Privacy Policy

1. Business operator: name, address, and representative

ikkatsup (https://ikkatsup.com) is a service that schedules finished short videos for posting to multiple YouTube, TikTok, and Instagram accounts.

This policy describes how the operator collects, uses, stores, shares, and deletes users' information through ikkatsup.

Name of the business operator

efoo Inc. (the "operator")

Representative Director

山本 篤

Address

101 Kawahiro Bldg., 4-4-6 Igusa, Suginami-ku, Tokyo 167-0021, Japan

Contact (including for privacy questions and complaints)

chefree@efoo.jp

This policy uses the following terms.

• "Organization" means a company or group that has its own independent workspace in ikkatsup.
• "Participant" means a person who has been invited to an organization and can log in to ikkatsup. A participant's role is either administrator or member.
• "User" means organizations and participants together.
• "Connected platform" means YouTube, TikTok, or Instagram, which an organization connects as a place to post.

ikkatsup is a service that multiple organizations can use. Each organization connects its own social media accounts. The operator accepts organizations by invitation.

One participant can belong to multiple organizations. A participant's role is set separately for each organization the participant belongs to.

2. Information we collect

ikkatsup collects and stores the following information.

Passwords for connected platforms are never passed to ikkatsup. A participant reviews and approves what ikkatsup is allowed to do on the connected platform's own consent screen.

3. How we use information

The operator uses the information it collects only for the following purposes.

• To post the content that an organization has confirmed to the social media accounts that the organization connected, at the specified time.
• To show connected accounts, scheduled posts, and posting results in the admin console and the command-line tool.
• To accept participants' logins and determine the organizations each participant belongs to and the participant's role in each organization.
• To confirm that a participant has agreed to the Terms of Service and this Privacy Policy, and to ask for agreement again when the Terms of Service or this policy is revised.
• To prevent unauthorized use, maintain security, and investigate the causes of failures.
• To respond to requests for deletion of data and to inquiries.

The operator does not use the information it collects for advertising, sale, or profiling.

ikkatsup has no AI features. The operator does not use the information it collects to train generative AI or machine learning models.

4. Google user data

When an organization connects a YouTube channel, ikkatsup receives information about that channel through Google's APIs. We disclose how we handle information received from Google APIs as follows.

ikkatsup's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

The sentence above is the disclosure wording that Google specifies. ikkatsup handles information received from Google APIs ("Google user data") in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

Google user data we access

ikkatsup requests one permission (scope) from Google: https://www.googleapis.com/auth/youtube.

ikkatsup accesses the following six kinds of Google user data.

• The channel ID and channel name of the connected channel.
• The identifier (video ID), public URL, and upload session URI of videos that ikkatsup uploaded.
• The publication status and processing status of videos that ikkatsup uploaded.
• The OAuth access token and refresh token.
• The reason that Google returned when a token's expiry could not be renewed, or when data from YouTube could not be re-fetched.
• Whether the connected channel is able to upload videos longer than 15 minutes.

Actions we take on a user's behalf

ikkatsup takes only the following five actions on a connected channel.

1. When an account is connected, and every day after that, it reads the channel ID and channel name. The daily reading is the re-fetching of data obtained from YouTube that is described in 10. Retention.
2. After a participant confirms a scheduled post, it uploads the confirmed video to that channel and sets the title and description. When it uploads, and the state of the video on YouTube, depend on the visibility setting of the scheduled post (public, unlisted, or private).
   • Public: it uploads the video right after the confirmation, as private, and sets the scheduled publication time. The video stays private until that time, when YouTube publishes it.
   • Unlisted or private: it uploads the video at the scheduled publication time, with that visibility. Before that time, the video does not exist on YouTube.
3. After the scheduled publication time, it checks whether the uploaded video has the visibility that was set for the scheduled post, and whether the video still exists on YouTube. It also checks for existence every day after the account is connected.
4. When a scheduled post is canceled, it deletes the video that ikkatsup uploaded. The same applies when scheduled posts that have not yet been published are canceled because an account is disconnected. For an unlisted or private scheduled post, no video exists on YouTube before the scheduled publication time, so there is nothing to delete if it is canceled before then.
5. When an account is disconnected, it revokes the token that ikkatsup stores at Google.

Until a participant confirms a scheduled post, ikkatsup sends neither the video nor the post text to YouTube.

ikkatsup takes no actions other than these. ikkatsup does not modify or delete any video other than those it uploaded. ikkatsup does not display, download, or search YouTube videos. ikkatsup does not read comments or similar data.

Scope of use under the Limited Use requirements

• The operator uses Google user data only to provide the features that an organization can see in ikkatsup (scheduled posting, display of connected accounts, and display of posting results).
• The operator does not sell Google user data to third parties.
• The operator does not transfer Google user data to third parties, except in the following cases.
  • When the user has consented.
  • When it is necessary for security.
  • When required by law.
  • In a merger, acquisition, or sale of assets, when the user has given prior explicit consent.
• The operator does not use Google user data for advertising, including personalized advertising, interest-based advertising, and retargeting.
• The operator does not transfer or sell Google user data to data brokers or information resellers.
• The operator does not use Google user data to determine credit-worthiness or for lending decisions.
• The operator does not build databases from Google user data in order to sell them.
• A person, such as an employee of the operator, reads Google user data only with the user's consent, when necessary for security, or when necessary to comply with law.
• If the operator wants to use Google user data beyond what this policy states, it will first obtain the user's consent.

Storage and sharing of Google user data are described in 8. Sharing and third parties, 9. Storage and security, and 10. Retention.

How we protect Google user data

We protect Google user data using the measures described in 9. Storage and security. OAuth tokens are stored encrypted and are never shown in the admin console or returned by the API. When an account is disconnected, we revoke the token with Google and delete it from ikkatsup.

5. Use of a video-sharing service's API

ikkatsup uses YouTube API Services.

When you use YouTube features through ikkatsup, the YouTube Terms of Service apply. The YouTube Terms of Service are available at https://www.youtube.com/t/terms.

The Google Privacy Policy governs how Google handles information. The Google Privacy Policy is available at https://policies.google.com/privacy.

The information that ikkatsup obtains from YouTube is described in 2. Information we collect and 4. Google user data. Who the information is shared with is described in 8. Sharing and third parties. Revoking YouTube access is described in 12. Revoking access.

6. Handling of information from a short-video app

ikkatsup uses the open_id and display_name that TikTok returns to identify and display the connected account.

ikkatsup uses the values of TikTok's creator_info to display the post page in the admin console, and to check whether the post content fits the poster's limits. ikkatsup obtains the creator_info values from TikTok each time it displays the post page. To build the public URL of a post after it is published, ikkatsup uses the creator_username from creator_info, and stores the URL it builds as part of the posting result. ikkatsup does not store any other creator_info values in its database.

The only content that ikkatsup sends to TikTok is content that has been confirmed. The person posting selects and saves TikTok's visibility, whether comments, duets, and stitches are allowed, and the commercial content disclosure on the post page in the admin console. Until they have saved them, a post to TikTok cannot be confirmed, either in the admin console or with the command-line tool. Until a post is confirmed, ikkatsup sends neither the video nor the post text to TikTok.

A confirmed video is served at a URL that ikkatsup signs so that TikTok can retrieve it. The URL stops working after it expires.

When an account is disconnected, ikkatsup sends TikTok a request to revoke the stored access token. The result of the revocation, and what to do if it could not be revoked, are described in 12. Revoking access.

7. Handling of information from a photo and video sharing app

ikkatsup uses the Instagram user ID and username to identify and display the connected account. ikkatsup uses the access token to post to Instagram.

The operator uses data obtained from Instagram only for posts made on an organization's instructions. The operator does not use that data for any other purpose of its own.

The operator stores data obtained from Instagram separately for each organization. How it is stored is described in 9. Storage and security.

A confirmed video is served at a URL that ikkatsup signs so that Instagram can retrieve it. The URL stops working after it expires.

Instagram has no API for revoking a token. When an account is disconnected, ikkatsup does not send Instagram a request to revoke the token. ikkatsup erases the token it stores. How to revoke access on Instagram's side is described in 12. Revoking access.

8. Sharing and third parties

Transfer and sale to third parties

The operator does not sell the information it collects to third parties.

The operator does not transfer the information it collects to third parties, except when the user has consented, when it is necessary for security, when required by law, or in a business succession such as a merger, acquisition, or sale of assets, when the user has given prior explicit consent.

The operator does not use the information it collects for advertising.

A person, such as an employee of the operator, reads the information it collects only with the user's consent, when necessary for security, or when necessary to comply with law.

Infrastructure provider

The operator entrusts the storage and processing of ikkatsup's data to the services of Cloudflare, Inc. The information we collect is stored and processed on Cloudflare's services. Cloudflare's services also authenticate logins.

Connected platforms

ikkatsup sends the content that an organization has confirmed to the connected platform that the organization connected. The content sent is the video, an optional cover image, the title, the caption, hashtags, the visibility setting, the scheduled publication time, and settings specific to each connected platform.

This transmission is made for a post that the user instructed. Content sent to a connected platform is handled under that platform's terms and privacy policy.

Participants of the same organization, and the operator

Participants of the same organization can see that organization's connected accounts, scheduled posts, posting results, and participants' email addresses and roles. One organization's data is not visible to people who do not belong to that organization. A participant who belongs to multiple organizations can see the data of each organization the participant belongs to, organization by organization.

The operator refers to an organization's name and its participants' email addresses and roles to create organizations, invite participants, and operate the service.

Cookies and advertising

The operator does not use third-party advertising. ikkatsup does not store cookies on your device for advertising.

In the admin console (app.ikkatsup.com), Cloudflare Access sets cookies on your device to keep you logged in. ikkatsup itself does not set cookies.

This public website has no code that sets cookies and loads no scripts.

9. Storage and security

We maintain technical and organizational safeguards to protect the information we collect against unauthorized access, use, disclosure, alteration, and loss.

• Encryption in transit: All communication between users and ikkatsup, and between ikkatsup and connected platforms, is encrypted with TLS (HTTPS).
• Encryption at rest: OAuth tokens are stored encrypted using industry-standard encryption, and the encryption keys are managed separately from the data. Other data, including videos, is kept in encrypted storage.
• Access control: Only participants who have been authenticated and invited to an organization can use ikkatsup. An organization's data is visible only to that organization's participants. Only an organization's administrators can connect or disconnect accounts and invite or remove participants.
• Access by our staff: Our staff read user data only with the user's consent, when necessary for security, or when required by law.
• Logs: Tokens are never recorded in operational logs. Records of scheduled-post processing are deleted within 30 days after processing ends, and operational logs within 7 days.

10. Retention

The method and deadlines for deletion are described in 11. Requesting deletion of data.

11. Requesting deletion of data

You can request deletion of the data stored in ikkatsup at any time. This section explains which data is deleted, how it is deleted, why it is deleted, and how to make a request.

Purpose of deletion

The purpose of deletion is to let users decide for themselves whether ikkatsup keeps their data.

Ways to delete data

There are two ways to delete data.

Disconnecting an account

An organization administrator can disconnect each connected account at any time from "SNS accounts" (SNS アカウント) in the admin console. When an account is disconnected, ikkatsup does the following.

1. It cancels the scheduled posts for that account that have not yet been published (drafts, scheduled, running, and those handed to a connected platform but not yet published). For YouTube, it deletes the video that ikkatsup uploaded (an unlisted or private scheduled post is not uploaded until its scheduled publication time, so before that time there is no video to delete). For TikTok and Instagram, ikkatsup cannot cancel a scheduled post that has been handed to the platform, so it may remain there; cancel it on the platform's own screen.
2. It deletes the execution records (Cloudflare Workflows) of that account's scheduled posts.
3. It revokes the stored tokens at the connected platform. Instagram has no API for revoking a token, so ikkatsup sends no revocation for Instagram.
4. It deletes everything for that account: the account identifier and display name, the tokens, videos and cover images, titles, captions, hashtags, scheduled posts, and posting results. A video that scheduled posts of other accounts also use remains until those scheduled posts are gone. A video that was only registered with ikkatsup and never used in a scheduled post is not deleted.

To post to that account again after disconnecting it, connect the account again.

Deletion request

Send an email to chefree@efoo.jp. In the request, state the organization's name and the scope you want deleted (all of the organization's data, or the data related to a specific account). Deletion requests are accepted only from an email address registered as an administrator of the organization. A participant who is not an administrator should make the request through an administrator of the organization.

Disconnecting an account deletes only the data of the account that was disconnected. It does not delete the organization name, the participants' email addresses and roles, the participants' records of agreement, or the data of other accounts. Deleting an organization's data as a whole requires a deletion request. Videos never used in a scheduled post are deleted when the organization's data as a whole is deleted.

The admin console shows the result of the token revocation as the result of disconnecting. If a revocation could not be sent to the connected platform (because the revocation failed, for example through a communication failure, or because the platform is Instagram), the admin console also shows how to revoke on the platform's side. Because ikkatsup erases the token when an account is disconnected, it does not retry a failed revocation later. How to revoke on the connected platform's side is described in 12. Revoking access.

Data that is deleted and how it is processed

When the operator receives a request, it deletes the following data within the requested scope from ikkatsup's database, the video storage, and the registry of organizations and participants. For the accounts concerned, it cancels scheduled posts, deletes their execution records, and sends the connected platforms a request to revoke the tokens (except for Instagram), in the same way as when an account is disconnected.

• Social media account identifiers and display names.
• OAuth access tokens and refresh tokens.
• Videos and cover images.
• Titles, captions, hashtags, scheduled posts, and posting results (including YouTube video IDs, public URLs, and upload session URIs).
• Reasons that token renewals and YouTube data re-fetches failed.
• Execution records for scheduled posts (Cloudflare Workflows; they may contain a YouTube upload session URI, a video ID, the post identifier and public URL that a connected platform returned, and the text of a failure reason).
• Organization names (only when the organization's data as a whole is deleted).
• Participants' email addresses and roles in that organization (only when the organization's data as a whole is deleted).
• Participants' records of agreement (only when the organization's data as a whole is deleted, and only for a participant for whom that organization was the last membership; the record of a participant who also belongs to another organization is not deleted).

A deletion request for a specific account deletes that account's data. It does not delete videos never used in a scheduled post, the organization name, participants' email addresses and roles, participants' records of agreement, or the data of other accounts.

Users cannot restore deleted data.

Deadline for deletion

The operator deletes the requested data within 7 calendar days of the deletion request. Data obtained from YouTube is deleted within the same deadline. Data deleted by disconnecting an account has already been deleted at the time of that operation.

When the deletion is finished, the operator notifies the requester by email. Recovery records may still hold the data from before the deletion for up to 30 days, even after the data has been deleted within 7 calendar days of the deletion request. For details, see 10. Retention.

Effect of deletion on data at connected platforms

Deleting data in ikkatsup does not affect content that has already been sent to a connected platform. For example, a video already published on YouTube remains on YouTube even after the data is deleted in ikkatsup.

Deleting data in ikkatsup also does not affect posts already published on TikTok and Instagram.

To delete content that remains on a connected platform, use that platform's own screens.

Data obtained from a photo and video sharing app

You can request deletion of data obtained from Instagram by the same methods as above. The data processed is the Instagram user ID, username, access token, the videos and post text posted to Instagram, and posting results. The purpose of processing is posting on an organization's instructions.

12. Revoking access

Users can revoke the permission that lets ikkatsup act on an account at a connected platform by the following methods.

From the ikkatsup admin console

An organization administrator disconnects the account from "SNS accounts" (SNS アカウント) in the admin console. ikkatsup sends YouTube and TikTok a request to revoke the stored tokens. What disconnecting does is described in 11. Requesting deletion of data.

From Google's security settings

The owner of the Google account that connected a YouTube channel can revoke ikkatsup's access on Google's security settings page, https://security.google.com/settings/security/permissions.

After access is revoked in Google's security settings, ikkatsup can no longer act on that channel. ikkatsup re-fetches the data it obtained from YouTube every day and updates it. Once access has been revoked, it can no longer re-fetch, so ikkatsup deletes all of that channel's data (the tokens, the channel ID and channel name, videos and cover images, titles, captions, hashtags, scheduled posts, the execution records of scheduled posts, and posting results) within 30 calendar days of the last time it could re-fetch. A video that scheduled posts of other accounts also use remains until those scheduled posts are gone. A video that was only registered with ikkatsup and never used in a scheduled post is not deleted. To have the data deleted without waiting 30 calendar days, disconnect the account in the admin console or request deletion by the method in 11. Requesting deletion of data.

Revoking on the connected platform's side

If the revocation of a token at the connected platform failed when you disconnected the account, and in the case of Instagram, revoke ikkatsup's access on the connected platform's side. The admin console shows the same information as the result of disconnecting.

• YouTube: revoke it on the Google security settings page above.
• TikTok: revoke ikkatsup on TikTok's "Manage app permissions" page.
• Instagram: revoke the permission for ikkatsup in your Instagram account settings.

ikkatsup cannot cancel a scheduled post on TikTok or Instagram. A post that was handed to the platform before you disconnected the account may remain there; cancel it on the platform's own screen. For YouTube, when the account is disconnected, ikkatsup deletes the video that it uploaded for a scheduled post that has not yet been published. An unlisted or private scheduled post is not uploaded until its scheduled publication time, so before that time there is no video to delete.

13. Contact

We accept questions and complaints about privacy, requests for deletion of data, and questions about revoking access at the following address.

Email

chefree@efoo.jp

Operator

efoo Inc.

Address

101 Kawahiro Bldg., 4-4-6 Igusa, Suginami-ku, Tokyo 167-0021, Japan

Other inquiries are described on the Contact page.

14. Changes to this policy

When the operator revises this policy, it publishes the revised content on this page and shows the date of publication as the effective date. The top of this page shows the date this policy was first effective and the date it was last revised.