Privacy Policy

Last updated: 30 August 2026

1. Who we are

PicPlanr is a social media content planning and publishing tool operated by Health Hub Studios (Scotland) Limited, a company registered in Scotland (company number SC595494).

For the purposes of UK data protection law, Health Hub Studios (Scotland) Limited is the data controller for the personal information described in this policy.

In this policy, "we", "us" and "our" mean Health Hub Studios (Scotland) Limited. "You" means anyone using PicPlanr, whether on a paid plan or a free trial.

2. What this policy covers

This policy covers:

• picplanr.com — our marketing website

• picplanrapp.com — the PicPlanr application

• The social media accounts you choose to connect to PicPlanr

It explains what we collect, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

3. Information we collect

3.1 Information you give us

• Name and email address — to create and secure your account, and to contact you about it.

• Password — to sign you in. Stored only as a cryptographic hash. We never see or store the password itself.

• Business or brand details you enter — so generated content reflects your business.

• Photos, videos and captions you upload — these are the posts you are planning and publishing.

• Past posts or website addresses you supply for brand voice analysis — to learn your writing style, so captions sound like you.

• Payment details — handled entirely by Stripe. We never receive or store your card number.

3.2 Information we collect automatically

• Basic technical information such as IP address, browser type and device type

• Pages viewed within the application and actions taken, so we can find and fix faults

• Records of when posts were scheduled, published, or failed to publish

3.3 Information we receive from platforms you connect

When you connect a social media account, we receive information from that platform. This is set out in detail in sections 4 and 5.

4. Social media accounts you connect

PicPlanr's purpose is to publish to social media on your behalf. To do that, you authorise us to act for you on the platforms you choose. We support Instagram, Facebook, TikTok, LinkedIn, YouTube and Google Business Profile.

When you connect an account:

• The platform, not PicPlanr, asks for your username and password. We never see your social media passwords.

• The platform gives us an access token — a credential that lets PicPlanr act for you within the permissions you granted.

• Access tokens are encrypted before they are stored and are used only to perform actions you have asked for.

You can disconnect any account at any time from the Connected accounts page. Disconnecting revokes the token and stops all access immediately. You can also revoke PicPlanr's access from the platform's own settings, as set out below.

What we receive, and what we do with it, differs by platform.

4.1 Instagram and Facebook

What we access: the professional Instagram account or Facebook Page you select, its username and display name, its profile description, your recent posts and their captions, and engagement figures for posts published through PicPlanr.

What we do with it: publish the images, carousels and Reels you have scheduled; read your existing captions if you ask us to analyse your brand voice; and show you likes, comments and shares on posts published through PicPlanr.

What we cannot do: we cannot read your direct messages, see who follows you, view your private activity, or post to accounts you have not connected.

To revoke access: Instagram — Settings → Apps and websites. Facebook — Settings → Business integrations.

4.2 TikTok

What we access: your username and display name, and permission to upload videos to your account.

What we do with it: publish the videos you have scheduled, using the cover frame and caption you chose.

What we cannot do: we cannot read your direct messages, your viewing history, or your private drafts.

To revoke access: TikTok — Settings and privacy → Security and permissions → Manage app permissions.

4.3 LinkedIn

What we access: your name and profile identifier, and permission to post on your behalf.

What we do with it: publish the posts you have scheduled to your personal LinkedIn profile.

What we cannot do: we cannot read your connections, your messages, or your feed. We cannot post to LinkedIn Company Pages — LinkedIn does not make that available to us, so a Page post must still be made on LinkedIn itself.

To revoke access: LinkedIn — Settings → Data privacy → Permitted services.

4.4 YouTube and Google Business Profile

These are covered in full in section 5 below.

5. Google user data

This section describes our use of data from Google accounts, including YouTube, and applies in addition to the rest of this policy.

5.1 What we access

If you connect a YouTube channel or Google Business Profile, we request only the permissions needed to do what you have asked. For YouTube this is the ability to upload videos to your channel on your behalf. For Google Business Profile it is the ability to publish posts to the profile you select.

We do not request access to your Gmail, your Google Drive, your Google contacts, your calendar, or your Google search history, and we cannot read any of them.

5.2 How we use it

Google user data is used for one purpose only: to publish the content you have created in PicPlanr to the Google or YouTube account you connected, at the time you scheduled it. We also read back basic engagement figures for posts published through PicPlanr, so we can show you how they performed.

5.3 Who we share it with

We do not sell Google user data. We do not share it with advertisers, data brokers, or any third party for advertising, marketing or profiling purposes.

Google user data is disclosed only to the service providers listed in section 6, and only where necessary to operate PicPlanr:

• Supabase — stores your encrypted YouTube access token and the record of your scheduled and published posts

• Vercel — hosts the application code that transmits your video to YouTube at the moment of publishing

No other third party receives Google user data. In particular:

• Google user data is never sent to OpenAI or any other AI provider. Captions are generated from the text and images you provide, before any connection to Google is involved.

• Google user data is never used to train any machine learning or AI model, whether ours or anyone else's.

5.4 Human access

No member of our staff reads your Google user data as a matter of routine. A person may access it only where you have asked us for support and access is needed to resolve your problem, where we are required to by law, or where it is necessary to investigate a security incident or abuse.

5.5 How long we keep it

Your access token is kept for as long as the account is connected. When you disconnect a Google or YouTube account, or delete your PicPlanr account, the token is revoked and deleted. Records of posts already published are retained as described in section 8.

5.6 Limited Use

PicPlanr's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5.7 Your control over Google access

• You can disconnect the account inside PicPlanr at any time, from the Connected accounts page.

• You can revoke PicPlanr's access directly from your Google account at any time, at myaccount.google.com/permissions.

By connecting a YouTube channel you are also agreeing to the YouTube Terms of Service. Google's own handling of your information is described in the Google Privacy Policy.

6. Who we share your data with

We share personal information only with the service providers below, each of which is bound by contract to protect it and to use it only to provide their service to us.

• Vercel Inc. — hosts the PicPlanr application. Receives technical request data, and content in transit while the application is running.

• Supabase Inc. — database and account authentication. Receives your account details, business details, scheduled and published posts, uploaded media, and encrypted platform access tokens.

• Stripe, Inc. — payments and subscription billing. Receives your name, email address and payment details. Stripe acts as an independent controller for payment data; see the Stripe Privacy Policy.

• OpenAI, L.L.C. — generates captions, content ideas and brand voice analysis. Receives the text and images you submit for generation, and the brand details you have entered. OpenAI states that data submitted through its API is not used to train its models. See section 7.

• Resend — sends account and notification emails from notifications@picplanrapp.com. Receives your name and email address, and the content of the email being sent.

• Meta Platforms, Inc. — Instagram and Facebook publishing. Receives the posts you publish to those platforms.

• TikTok Ltd. — TikTok publishing. Receives the posts you publish to TikTok.

• LinkedIn Corporation — LinkedIn publishing. Receives the posts you publish to LinkedIn.

• Google LLC / YouTube — YouTube and Google Business Profile publishing. Receives the posts and videos you publish to those services. See section 5.

We may also disclose information where we are required to by law, court order, or a valid request from a public authority; or where necessary to establish, exercise or defend legal claims.

We do not sell your personal information, and we do not share it with advertisers or data brokers.

7. Artificial intelligence and generated content

PicPlanr uses OpenAI's API to generate captions, suggest content ideas, and analyse writing style.

• The material sent for generation is the content you provide: captions and images you upload, business details you enter, and any past posts or website address you supply for brand voice analysis.

• Data connected to your Google or YouTube account is never sent to OpenAI.

• OpenAI states that data submitted through its API is not used to train its models. We do not use your content to train any model of our own.

• Generated captions are suggestions. Nothing is published until you schedule or publish it.

8. How long we keep your information

• Account information — for as long as your account is open.

• After you delete your account — personal data is deleted within 30 days, other than the records below.

• Access tokens — deleted immediately when you disconnect an account or close your account.

• Invoices and payment records — retained for 6 years, as required by UK tax law.

• Backups — deleted data may persist in encrypted backups for a short period before those backups expire.

9. Where your data is stored

Our service providers operate internationally, and some are based in the United States. Where personal information is transferred outside the United Kingdom, that transfer is covered by appropriate safeguards — such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses — as required by UK data protection law.

10. Your rights

Under UK data protection law you have the right to:

• Access the personal information we hold about you

• Correct information that is inaccurate or incomplete

• Delete your information (the "right to erasure")

• Object to or restrict how we use it

• Portability — receive your information in a machine-readable format

• Withdraw consent at any time, where our use is based on consent

To exercise any of these rights, contact us using the details in section 11. We will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

11. Contact us

Health Hub Studios (Scotland) Limited
Company number SC595494
1037 Sauchiehall Street, Glasgow, Scotland, G3 7TZ

Email: privacy@picplanr.com

12. Cookies

PicPlanr uses cookies and similar technologies only where necessary to run the service — keeping you signed in, remembering your preferences, and keeping your session secure.

We use Vercel Analytics to understand which pages are used. It does not use cookies to track individuals across other websites, and does not build advertising profiles.

We do not use advertising cookies, and we do not allow third parties to place advertising cookies on our sites.

13. Children

PicPlanr is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

14. Changes to this policy

If we make a material change to this policy — particularly to who we share data with, or what we do with it — we will tell you by email and update the date at the top before the change takes effect.