Privacy Policy

Effective date: 19 October 2026. Cadence Studio is a social media scheduling and analytics service for creators and businesses, operated by Lachlan Oldfield in Australia ("we", "us"). We are responsible for account and service administration data. Workspace customers control the content and connected accounts they manage. Contact: lachieold@gmail.com.

1. Information we collect

We collect sign-in email and profile details, workspace membership and invitations, timezone and notification preferences, encrypted social access and refresh tokens, account IDs and profile images, uploaded media, captions and scheduling instructions, publishing results, analytics, comments and replies, API key hashes and usage timestamps, and link-in-bio click details such as referrer. Authentication and infrastructure providers may process IP addresses, device and security logs. We do not receive your social media passwords.

2. Purpose and lawful basis

We process data to operate your workspace, publish requested content, display analytics and comments, provide support, prevent abuse and meet legal obligations. For EU/EEA users, our bases are performance of our contract with you, legitimate interests in security and reliable service, legal obligations where applicable, and consent where required. You may withdraw consent without affecting earlier lawful processing. We do not sell personal information or use connected-platform data for advertising.

3. AI assistance

When you request AI assistance, the brief, caption, brand name, tone and chosen networks are sent through Lovable’s AI gateway to its configured model provider. OAuth tokens are not sent. Do not include sensitive personal information in prompts. AI assist uses OpenAI through Lovable’s AI gateway. The request disables model-response storage. Contact us for current processing locations. Connected Google API data is not supplied to AI assistance automatically.

4. Sharing, processors and overseas disclosure

We use Lovable Cloud, backed by Supabase, for database, authentication and storage; Lovable and Cloudflare for application hosting and network infrastructure; and OpenAI through Lovable’s AI gateway for AI assistance you request. Google/YouTube, Meta, TikTok and X receive content and requests when you use their connected services and handle that information under their own policies. We may disclose information to service providers acting for us, with your instructions, or when required by law; we do not promise that no third-party processing occurs.

We operate in Australia. Infrastructure, social platforms and AI providers may process data overseas, including in the United States and other countries. Contact us for current processing locations for Supabase, Lovable, Cloudflare, OpenAI and the connected social networks. Transfers are subject to applicable data-protection requirements.

Security and workspace access

Provider tokens are encrypted with AES-GCM and restricted to server access. Workspace membership and roles control access to workspace records. Invited users may see shared content according to their access. We use HTTPS, server-side authorization and abuse limits, but no service can guarantee absolute security.

5. Google and YouTube data

Cadence uses the YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

Cadence's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the publishing and analytics features described here, is not transferred to others except as needed to provide those features or as required by law, is not used for advertising, and is not read by humans except with your consent, for security purposes, or as required by law.

TikTok data

Cadence uses TikTok Login Kit and the Content Posting API with scopes user.info.basic (open ID, display name and avatar), video.upload and video.publish (to send videos you choose, as drafts or direct posts with the privacy and interaction settings you pick), and video.list (your recent videos and their view, like, comment and share counts for analytics). We do not request follower statistics. TikTok data is used only to provide these features, is not sold or used for advertising. Disconnecting deletes our stored TikTok access and refresh tokens and stops further access; previously saved account details and analytics remain until workspace deletion or a deletion request, as described below.

6. Retention

Tokens are removed locally when an account is disconnected. Workspace posts, media and analytics remain until workspace deletion or removal through the service, except published media originals, which are removed 90 days after their posts finish publishing unless pinned. Media storage is limited by plan (Solo 5 GB, Creator 25 GB, Studio 100 GB, Agency 250 GB). Inbox comments older than 90 days are removed by the scheduled cleanup. Pending social account selections expire after 15 minutes, and invitation links expire after seven days. Operational logs, backups and provider copies follow their providers’ retention schedules. Contact us for current retention information. Legally required records may be retained only as necessary.

7. Revoking access

• In Cadence, open Connections and choose disconnect on the account. This immediately deletes its stored tokens.
• You can also revoke access from each platform: Google account permissions, Facebook/Instagram Settings → Business Integrations, TikTok Settings → Security → Manage app permissions, and X Settings → Connected apps.

8. Access, correction and deletion

You can update profile details and preferences in Settings, disconnect social accounts in Connections, and use Settings → Members & deletion to delete your account or an owned workspace. Workspace deletion removes shared workspace content and files for all members. Account deletion removes workspaces you own and your memberships; content in another owner’s workspace remains under their control. Deletion may be blocked while publishing is in progress. Contact lachieold@gmail.com to request access, correction, export or deletion of personal information, or assistance with a failed deletion. We may verify identity before acting. See the data deletion page.

EU/EEA users may also request restriction or portability, object to processing based on legitimate interests, withdraw consent, and complain to their local data protection authority, subject to applicable law.

9. Cookies and browser storage

Essential authentication storage maintains your sign-in session. A short-lived secure HttpOnly cookie binds social sign-in to your browser. Browser storage also remembers theme, brand and selected posting accounts. We do not intentionally set advertising cookies. Optional non-essential tracking, if introduced, requires an updated notice and consent where applicable.

10. Complaints and data incidents

Send privacy concerns to lachieold@gmail.com. We will investigate and respond within applicable legal timeframes. Australian users can complain to the Office of the Australian Information Commissioner; EU/EEA users can contact their supervisory authority. Where a breach meets notification requirements, we will notify affected people and the relevant regulator without undue delay, including within 72 hours to an EU authority where the GDPR requires it.

11. Policy changes

We publish updates here with an effective date and will provide additional notice where required.