Privacy Policy

Last updated: October 23, 2026

Agency OS ("we", "us") is a content management platform that lets marketing agencies manage their clients' social media accounts, content calendars, and analytics from one system. This policy explains what data we collect, how we use it, and how you can control it.

Data we collect

  • Account data: your name, email address, and role within your agency.
  • Client and content data you create in the product: clients, brands, calendar entries, drafts, captions, media files you upload, campaigns, and reports.
  • Connected social platform data: when you connect an Instagram, Facebook, TikTok, YouTube (Google), or LinkedIn account, we receive an access token and basic profile/account metrics (follower counts, recent posts, and engagement metrics) via that platform's official API, scoped to what's needed to publish content and show analytics on your behalf.
  • Chat messages between your agency and its clients, and comments on content, which we store so both sides can read them.
  • Public data of other professional accounts (for example followers and posts of competitors your agency chooses to track), obtained through the official APIs and only shown to your agency.

How we use platform data

Data obtained from Meta (Instagram/Facebook) and TikTok is used solely to provide the features you request inside Agency OS: publishing or scheduling the content you author, and displaying account metrics and recent posts back to you and your team. We do not sell this data, use it for advertising, or share it with third parties outside of the infrastructure providers (database and file storage) that run the application on our behalf.

Providers that process data on our behalf

To run the service we use database and storage (Supabase), hosting (Vercel), email delivery (Resend) and, when your agency uses the artificial-intelligence features, an AI provider (Anthropic). Only the text needed for the task you request is sent to the AI (for example a report's figures and the brand's texts to draft a summary); it is not used to train models or for advertising. These providers act on our behalf and may not use the data for their own purposes.

Storage and security

Access and refresh tokens for connected accounts are encrypted at rest (AES-256-GCM) and are never exposed to the browser or to any client-side code. All data is stored in a managed Postgres database and object storage bucket restricted to your account's tenant. We take daily backups of the database and keep them for 14 days; deleted data can remain in those backups until they expire.

Disconnecting an account and data deletion

You can disconnect any connected Instagram, Facebook, TikTok, YouTube, or LinkedIn account at any time from that client's Social Accounts page — this immediately erases the access token we store for it, and removing the account also deletes its synced metrics and posts. To request full deletion of your agency's data, or any data associated with a specific connected social account, email bqstudio176@gmail.com from the email address on your account. We will delete the requested data within 30 days and confirm by email once complete. Step-by-step instructions are also at /data-deletion.

Contact

Questions about this policy can be sent to bqstudio176@gmail.com.