.

(a) A Member writes or approves every post, thread and poll, and Watchpost publishes it to the X account and at the time the Member chose. Threads are replies to your own post. Watchpost does not generate or rewrite content.

(b) Watchpost never likes, follows, reposts, quotes, sends direct messages, replies to others' posts, or posts in response to keywords or trends.

(c) You must not post identical or substantially similar content across several X accounts, send unsolicited @mentions, or repeat identical content through recurring posts. We may hold posts that appear to break these rules (AUP clause 5.1(c)).

11.3 What we access. We access your account ID, username, name and avatar; your verification and subscription type, which set your character limit; and metrics for posts you publish.

11.4 Commitments.

(a) If X content we hold is deleted, protected, suspended, withheld or modified on X, we delete or update our copy within 24 hours of a written request from X or the account owner (Developer Agreement s.IV.B). Owners may write to [email protected].

(b) We never use X content to train AI, target advertising outside X, match X users with other identities or infer their sensitive characteristics.

(c) X is switched off in the Service for now, and nothing is charged for it. X charges for each post sent through its API, more for a post with a link. If we switch X on, we will give at least 30 days' notice, show the per-post charge, including SST where applicable, before you schedule an X post, and add those charges to your monthly invoice as Terms clause 7.4 describes. We do not import X posts published outside Watchpost, because X charges for reading them. X's Privacy Policy (opens in a new tab) covers X's own processing.

12. Trademarks and non-affiliation

12.1 Trademarks. Meta, Facebook, Instagram and Threads are trademarks of Meta Platforms, Inc.; Google, YouTube and Google Business Profile of Google LLC; X of X Corp.; and TikTok of its owner in the TikTok group. We use them only to identify the services you can connect.

12.2 Independence. Watchpost is independent and is not affiliated with, endorsed, sponsored, approved or certified by any Platform. Passing a Platform's review or audit is not an endorsement (Trade Descriptions Act 2011 s.16; Consumer Protection Act 1999 s.10).

13. Contact, complaints and changes

13.1 Contact. [email protected] for support, security reports (subject "Security"), legal notices and our Data Protection Officer. Post: Malaysia. You may complain to Malaysia's Personal Data Protection Commissioner (PDPA s.104), or to the data protection authority where you live or work.

13.2 Changes. We update this page's version and date on every change, and before connecting a new Platform or using a new Scope that changes how we use data. We give notice of material changes under Privacy Policy section 19 (PDPA s.7(2)).