Privacy notice · Social media management
Who we are
BRINLEZ PTY LTD (ACN 700 392 909), Australia. Contact: brinlez@brinlez.com.
Who this applies to
Businesses that hire Brinlez to manage their social media, and the people who connect their accounts on their behalf from the private link we send them.
What we handle
For each connected account: its id and public name, the permissions granted and the access keys the network issues, encrypted with AES-256-GCM under a dedicated key. The photos, videos and text we publish come from the client's own library and are published only after their approval. On the private link we keep, encrypted, the name, role and notes of whoever approves or asks for changes. We never store passwords, never read private messages or comments, never manage ads and never sell any data.
Why
Only to prepare, schedule and publish the content the client approves, and to check from time to time that the authorisation is still valid. No post goes out without a person approving it; YouTube also requires the account holder to approve each video before it is uploaded.
YouTube
This service uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service (youtube.com/t/terms). Google handles data under its Privacy Policy (policies.google.com/privacy). You can remove Brinlez's access from the private link or at any time in your Google account's security settings (security.google.com/settings/security/permissions).
Google user data we access
When a client connects YouTube, Brinlez asks Google for exactly two permissions: youtube.upload (to upload videos to the connected channel) and youtube.readonly (to read the connected channel's id, name and handle, so the client can confirm which channel they connected and so we can check the authorisation is still valid). With them Brinlez accesses only: the channel id, name and handle; the access and refresh tokens Google issues; and, for each video Brinlez uploads, the video id and link YouTube returns. Brinlez does not read the channel's other videos, comments, messages, subscribers or analytics, nor any other Google account data, and never asks for the Google password.
How we use Google user data
Only to provide the feature the client asks for: showing which channel is connected; uploading to that channel the videos the account holder approved, one by one, with the title, description, thumbnail, schedule and settings they approved; and checking from time to time that the authorisation is still valid. We do not use Google user data for advertising, profiling, selling, credit decisions, or to train artificial intelligence or machine learning models. People at Brinlez do not read it, except when the client asks for support, for security, or to comply with the law.
Who we share Google user data with
We do not sell, rent, share or disclose Google user data to third parties. It is transferred only: to Google/YouTube itself, when we upload a video the account holder approved; to the infrastructure providers that store it for us under contract and may not use it for themselves — Vercel and Upstash (United States, encrypted authorisations) and Cloudflare R2 (prepared media); and when the law requires it. If Brinlez were ever merged or sold, we would ask for explicit consent before transferring it.
How we protect, keep and delete Google user data
Tokens are encrypted with AES-256-GCM under a dedicated key, travel only over HTTPS and are never shown to anyone. They are kept only while the channel stays connected. When the client disconnects (from the private link, through Brinlez, or by removing Brinlez in their Google account's security settings security.google.com/settings/security/permissions), we revoke the token at Google and delete it from Brinlez at once; anything left is deleted within 7 days. Channel data is refreshed or deleted at least every 30 days. To ask for deletion at any time, write to brinlez@brinlez.com.
Limited Use
Brinlez's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Facebook and Instagram
You can remove Brinlez in Facebook or Instagram (Settings › Apps and websites or Business integrations). If you ask Meta to delete your data from Brinlez, Meta tells us and we delete it immediately; you can check the status with the code you receive.
Where it is stored
Authorisations and the calendar in Upstash (United States) through Vercel (United States); the prepared image versions in Cloudflare R2 (Oceania location preference). Published content stays on each network under its own policies.
How long
Access keys for as long as the account stays connected: on disconnection they are revoked at the network where it allows it and deleted from Brinlez at once; anything left is deleted within 7 days. Data obtained from the networks is refreshed or deleted at least every 30 days. Decisions on the private link are kept encrypted for 12 months as a record of what was approved.
Access, correction and complaints
You can ask for access, correction or deletion by writing to brinlez@brinlez.com. If you think we haven't handled your information properly, write to us first; if you're not satisfied, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).