Privacy policy

Last updated 26 October 2026

The short version

We use your data only to schedule and publish the posts you ask for, and to show you how they did.
We never sell your data, show you ads, or share it with anyone except the platform you choose to post to and the providers that run Onslot for us.
Your uploaded media is deleted 14 days after it is posted. Platform tokens are deleted when you disconnect the account.
Everything is stored in Google Cloud (Firebase) in the European Union.
You can delete your account and all its data at any time. See Delete your data.

1. Who is responsible

Onslot is a service run by Nicolas Frugoni, trading as Frusoft, based in Barcelona, Spain. He is the data controller for the personal data described in this policy. You can reach him at hello@frusoft.dev for anything about your data, including the requests in section 16.

In this policy, "Onslot", "we" and "us" mean that controller. "You" means anyone who uses the Onslot website, joins the waitlist, or uses the Onslot app.

2. What this policy covers

This policy covers the website at onslot.frusoft.dev, the Onslot web app, and the Onslot MCP server. It covers the data of people who use Onslot. Onslot does not collect data about your followers or viewers beyond the aggregate numbers described in section 3.

3. What we collect and why

Data	What it is	Why we need it	Legal basis (GDPR)
Your Onslot account	Email address, name, profile picture and user identifier from the sign-in method you use; your time zone and language; the workspaces you belong to and your role in them.	To sign you in, keep your posts separate from other people's, and show times in your zone.	Performance of a contract (Art. 6(1)(b))
Connected platform accounts	For each Instagram, YouTube or TikTok account you connect: the account's name, username, identifier and profile picture, the permissions you granted, and the access and refresh tokens the platform gives us.	To publish to that account on your behalf and show you which account a post goes to.	Performance of a contract
Your content	The videos and photos you upload, captions, titles, first comments, the platforms and post type you pick, and the scheduled time.	To publish the post you asked for, when you asked for it, and to show you previews.	Performance of a contract
Post results	For each publish attempt: the status, the time, the post's identifier and link on the platform, and any error the platform returned.	To tell you whether a post went out, link you to it, and retry or explain failures.	Performance of a contract
Statistics	Follower or subscriber counts of the connected accounts, and the views, likes, comments and shares of the posts you published through Onslot, as reported by each platform.	To show you how your posts and accounts are doing.	Performance of a contract
Technical logs	IP address, browser type, request times and errors, kept by our hosting provider.	To keep the service secure, prevent abuse, and fix bugs.	Legitimate interest (Art. 6(1)(f))
Messages you send us	Emails to hello@frusoft.dev and anything you include in them.	To answer you.	Legitimate interest, or contract when it is about your account

We do not collect passwords for Instagram, YouTube or TikTok. You sign in on each platform's own page and the platform gives Onslot a token limited to the permissions you approve. We do not collect payment details during the beta.

4. YouTube API Services

Onslot uses YouTube API Services to upload Shorts to your channel and to read basic channel and video information. By connecting a YouTube channel to Onslot you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

When you connect a channel, Onslot asks Google for permission to:

upload videos to your channel and set their title, description and privacy status (scope youtube.upload);
read your channel's name, identifier and subscriber count, read the view, like and comment counts of the videos Onslot uploaded, and post the first comment you write (scope youtube.force-ssl).

Onslot stores the channel's name and identifier, the tokens, the identifiers of the videos it uploaded and their statistics. It uses this information only to publish what you schedule and to show you the results. Statistics obtained from YouTube are refreshed or deleted at least every 30 days. If you disconnect the channel in Onslot or revoke Onslot's access in Google, Onslot deletes the tokens immediately and the rest of the data it obtained from YouTube within 7 days.

You can revoke Onslot's access to your Google account at any time on the Google security settings page (also reachable at security.google.com/settings/security/permissions).

Onslot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial intelligence models, and no person at Onslot reads it except with your permission to help with a problem you reported, for security reasons, or when the law requires it.

5. Instagram

Onslot publishes to Instagram professional accounts (Business or Creator) through the Instagram API with Instagram Login, provided by Meta. When you connect an account, Onslot asks for permission to read the account's basic profile, publish Reels, photos, carousels and Stories, publish the first comment you write, and read insights for the account and for the posts it published. Meta's handling of your data is described in the Instagram Privacy Policy, and your use of Instagram is subject to the Instagram Terms of Use.

You can remove Onslot's access from Instagram at any time: in the Instagram app go to Settings, then Apps and websites, and remove Onslot. If you do, Onslot can no longer publish to that account and deletes the tokens and the data it obtained from Instagram as described in section 12. Meta may also send us a deletion request on your behalf, which we handle the same way.

6. TikTok

Onslot uses TikTok's Login Kit and Content Posting API. When you connect an account, Onslot asks for permission to read your basic profile and public statistics (display name, avatar, follower count, and the counts of your videos), and to send videos to your TikTok inbox as drafts. Onslot does not publish to TikTok directly: you open the draft in TikTok, edit it if you want, and post it yourself. TikTok's handling of your data is described in the TikTok Privacy Policy.

You can remove Onslot's access in the TikTok app: Profile, then Menu, then Settings and privacy, Security and permissions, Apps and services permissions, and remove Onslot.

7. Claude and the MCP server

Onslot offers an MCP server so you can ask an AI assistant such as Claude to list, draft, schedule and cancel posts in your workspace. You connect it yourself and approve it in your Onslot account. When you use it, Onslot sends your assistant the information it asks for on your behalf (for example your scheduled posts and their captions). What the assistant does with that information is governed by its provider's terms and privacy policy, not this one. Onslot keeps a record of the actions taken through the MCP server, the same way it does for actions in the app. You can disconnect the assistant from your Onslot settings at any time, which invalidates its access immediately.

8. The waitlist

If you join the waitlist on this website, we store the email address, the optional name, what you told us you post, and the language of the page, with the date. We use them only to send you an invite and, if it is useful, a short question about how you post. We don't send newsletters or marketing. The legal basis is your consent, which you can withdraw at any time by emailing hello@frusoft.dev. We delete waitlist entries when you are invited and create an account, when you ask, or after 12 months, whichever comes first.

9. How we use data

We use the data above only to:

publish the posts you schedule, to the accounts and at the times you choose;
show you your calendar, previews, post results and statistics;
tell you when something needs your attention, such as a failed post or an expired connection;
keep Onslot secure and working, and fix problems you report;
meet legal obligations.

We do not sell personal data. We do not use it for advertising or profiling. We do not use your content or data from Google, Meta or TikTok to train artificial intelligence models.

The platform you post to. When a post goes out, Onslot sends that platform the media, caption and settings for that post, and nothing else. Instagram content goes only to Meta, YouTube content only to Google, TikTok content only to TikTok.
Service providers that run Onslot for us. Google Cloud and Firebase (Google Ireland Limited) host the app, database and file storage. If we send you an email, such as an invite, we use an email delivery provider. These providers process data only on our instructions under data processing agreements.
Other members of your workspace. If you invite people to a workspace, they can see that workspace's posts, connected accounts (but never the tokens) and statistics.
Authorities, when the law requires it, and only what it requires.

If Onslot is ever sold or merged into another company, we will tell you before your data moves and give you the chance to delete it.

11. Where it is stored

Onslot stores data in Google Cloud (Firebase) in the European Union: the database in Google's multi-region eur3 (Belgium and the Netherlands), files and server code in europe-west1 (Belgium). Google may access data from other countries to operate its infrastructure; those transfers are covered by the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework. When Onslot publishes a post, the platform receiving it stores it under its own policy, which may be outside the EU.

12. How long we keep it

Data	Kept until
Uploaded videos and photos	14 days after the post is published to all its platforms. If you delete a post before it goes out, its media is deleted right away. Media of a post that failed and was never published is deleted 14 days after its scheduled time.
Access and refresh tokens	Until you disconnect the account in Onslot, the platform revokes them, or you delete your Onslot account. They are deleted immediately at that point.
Captions, schedule, post results	While your account exists, so your calendar and history keep working. You can delete any post at any time.
Statistics	While the account stays connected. YouTube statistics are refreshed or deleted at least every 30 days. All statistics of an account are deleted within 7 days of disconnecting it.
Your Onslot account and workspaces	Until you delete them. Deletion is completed within 30 days, including backups.
Technical logs	30 days.
Waitlist entries	Until you are invited, you ask, or 12 months pass.
Emails with us	As long as needed to help you, and at most 2 years.

13. Disconnecting and revoking access

You can disconnect any platform account from Onslot's settings. You can also revoke Onslot's access directly with each platform, which has the same effect:

Google and YouTube: myaccount.google.com/permissions, choose Onslot, then remove access.
Instagram: Settings, then Apps and websites, then remove Onslot. On the web: instagram.com/accounts/manage_access.
TikTok: Settings and privacy, then Security and permissions, then Apps and services permissions, then remove Onslot.

Once access is revoked, scheduled posts for that account will not be published, and the data is deleted as described above.

14. Deleting your account and data

You can delete a workspace or your whole account from Onslot's settings, or by emailing hello@frusoft.dev from the address on your account. We delete the account, its workspaces you own, connected accounts and tokens, posts, media, results and statistics within 30 days, including backups, and email you when it's done. Posts already published stay on the platforms: delete them there if you want them gone. The full steps are on the Delete your data page.

15. Security

Data is encrypted in transit (HTTPS) and at rest. Platform tokens are only readable by Onslot's servers, never by the browser or by other members of your workspace. Access to production data is limited to the controller, protected by two-factor authentication, and used only to operate the service or help with a problem you report. If a breach affects your personal data, we will notify the AEPD within 72 hours where required and tell you without undue delay.

16. Your rights

Under the General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD) you have the right to:

access the personal data we hold about you and get a copy;
correct data that is wrong or incomplete;
have your data deleted;
restrict or object to how we process it, including processing based on legitimate interest;
receive your data in a portable, machine-readable format;
withdraw consent at any time, without affecting what was done before.

Email hello@frusoft.dev to use any of these rights. We answer within one month. We may ask you to confirm the request from the email on your account so nobody else can ask for your data.

If you think we have not handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es, or to the authority of the EU country where you live. We'd appreciate the chance to fix it first.

17. Children

Onslot is not for children. You must be at least 16 years old to use it, and old enough to hold accounts on the platforms you connect. If we learn that a child under 16 has an account, we delete it.

18. Cookies and local storage

This website sets no cookies and uses no analytics or tracking. It stores one setting in your browser, your light or dark theme choice, which never leaves your device. The Onslot app uses the browser storage it needs to keep you signed in. Neither uses advertising or third-party tracking cookies. Fonts are served from our own domain.

19. Changes to this policy

If we change this policy, we update the date at the top. If a change affects how we use data you already gave us, we will email account holders at least 14 days before it takes effect.

20. Contact

Nicolas Frugoni (Frusoft), Barcelona, Spain. Email: hello@frusoft.dev.