นโยบายความเป็นส่วนตัว Privacy Policy

SaenPost Privacy Policy

Version 3.0

Effective date: 19 October 2026

This policy is published in English and Thai. If the two versions differ, the Thai version applies.

Sections for each platform: Facebook and Instagram (section 8), TikTok (section 9), Google and YouTube (section 10). Data deletion instructions are at https://saenpost.com/data-deletion/.

1. Who we are

SaenPost is a web app for writing social media posts and scheduling or publishing them to Facebook, Instagram, TikTok and YouTube. It is operated by THE MASTER 2021 (THAILAND) COMPANY LIMITED (บริษัท เดอะ มาสเตอร์ 2021 (ไทยแลนด์) จำกัด), a company registered in Thailand under registration number 0945564000511 ("SaenPost", "we", "us").

Head office: 35/1 Moo 8, Bang Kruai-Sai Noi Road, Bang Kruai Subdistrict, Bang Kruai District, Nonthaburi 11130, Thailand

Email: [email protected]

Website: https://saenpost.com

Under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"), we are the data controller for the personal data described in this policy. Section 13 describes the cases where we act as a data processor for our customers instead.

2. What this policy covers

This policy applies to saenpost.com and its subdomains, including the SaenPost web app, our public API and our MCP server (together, the "Service"). It explains what personal data we collect, why we use it, who we share it with, how long we keep it and what rights you have.

When you publish through SaenPost, Meta, TikTok and Google also process your data under their own privacy policies. This policy does not cover what those companies do with it. Links to their policies are in sections 8 to 10.

3. Personal data we collect

3.1 Account data

• Your name and email address.
• Your password, which we store only as a one-way hash.
• Your language, time zone and notification settings.
• If you sign in with Google or LINE: your account ID with that provider, your name, email address and profile picture.

3.2 Workspace and team data

• Workspace names and settings.
• The members of each workspace and their roles (owner, admin, editor, approver or viewer).
• Email addresses that you or your teammates enter to send invitations.
• Approval records: who sent a post for approval, who approved or rejected it, when, and any comments.

3.3 Content

• Post text, captions, hashtags, video titles and descriptions, and first comments.
• Images, videos and thumbnails you upload.
• Publishing times, settings for each channel, labels, signatures and drafts.
• Text you send to the AI caption feature and the suggestions it returns.

Content can contain personal data about other people, such as people who appear in your photos or videos. Section 13 explains how we handle that data.

3.4 Data from connected social accounts

When you connect a Facebook Page, an Instagram account, a TikTok account or a YouTube channel, we receive account details and access tokens from that platform. Sections 8 to 10 list what we receive from each one.

3.5 Billing data

• Your plan, subscription status and payment history.
• Billing name, address, tax ID and branch, which appear on tax invoices.
• Withholding tax certificates you upload.
• Limited payment details from Stripe, such as card brand, the last four digits and the expiry date. Stripe collects and stores full card numbers. We never receive them.

3.6 API and MCP data

• API keys, which we store only as hashes, with their names and when they were last used.
• The AI apps and other OAuth clients you connect to our MCP server, and the access tokens we issue to them, which we store only as hashes.
• Records of requests made through the API and MCP server.

3.7 Technical and usage data

• IP address, browser type, device type and operating system.
• The pages and features you use, with timestamps.
• Error reports and security logs.
• An audit log of important actions in a workspace, such as connecting a channel, approving a post or changing a member's role.

3.8 Messages

• Emails you send to [email protected] and our replies.
• Records of the notifications we send you by email.

We do not ask for sensitive personal data as described in section 26 of the PDPA, such as health, religious or biometric data. Please do not put it in your content unless you have a lawful basis to do so.

You need to give us an email address to create an account, and your billing name, address and tax ID if you want a full tax invoice. Without them we cannot create the account or issue the invoice.

4. Where we get your data

• From you, when you sign up, use the Service or contact us.
• From your teammates, when they invite you or add content to a workspace you share. The invitation email says who invited you and links to this policy.
• From Meta, TikTok and Google, when you connect a Facebook Page, an Instagram account, a TikTok account or a YouTube channel.
• From Google or LINE, if you use them to sign in.
• From Stripe, about the status of your payments.
• Automatically from your browser and our servers, through logs and cookies (section 12).

5. Why we use your data and our lawful bases

We do not sell personal data. We do not use data from Facebook, Instagram, TikTok or YouTube for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

6. AI features

SaenPost uses Claude, an AI model made by Anthropic, PBC, to suggest captions. When you use the AI feature, we send Anthropic the text and instructions you enter and any draft text you choose to include. Anthropic returns suggestions, which you can edit or discard. Under Anthropic's Commercial Terms, Anthropic may not train its models on content we send through its API.

We do not use your content to train AI models. We do not send data received from Google APIs, including YouTube data, to Anthropic or to any other AI provider.

You can use SaenPost without the AI feature.

7. Who we share data with

7.1 The platforms you connect

When you publish a post, we send its content and the settings you chose to the platform: Meta (Facebook and Instagram), TikTok or Google (YouTube). Each platform then handles the content under its own terms and privacy policy.

7.2 Our service providers

These companies process personal data for us, under contract, to run SaenPost.

7.3 Sign-in providers

If you sign in with Google or LINE, that provider confirms your identity to us under its own terms.

7.4 Your workspace

Members of a workspace can see its content, connected channels and activity according to their role. Owners and admins can see the workspace's audit log.

7.5 AI assistants you connect

You can connect your own AI assistant, such as Claude, to SaenPost through our API or MCP server. You choose that assistant, and its provider handles data under its own terms. The assistant can do only what the permissions you grant allow, such as reading your posts and channel names and creating posts. For data from YouTube, see section 10.4.

7.6 Legal reasons and business transfers

We disclose personal data when the law requires it, for example to comply with a court order or a lawful request from a Thai authority, and when it is needed to protect the rights, property or safety of our users, the public or SaenPost.

If SaenPost or our company is merged or sold, we will tell you before your personal data is transferred. For data received from Google APIs, we will ask for your consent first.

8. Facebook and Instagram data (Meta)

8.1 How the connection works

You connect Facebook Pages and Instagram professional accounts (Business or Creator) through Facebook Login for Business. Meta shows you the permissions SaenPost asks for and lets you choose which Pages and Instagram accounts to share with us. An Instagram account must be linked to a Facebook Page that you connect.

8.2 Permissions we ask for

• pages_show_list, to list the Pages you can connect.
• pages_read_engagement, to read your Page's details, find the Instagram account linked to it, and read engagement on posts published through SaenPost.
• pages_manage_posts, to publish posts, photos, videos and Reels to your Page.
• instagram_basic, to read your Instagram account ID, username and profile picture, and basic details of media published through SaenPost.
• instagram_content_publish, to publish photos, carousels, Reels and Stories to your Instagram account.
• pages_manage_engagement, to add the first comment you write under a post on your Page.
• instagram_manage_comments, to add the first comment you write under a post on your Instagram account.

8.3 Data we receive and store

• The app-scoped user ID and name of the person who connects the accounts.
• For each Page: the Page ID, name, profile picture and a Page access token.
• For each Instagram account: the account ID, username and profile picture.
• For posts published through SaenPost: the post or media ID, link, publishing status and any error message.
• Instagram's publishing limit for your account, which tells us how many more posts it can publish in the current 24 hours.
• If you use post statistics: basic engagement counts, such as the number of likes and comments, for posts published through SaenPost.

We do not access posts on your personal Facebook profile, your friends list, your messages or your ad accounts.

8.4 How we use it

• To show which Pages and Instagram accounts you can post to.
• To publish the posts you schedule and add the first comments you write.
• To check whether each post went live and show you its status.
• To show post statistics.
• To check once a day that each connection still works, and to warn you before access expires.

We do not use Meta data for advertising, we do not sell it, and we do not use it to build profiles of people. When we act as a Meta Tech Provider for a business customer, we process Facebook and Instagram data on behalf of that business and follow its instructions, including requests to delete data.

8.5 Retention and deletion

Page access tokens and other tokens are encrypted (section 15). We keep Meta data while the account is connected. When you disconnect an account in SaenPost, remove SaenPost in your Facebook settings or ask us to delete your data, we delete the tokens as soon as we learn of it and delete the other data we received from Meta within 7 days, except records the law requires us to keep.

8.6 How to remove SaenPost's access

• In SaenPost: go to Settings > Channels, choose the Page or Instagram account and select Disconnect.
• On Facebook: go to Settings & privacy > Settings > Business integrations (or Apps and websites), find SaenPost and select Remove. Menu names can differ slightly between the Facebook app and the website.
• To ask us to delete your data, follow https://saenpost.com/data-deletion/.

Meta's Privacy Policy: https://www.facebook.com/privacy/policy/

9. TikTok data

9.1 How the connection works

You connect a TikTok account on TikTok's own login page (TikTok Login Kit). We ask for these scopes:

• user.info.basic, to read your open_id (an ID that TikTok creates for SaenPost), display name and profile picture.
• video.upload, to send videos to your TikTok inbox as drafts that you finish in the TikTok app.
• video.publish, to post videos directly to your TikTok profile (Direct Post).

9.2 Data we receive and store

• Your open_id, display name and profile picture.
• Creator information, which we request from TikTok each time you open the TikTok section of a post: your nickname and username, profile picture, the privacy options available to your account, whether comments, Duet and Stitch are turned off for your account, the longest video you can post, and whether TikTok currently allows the account to post.
• The publish ID that TikTok returns, the processing and publishing status of each video, and the post ID once TikTok makes it available.
• Access and refresh tokens, which are encrypted.

9.3 How we use it

• To show which TikTok account a post will go to.
• To build the privacy and interaction options from what TikTok returns for your account, and to stop a post if TikTok says the account cannot post at that time.
• To upload the video you chose with the settings you chose.
• To show whether TikTok is still processing the video, has published it or has sent it to your inbox.

9.4 Posts are published only by your action

We send a video to TikTok only after someone in your workspace with permission (you or a teammate) has reviewed the post in SaenPost and chosen its TikTok settings: who can view it (we do not pre-select an option), whether to allow comments, Duet and Stitch (each stays off until you turn it on), and whether the video promotes your own brand or a third party. Before you can schedule or publish, you must agree to TikTok's Music Usage Confirmation, and to TikTok's Branded Content Policy if the video is branded content. We do not add watermarks or SaenPost branding to your videos.

Until TikTok approves SaenPost for public Direct Post, videos may be sent to your TikTok inbox or published so that only you can see them. SaenPost tells you when this applies, and you finish the post in the TikTok app.

9.5 Retention and deletion

We keep TikTok data while the account is connected. When you disconnect the account in SaenPost, remove SaenPost's access in the TikTok app or ask us to delete your data, we delete the tokens as soon as we learn of it and delete the other data we received from TikTok within 7 days, except records the law requires us to keep.

9.6 How to remove SaenPost's access

• In SaenPost: go to Settings > Channels, choose the TikTok account and select Disconnect.
• In the TikTok app: go to Profile > Menu > Settings and privacy > Security > Manage app permissions, select SaenPost and tap Remove access. Menu names can differ between app versions.

TikTok's Privacy Policy: https://www.tiktok.com/legal/privacy-policy

10. Google and YouTube data

SaenPost uses YouTube API Services. By using SaenPost you agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). The Google Privacy Policy (https://policies.google.com/privacy) explains how Google handles your data.

10.1 What we access

Sign in with Google (optional). If you choose to sign in with Google, we receive your Google account ID, name, email address and profile picture (scopes: openid, email and profile). We use them only to create your SaenPost account and sign you in.

YouTube. When you connect a YouTube channel, we ask for two scopes:

• https://www.googleapis.com/auth/youtube.upload, so SaenPost can upload videos to your channel and set each video's title, description, thumbnail, visibility (public, private or unlisted) and scheduled publish time.
• https://www.googleapis.com/auth/youtube.readonly, so SaenPost can read your channel ID, channel name and channel picture to show which channel you are posting to, and read the processing status, visibility and statistics (such as view, like and comment counts) of videos uploaded through SaenPost.

10.2 What we store

• Your channel ID, channel name and the address of your channel picture.
• For videos uploaded through SaenPost: the video ID, upload and processing status, visibility, scheduled publish time and statistics.
• OAuth access and refresh tokens, which are encrypted.
• If you use Sign in with Google: your Google account ID, name, email address and profile picture.

We do not read or store other YouTube data, such as your watch history, subscriptions, playlists, comments, or videos that were not uploaded through SaenPost.

10.3 How we use it

We use Google user data only to provide the features you see in SaenPost: signing in, connecting your channel, uploading and scheduling videos, showing their status and statistics, and checking that the connection still works.

We upload a video only after someone in your workspace with permission (you or a teammate) has created the post, set its title, visibility and publish time, and chosen to schedule or publish it. We never change a video's visibility without your action.

10.4 How we share it

We do not sell Google user data. We do not transfer it to advertising platforms, data brokers or information resellers, and we do not use it for advertising, to determine creditworthiness or for lending. We share it only:

• with our hosting and storage providers (Hetzner and Cloudflare), which process it for us under contract to run the Service;
• with an AI assistant you connect to SaenPost through our API or MCP server, limited to your channel's name and ID and the status of your posts, and only after you authorize that assistant;
• when the law requires it; or
• in a merger or sale of the business, and only after asking for your consent.

Our staff do not read your Google user data unless you ask us to as part of a support request, it is needed for security (for example to investigate abuse), or the law requires it.

10.5 AI and machine learning

We do not use Google user data to develop, improve or train generalized AI or machine learning models. We do not send data received from Google APIs to Anthropic or to any other AI provider.

10.6 How we protect it

YouTube tokens are encrypted with AES-256-GCM. Connections to SaenPost use HTTPS, every request is checked against the user's role on our servers, and important actions are recorded in an audit log. Section 15 describes our security measures in full.

10.7 Retention and deletion

• We keep YouTube tokens while your channel is connected.
• We refresh or delete other stored YouTube data at least every 30 days, as the YouTube API Services Developer Policies require.
• When you disconnect your channel in SaenPost, we revoke our access with Google right away and delete all data we received from YouTube within 7 days.
• If you ask us to delete your data, we delete the data we received from YouTube within 7 days of your request.
• If you remove SaenPost's access in your Google Account instead, we detect it at our next daily connection check and delete the data we received from YouTube within 7 days after that.
• Sign in with Google data is deleted together with your SaenPost account (section 14).

10.8 How to revoke access

• In SaenPost: go to Settings > Channels, choose the YouTube channel and select Disconnect.
• In your Google Account: open https://myaccount.google.com/connections (Google's security settings page, also reachable at https://security.google.com/settings/security/permissions), select SaenPost and remove its access.

10.9 Limited Use

SaenPost's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy: https://developers.google.com/terms/api-services-user-data-policy

11. Transfers outside Thailand

Our servers are in Singapore. Some of our service providers are based in the United States and other countries, and the platforms you publish to process data in many countries. We transfer personal data outside Thailand only as the PDPA allows:

• when the transfer is necessary to perform our contract with you, such as sending your posts to the platforms you choose (section 28 of the PDPA); and
• to our service providers, relying on each provider's standard data processing terms to protect the data, as section 29 of the PDPA provides.

You can ask us about these safeguards at [email protected].

12. Cookies and similar technologies

Our public website at saenpost.com does not set cookies.

The SaenPost app uses necessary cookies and browser storage, such as local storage, to keep you signed in, protect forms against cross-site request forgery (CSRF) and remember your interface preferences. The app does not work without them, so they do not need your consent.

We may count visits to our website with Plausible Analytics, which does not use cookies.

We do not use advertising or marketing cookies, and we do not show third-party advertising in SaenPost.

13. Data we process for our customers

When a business uses SaenPost, the business decides what content to create and which personal data the content contains, such as photos of its staff or students. For that content, the business is the data controller and we are its data processor. We process the data only to provide the Service and follow the business's instructions. Business customers can ask for a data processing agreement (DPA) by emailing [email protected].

If your content includes children, you are responsible for getting the consent the law requires, such as consent from a parent or guardian.

If you appear in content managed through SaenPost and want to exercise your rights, please contact the business that published it. If you contact us, we will pass your request to that business.

14. How long we keep data

When a period ends, we delete the data or anonymize it so that it can no longer identify you. We may keep anonymized, aggregated statistics.

15. How we protect your data

• Platform access tokens are encrypted with AES-256-GCM, using a new random IV each time. The encryption key is stored separately from our other secrets.
• API keys and OAuth tokens are stored only as hashes. Passwords are stored only as one-way hashes.
• Sessions expire, and signing out ends the session on our servers.
• Our servers check the user's role on every request.
• Sign-in and sign-up are rate limited, and forms are protected with CSRF tokens.
• Important actions are recorded in an audit log.
• Connections to SaenPost use HTTPS.
• We back up the database to Cloudflare R2 every day.

No system is completely secure. If a breach happens, we follow section 16.

16. Data breaches

If a personal data breach occurs, we will notify the Office of the Personal Data Protection Committee (PDPC) within 72 hours of becoming aware of it, unless the breach is unlikely to put anyone's rights and freedoms at risk (section 37(4) of the PDPA). If the breach is likely to put you at high risk, we will also tell you without delay what happened and what we are doing about it. We will also notify Meta, Google or TikTok when their terms require it.

17. Your rights

Under the PDPA you have the right to:

• access your personal data and get a copy, and ask how we obtained data you did not give us (section 30);
• receive your data in a commonly used, machine-readable format, or ask us to send it to another controller (section 31);
• object to processing based on legitimate interests, and to direct marketing (section 32);
• ask us to delete, destroy or anonymize your data (section 33);
• ask us to restrict the use of your data (section 34);
• ask us to correct inaccurate or incomplete data (sections 35 and 36);
• withdraw your consent at any time (section 19); and
• complain to the PDPC if you believe we have broken the PDPA (section 73).

You can do several of these yourself in the app: edit your profile, export your workspace data (Settings > Workspace > Export data), disconnect channels (Settings > Channels) and delete your account (Settings > Account > Delete account). For anything else, email [email protected] from the email address on your account. We may ask you to confirm your identity. We respond within 30 days of receiving your request. If we cannot do everything you ask, for example because the law requires us to keep tax records, we will explain why.

Office of the Personal Data Protection Committee (PDPC): https://www.pdpc.or.th

18. Withdrawing consent

Where we rely on your consent, such as for marketing emails, you can withdraw it at any time by using the unsubscribe link in our emails or by emailing [email protected]. Withdrawing consent does not affect processing that took place before you withdrew it.

You can also end our access to a social account at any time by disconnecting it (sections 8.6, 9.6 and 10.8).

19. Children

SaenPost is for businesses and adults. You must be at least 20 years old to create an account. We do not knowingly collect personal data from people below that age. If you believe someone below that age has given us personal data, email [email protected] and we will delete it.

20. Changes to this policy

We may update this policy. For material changes, we will tell you by email and in the app at least 30 days before the change takes effect. The version number and effective date at the top of this page show which version applies.

21. Contact us

THE MASTER 2021 (THAILAND) COMPANY LIMITED

35/1 Moo 8, Bang Kruai-Sai Noi Road, Bang Kruai Subdistrict, Bang Kruai District, Nonthaburi 11130, Thailand

Email: [email protected]

Send privacy questions, requests to exercise your rights and complaints to [email protected].