Schmidt WebDev

Privacy Policy

Last updated: October 15, 2026

1. Controller

Schmidt WebDev UG (haftungsbeschränkt), Hellestraße 21, 58675 Hemer, Germany, represented by its managing directors Jan Braband and Johannes Schmidt. Email: office@schmidtwebdev.de. See also our imprint.

2. About SWD Social

SWD Social (social.schmidtwebdev.de) is a tool to create, review, schedule and publish short videos and photo slideshows to YouTube, Instagram and TikTok. Access is by invitation. This policy explains which data we process.

3. Data we process

  • User account: name, email address, password (stored only as a hash) and sign-in sessions (with IP address and user agent).
  • Content: brand details, messages in the AI studio, uploaded and generated images, videos, texts, hashtags and schedules.
  • Connected platform accounts: access tokens (encrypted with AES-256-GCM), account or channel ID, username or channel name, profile picture URL, token expiry, and the IDs and links of posts published by SWD Social.
  • Server logs: IP address, time, requested URL and user agent – for operational security, deleted after 14 days.

4. Data from YouTube, Instagram and TikTok

We only access platform data when you connect an account yourself, and only with these permissions:

  • YouTube (YouTube API Services by Google): youtube.upload to upload videos you approved, and youtube.readonly to show the channel name and channel ID. We do not read any other content of your channel.
  • Instagram (Meta): instagram_business_basic for username, account ID and profile picture, and instagram_business_content_publish to publish approved Reels and carousels.
  • TikTok: user.info.basic for display name, avatar and open ID, and video.publish to publish approved videos and photo posts. Before each post we read the privacy options TikTok allows for your account.

We use this data solely to publish your posts and to show which account is connected. We do not sell it, use it for advertising or profiling, use it to train AI models, or share it with third parties – except with the respective platform when publishing. So that Instagram and TikTok can fetch media, finished posts are reachable via unguessable links.

YouTube and Google

SWD Social uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can revoke SWD Social's access at any time in your Google security settings.

SWD Social's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram and TikTok

For Instagram, the Meta Privacy Policy applies as well; for TikTok, the TikTok Privacy Policy.

5. AI services

  • Anthropic (Claude), Anthropic PBC, USA: processes AI studio messages, brand details and attached images to write texts and post drafts (privacy).
  • fal.ai, Features & Labels, Inc., USA: generates images, video clips and voice-overs from text prompts and reference images (privacy).

Access tokens and data from the platform APIs are not sent to these services. Transfers to the USA are based on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.

6. Hosting

The app runs on a server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, in a data center in Germany.

7. Cookies

We only set a strictly necessary session cookie for signing in. There is no tracking, no analytics and no advertising.

8. Legal bases

  • Art. 6(1)(b) GDPR: providing SWD Social to its users.
  • Art. 6(1)(a) GDPR: consent when connecting a platform account – revocable at any time by disconnecting it.
  • Art. 6(1)(f) GDPR: security and stability of operation (server logs).

9. Retention and deletion

  • If you disconnect a platform account in SWD Social, we delete its access tokens and account data immediately.
  • If access stops working, e.g. because you revoked it on the platform, we flag the account. If it is not reconnected within 7 days, we delete it including its tokens automatically.
  • Deleting a brand deletes its accounts, posts and media.
  • Intermediate files are deleted 14 days after a post was published or rejected.
  • We delete your user account and all data on request within 30 days – see Data Deletion.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Contact us at office@schmidtwebdev.de. You may also lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.