Privacy Policy

This page is maintained by WYREIT APP LTD to explain how WyreIt handles personal data. WyreIt is a social media management application operated by WYREIT APP LTD, Company No. 17283422, registered in England and Wales.

For the purposes of UK GDPR and the Data Protection Act 2018, WYREIT APP LTD is the data controller for personal data collected through this application and website ( wyreit.app).

Data controller: WYREIT APP LTD (Company No. 17283422), registered in England and Wales, contactable at hello@wyreit.app.

ICO registration number: ZC195947 — WYREIT APP LTD is registered with the Information Commissioner’s Office as a data controller (registered 11 July 2026; renewable 10 July 2027).

This policy is app-owned content and is not an independent legal certification. It reflects the practices WYREIT APP LTD has enabled in the app. If you need legal advice, please consult a qualified professional.

We collect only the data necessary to provide the WyreIt service:

• Account information: Your name, email address, and authentication credentials managed by our auth provider when you register for WyreIt.
• Platform connection tokens: OAuth access tokens and secrets that allow WyreIt to post on your behalf to connected platforms (such as TikTok, X, Instagram, Facebook, YouTube, WhatsApp, and Messenger). These are stored in our database and are not kept in your browser.
• Posts and content: The text, images, videos, and scheduling details you enter so we can publish or schedule them through your connected platforms.
• Usage and technical data: Basic analytics about which features you use, together with your IP address, browser type, and operating system collected automatically when you access wyreit.app. This helps us improve the app and keep it secure.

Under UK GDPR we must have a lawful basis for processing your personal data. Depending on the activity, we rely on one or more of the following:

• Performance of a contract: to provide the WyreIt service you sign up for — creating and running your account, connecting your platforms, and publishing or scheduling the content you ask us to.
• Legitimate interests: to operate, secure, and improve the service — including troubleshooting, preventing abuse and fraud, and understanding how features are used — balanced against your rights and freedoms.
• Consent: where required, for example optional marketing communications or non-essential cookies. You can withdraw consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.

We use the data we collect for the following purposes:

• To provide the service: Authenticating your account, connecting to your social platforms, and enabling you to publish and schedule posts across platforms.
• To improve the app: Analysing usage patterns to fix bugs, improve features, and make the service more reliable.
• To contact you: Sending you important service updates and security alerts. We will only send marketing emails with your explicit consent, and you can unsubscribe at any time.
• To comply with legal obligations: Retaining records where required by law and responding to lawful requests from authorities.

Each use has a lawful basis under UK GDPR, such as contract, legitimate interests, or legal obligation. Where we rely on consent, you can withdraw it at any time.

WyreIt uses trusted third-party services (sub-processors) to host, process, and deliver the app. These services act as data processors or independent controllers for their own platforms. We review their privacy practices before integration and only share the minimum data needed. The list below sets out each sub-processor, what it does, and where it is located.

• Supabase — database, authentication, and file storage for account and platform token data; hosted in the EU (Frankfurt). See supabase.com/privacy.
• Render — backend application hosting; United States.
• Vercel — frontend hosting and content delivery (CDN); United States.
• Stripe — payment processing for subscriptions; we do not store your full payment card details; United States / global. See stripe.com/privacy.
• Anthropic — AI features (caption generation, in-app assistant, and support chat); United States.
• Resend — transactional and notification email; United States.
• Cloudinary — media (image and video) hosting and processing for content you attach to posts; United States / global. See cloudinary.com/privacy.
• Google (YouTube Data API) — publishing to, and analytics from, a connected YouTube channel; United States. See section 14 for the Google-specific disclosures.
• TikTok — social platform integration. See TikTok Privacy Policy.
• X — social platform integration. See X Privacy Policy.
• LinkedIn — social platform integration for publishing and analytics on your connected account. See LinkedIn Privacy Policy.
• Bluesky — social platform integration for publishing to your connected account. See Bluesky Privacy Policy.
• Meta (Facebook, Instagram, Messenger, WhatsApp) — social platform integrations. See Meta Privacy Policy.

When you authorise a social platform connection, you are granting WyreIt permission to act within the limits of the permissions you approve via that platform's OAuth flow. Each platform's own terms and privacy policy apply independently.

We do not sell your personal data or share it with advertisers or data brokers.

Your data is stored primarily in the European Union (Supabase, Frankfurt). Some sub-processors listed above are located in the United States, so your data may be transferred there.

Where data is transferred outside the UK/EEA we rely on appropriate safeguards — the UK International Data Transfer Agreement (IDTA) or Addendum, the EU Standard Contractual Clauses, or, for US providers certified under it, the UK Extension to the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards by contacting us at hello@wyreit.app.

We may share data only in the following limited circumstances:

• Service providers: The third parties listed above that help us operate WyreIt, bound by contract to process your data only as instructed.
• Legal requirements: If required by law, court order, or governmental authority, we may disclose your data. We will notify you where legally permitted to do so.
• Business transfer: In the event of a merger, acquisition, or sale of WYREIT APP LTD, your data may be transferred to the acquiring party. You will be notified in advance and given the option to delete your account.

Your data is stored in Supabase, our database and authentication provider. Supabase applies industry-standard security measures, including encryption of data in transit and at rest, and access controls on production infrastructure.

WYREIT APP LTD applies its own access controls on top of the hosting provider: platform tokens are stored in our database and are never logged in plain text, and we do not read or store the content of your private messages. However, security is a shared responsibility: you are responsible for keeping your account credentials safe and only connecting platforms you control.

No system can guarantee complete security. If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with UK GDPR requirements.

This Privacy Policy is governed by the laws of England and Wales. We keep your data only for as long as necessary for the purposes described in this policy:

• Account and profile data: Retained for the life of your account. When you delete your account, this data is removed from our live systems and purged from encrypted backups within 30 days, unless a legal obligation requires us to keep it longer.
• Platform tokens: Removed when you disconnect a platform or delete your account.
• Posts and scheduled content: Retained so you can view your history in the app; deleted when you delete your account or the relevant content.
• Billing records (Stripe): Invoice and payment records are retained for 6 years to meet UK tax and accounting law.
• Usage and technical logs: Retained for a limited period to support security and troubleshooting, then anonymised or deleted.
• Legal records: Where required by law, we keep data only for the minimum legally required period.

Under UK GDPR, you have rights regarding your personal data. You can exercise any of these by contacting us at hello@wyreit.app:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”): Request deletion of your personal data, subject to any legal retention obligations.
• Right to restrict processing: Ask us to pause processing your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.

We will respond to all data-rights requests within 30 days.

WyreIt uses a minimal number of cookies and similar technologies to keep the service functional:

• Essential cookies: Required for authentication and core app features. These are always on because the service cannot function without them.
• Non-essential cookies (e.g. analytics): Anonymous usage data to help us understand how the app is used. These are set only with your consent.

You can give or withdraw consent for non-essential cookies at any time using the in-app cookie consent control. Where a separate cookie notice exists, it is linked from that control.

We do not use advertising cookies, tracking pixels, or third-party marketing cookies, and we do not participate in cross-site tracking for advertising purposes.

WyreIt is not directed at children and is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe someone under 18 has created an account, please contact us at hello@wyreit.app and we will delete the account and associated data without delay.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or the law. When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email at least 14 days before the changes take effect.

Your continued use of WyreIt after the effective date of any changes constitutes acceptance of the updated policy.

When you connect a YouTube channel, WyreIt uses YouTube API Services. By connecting YouTube, you agree to be bound by the YouTube Terms of Service, and you acknowledge that Google’s use of your information is governed by the Google Privacy Policy.

WyreIt accesses YouTube data only for your own connected channel, and only to provide features you actively use:

• Publishing videos that you create and submit in our composer, to your own channel.
• Reading your channel name so you can confirm which channel is linked, and reading the comments left on your own videos so we can show them in your engagement inbox.
• Posting replies that you compose, to comments on your own videos.

We do not access, collect, or store data about other people’s channels, and we never use YouTube data for advertising, resale, scraping, or bulk data harvesting. We store the OAuth tokens needed to maintain your connection; comment data is retrieved as needed to populate your inbox and is not sold or shared. YouTube-derived data is retained only while your channel is connected.

You can revoke WyreIt’s access to your YouTube data at any time by disconnecting YouTube on your WyreIt Connect page, or through the Google security settings page at security.google.com/settings/security/permissions. On disconnection, we delete the stored tokens for that channel.

Google user data disclosures. The following applies specifically to data WyreIt receives from Google APIs:

• Access: with your authorisation, and limited to the scopes you grant, WyreIt accesses your Google/YouTube data as follows:
  • youtube.upload — to publish a video you have composed to your own YouTube channel.
  • youtube.readonly — to read your channel and video metadata (subscriber, view and video counts, and per-video views, likes and comment counts) so we can display your analytics back to you.
  • youtube.force-ssl — to read the comments left on your videos and to publish your replies to them from within WyreIt.
  We do not request any other Google scopes, and we do not access Gmail, Drive, Photos, Chat or any other Google service.
• Use: solely to provide the features you request — publishing and scheduling videos, displaying your channel and video analytics, and reading and replying to comments on your videos. It is not used for advertising, credit or lending purposes, and it is never sold. Google user data is not used to develop, improve or train AI or ML models, and is not transferred to any third-party service that would do so.
• Sharing: not transferred or sold to third parties; it is processed only by the sub-processors listed above that are needed to run the service.
• Protection: encrypted in transit (TLS) and at rest. Your Google OAuth tokens are additionally encrypted at rest with AES-256-GCM and are held server-side only — they are never exposed to your browser, never placed in a URL, and never returned to the client. Access is controlled by per-user authentication (a verified identity token on every request) and database row-level security, and our servers set strict HTTP security headers.
• Retention & deletion: we keep your Google data only for as long as your YouTube channel is connected and your account is open (see section 9). Disconnecting YouTube deletes the stored tokens for that channel immediately. You can permanently delete your account at any time from Settings → Danger zone → Delete account, or by emailing hello@wyreit.app. On deletion we revoke WyreIt’s access to your Google account directly, by calling Google’s OAuth revocation endpoint, delete all stored Google tokens and data, remove your uploaded files, and delete your account. You may also revoke our access yourself at any time in your Google Account permissions. Billing invoices are retained for approximately six years because UK tax law requires it; they contain no Google user data.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or need to report a concern, please contact us: