Clips are free. Three a week, no card, no call ›
Æthelstan
Legal

Privacy Policy

Last updated: 9 September 2026

Æthelstan (“Æthelstan”, “we”, “us”) is an operated agent that creates, schedules, publishes and measures social media content on the accounts you connect to it. This policy explains what data we handle to do that, why, how we protect it, how long we keep it, and how to make us delete it. Æthelstan is operated by Ezra Reichel; you can reach us any time at ezra@aethelstan.media.

Who this covers

This policy is for our customers — the businesses and creators whose accounts Æthelstan operates — and for the people whose information reaches us through those connected accounts. For the platform data we process on your behalf, you are the data controller and Æthelstan acts as your processor; for your own account and billing details, we are the controller.

What we collect

  • Account & onboarding information — the brand details, voice, audience, goals and contact information you give us so the agent can work as yours.
  • Connected-account access — the authorization (OAuth) tokens you grant when you connect Instagram, Facebook, TikTok or YouTube. These let Æthelstan publish and read performance on your behalf, within the scope you approve. We never see or store your platform passwords.
  • Content & performance data — the posts we publish for you, and the metrics we read back from each platform (views, likes, comments, saves, shares, follower counts and similar), used to measure and improve what we make.
  • Link-hub analytics — when we host a link hub for you, we count clicks on it (with basic bot-filtering) to report where your audience went. This is first-party measurement; we do not track people across other websites.
  • Technical information — IP address, browser and device information and server logs, used to operate and secure the service.

What we receive from Instagram and Facebook

We access data only for the accounts you explicitly connect, only through Meta’s official APIs, and only for the permissions you granted in the consent dialog. Specifically:

  • Account identity (instagram_basic) — the connected Instagram professional account’s id, username and profile details, so we know which account to act on, and its published media, so performance attaches to the right post.
  • Publishing (instagram_content_publish, pages_manage_posts) — the content you authored or approved, published to your own account or Page at the time you set.
  • Comments (instagram_manage_comments) — comments on your own media, including the commenter’s platform id and username, so replies can be sent on your behalf. We store the id and username of someone we replied to; we do not store the text of their comment.
  • Results (instagram_manage_insights, pages_read_engagement) — media-level and account-level metrics for the connected account: views, reach, engagement and follower counts, shown to you in your dashboard and your reports.
  • Page selection (pages_show_list, business_management) — the list of Pages you administer, so you can choose which one to connect. We store the id of the one you chose.

We do not access accounts you have not connected, and we do not use one customer’s platform data for another customer’s account.

How we use it

We use this information solely to provide the service to you: to research, generate, schedule, publish and measure content on your connected accounts, to report honestly on performance, and to support and improve the product for your account. We do not sell your data, and we do not use platform data for advertising, profiling, resale, or any purpose other than operating your service.

Automated generation and the model provider

Æthelstan writes and evaluates content with large language models operated by Anthropic, acting as our service provider under contract. What is sent to them, and only when producing or assessing your content: the episode or source material you gave us, captions and titles we are drafting for you, your brand brief, and aggregate performance figures for your own posts.

  • Anthropic is contractually prohibited from training models on this data.
  • The text of comments and direct messages is not sent to any model. Where Æthelstan replies to a comment, the trigger is a keyword matched inside our own systems, and the reply is one you configured.
  • Your billing details and your access tokens are never sent to a model provider.

Who else we share it with

Beyond the model provider above, we share data only with the service providers we need to run Æthelstan, each bound to use it only to provide their service to us:

  • The platforms you connect — Meta, TikTok and Google/YouTube — to publish and measure your content.
  • Google Cloud — hosting and key management (encryption), in a London (EU/UK) region.
  • Supabase — our managed database and media storage, in a London (EU/UK) region.
  • Stripe — payments and invoicing. We never hold your card details.
  • Resend — the service that sends our transactional email to you.
  • AI generation providers, used to generate video for audio-only podcasts, only when your show is audio-only.

We do not sell personal information and we do not share platform data with data brokers, advertisers or analytics resellers. We may also disclose information if required by law, or as part of a business transfer, in which case we will tell you.

Platform terms

Our access to and use of information from the platforms you connect is governed by each platform’s terms, and we handle that information only as described here:

  • Information received from Meta (Instagram and Facebook) is used and stored in compliance with the Meta Platform Terms, the Developer Policies and the Developer Data Use Policy.
  • Information received from TikTok is used in compliance with the TikTok Developer Terms of Service.
  • Where we read public YouTube metrics for measurement, that use complies with the YouTube Terms of Service and the Google Privacy Policy.

How we protect it

Data is encrypted in transit and at rest. Connected-account tokens are additionally envelope-encrypted with Google Cloud KMS, so a copy of the database alone cannot be used to post as you, and the web tier holds only the permission to write them, never to read them back. Access to production systems is limited to what is needed to operate the service.

How long we keep it

These windows are enforced by the software, not by anyone remembering to run something:

  • Your account content and settings — kept while your account is active.
  • Performance data for your posts — kept while the connection is active, because it is the record your reporting is built from.
  • Commenter ids and usernames — deleted 90 days after the reply they relate to.
  • Rendered video we produced — deleted from our storage 14 days after it was made, once the post it belongs to has gone out. The copy on your own platform account is unaffected.
  • Clips made with the free tool — deleted 7 days after they were made.
  • When you disconnect an account — its access token is deleted immediately, and everything else we hold for that account is deleted within 30 days. Reconnecting the same account inside that window cancels the deletion, so re-authorizing does not cost you your history.
  • When you remove Æthelstan from Instagram or Facebook — Meta notifies us. Our stored access to that account is deleted the moment we receive it, and the rest of its data within 30 days, on the same terms as a disconnect.
  • When you delete your Æthelstan account — every token is revoked and posting stops at once, and everything else is erased within 30 days, excluding records we are legally required to keep (billing and tax records).

Deleting your data

There are three ways, and all of them are self-serve: disconnect one account from Settings → Connected accounts; delete your whole account from Settings → Delete this account; or remove Æthelstan from Instagram or Facebook’s own Apps and websites settings. Each gives you a confirmation code and a public status page you can check without signing in. Full instructions are on Data Deletion.

Your rights

Depending on where you are, you may have the right to access, correct, delete, export, restrict or object to our use of your personal data, and to withdraw consent. To exercise any of these, email ezra@aethelstan.media and we will respond within the time the law requires, and in any case within 30 days. If you are in the UK or EU, you also have the right to complain to your data protection authority.

Children

Æthelstan is a business product, is not directed to anyone under 18, and we do not knowingly collect personal data from children.

Changes

If we change this policy we will post the new version here with an updated date, and, for material changes, let customers know directly.

Contact

Questions about this policy or your data: ezra@aethelstan.media.