Privacy policy
Last updated: 9 October 2026
Who is responsible
Kévin Lefebvre is responsible for processing personal data in this instance of Content OS. Contact for privacy requests: kevin.lefebvre@initial-infra.com.
Data and purposes
Content OS processes application-user identifiers and access permissions, connected-account identifiers and profile information, authorisation tokens and expiration information, content drafts and media, publication records and technical information needed to operate the service, such as connection timestamps, request information and error logs.
For TikTok, the current connector requests the account identifier, display name and avatar after authorisation. Publication features use the permissions granted by the account owner. Video statistics require additional permission and are only available where enabled and granted.
These data allow authorised users to sign in, select the right workspace and account, prepare and review content, perform authorised platform operations and diagnose failures. Account authorisation is optional and can be revoked. Without it, operations requiring that platform connection are unavailable. Data may come directly from an authorised user or from a connected platform after authorisation.
Legal basis and access
Operating and securing the internal workspace is based on the operator's legitimate interest in managing authorised content workflows. Optional social-account access is initiated by the account owner's authorisation. Any processing necessary to meet a legal obligation relies on that obligation. Requests concerning these grounds can be sent to the contact above. You can also ask which recipients, retention arrangements and international-transfer safeguards apply to your data.
Access is restricted through user and workspace permissions. Authorisation tokens are stored in encrypted database fields. Authorised administrators and infrastructure providers can access information necessary to operate, host, maintain or restore the service. Data necessary for an authorised platform operation are sent to the platform concerned. Content is only intended to become public when its publication and visibility are selected by an authorised user. Platforms process received information under their own terms and privacy policies, which may include processing outside the European Economic Area.
Retention and disconnection
Connected-account credentials are retained while the connection is maintained. Disconnecting an account removes its local account record and associated credentials and attempts to revoke platform access. Retained drafts, publication history and backup copies require separate consideration; disconnecting is not a guarantee that all related information has been erased everywhere.
Drafts and publication history remain in the workspace until deleted by an authorised operator. Archiving does not erase them. The application does not currently enforce a fixed automatic deletion period for these records. Technical logs and backup copies can outlast a live record; no fixed maximum period is promised for those copies. Contact the operator to request review and erasure of data that are no longer needed, including retained copies. Legal preservation requirements may limit erasure in particular cases.
Cookies
The application uses session and request-protection mechanisms to maintain access and protect forms. These standalone policy pages do not load advertising scripts or external analytics.
Your rights
Depending on the applicable conditions, you may request access, correction, deletion, restriction, objection or portability of your personal data, and withdraw consent where processing relies on it. Contact the operator using the address above. You may also lodge a complaint with the CNIL.
Revoking a platform authorisation stops that authorisation; requests to delete content already published on TikTok should also be handled through TikTok. See the terms of use for the scope of this internal service.