How Baciio handles your data

Baciio is a social media scheduling service. To publish for you we need access to your social accounts, and this page explains exactly what that involves. Effective October 14, 2026.

Who we are

Baciio (“we”, “us”) operates the service at https://baciio.com and the Baciio app. We are the data controller for the personal data described here. You can reach us at privacy@baciio.com for anything about privacy.

What we collect

Information you give us

Your name, email address and a password, which we store only as a salted hash.
Workspace names, team members you invite, and the timezone you choose.
The posts you write, the images and videos you upload, labels, comments and approval notes.
Billing details, which are handled by our payment processor. We never see your full card number.

Information from the social networks you connect

When you connect an account on Facebook, Instagram, Threads, LinkedIn, TikTok, YouTube, Pinterest, Google Business Profile, Bluesky, Mastodon, Telegram or X, the network sends us the following through its official API, with your permission:

The account’s ID, name, username and profile picture, so you can tell your accounts apart.
An access token that lets us publish on your behalf. Tokens are encrypted at rest with AES-256-GCM and are never shown in the app.
The list of pages or profiles you manage, so you can pick which ones to connect.
The posts we published for you, and their public metrics (reach, views, likes, comments, clicks) so we can show analytics.
Comments and replies on those posts, only if you turn on the inbox feature for that account.

We only request the permissions the feature you use needs. We do not read your private messages unless you explicitly enable the inbox for that account, and we never post anything you did not schedule.

Information collected automatically

Standard server logs: IP address, browser type, the pages and API endpoints you call, and timestamps. Kept for 30 days.
A session cookie that keeps you signed in. We do not use advertising cookies or third-party trackers.

Why we use it

To publish your posts to the networks at the time you chose, and to retry or tell you when a post fails.
To show previews, calendars, approvals and analytics inside the app.
To keep your account secure, prevent abuse, and meet each network’s platform policies.
To email you about failed posts, expiring connections, billing and changes to the service. Emails about failed posts and expiring connections can be turned off per workspace; billing and security emails cannot.

We do not sell personal data, and we do not use your data or your audience’s data for advertising.

Meta platforms: Facebook, Instagram and Threads

Baciio uses the Facebook Pages API, Instagram API and Threads API provided by Meta Platforms, Inc. When you connect one of these accounts, Meta shows you a consent screen listing each permission. You can review or remove Baciio’s access at any time in your Facebook, Instagram or Threads settings under Apps and websites or Business integrations.

We keep Meta data only while the account stays connected, and only to provide the features you use.
Removing Baciio from your Meta settings sends us a deletion request. We erase the data for that account and give you a confirmation code you can check on our data deletion page.
Our use of Meta data follows the Meta Platform Terms and Developer Policies.

Google and YouTube

Baciio’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is refreshed or deleted at least every 30 days, and we display YouTube content under the YouTube Terms of Service. You can revoke access at myaccount.google.com/permissions.

Who we share it with

The networks you connect. Your post content and media go to the network you chose to publish on, under that network’s own terms.
Infrastructure providers. Our servers, database and file storage run on Google Cloud. They process data on our instructions and under contracts that require them to protect it.
Payment processor. Handles your card and billing address for paid plans.
Email delivery. Sends the transactional emails described above.
Your team. Members of your workspace see the posts, accounts and comments inside that workspace, according to the role you gave them.
Legal requests. We disclose data if the law requires it, and we tell you first unless we are legally prevented from doing so.

How long we keep it

Account and workspace data: while your account exists, then deleted within 30 days of deletion.
Social network tokens and account data: while the account stays connected, then deleted within 30 days of disconnecting.
Published posts and their metrics: while the workspace exists. You can delete any post at any time.
Server logs: 30 days. Backups: 30 days, after which deleted data is gone from backups too.

Your rights and choices

Wherever you live, you can access, correct, export or delete your data, and object to or restrict how we use it. In the European Economic Area, the United Kingdom and similar jurisdictions these are legal rights; we honour them everywhere.

Disconnect any social account from Settings → Accounts. Its token and data are removed.
Ask for an export of your posts and media by emailing privacy@baciio.com; we send it within 30 days as a ZIP of JSON and files.
Delete your whole account from Settings → Account, or by emailing privacy@baciio.com. See the data deletion page for what happens next.
Revoke Baciio’s access from the network’s own settings at any time.

We answer every request within 30 days. If you think we got something wrong, you can also complain to your local data protection authority.

Security

All traffic uses TLS. Passwords are hashed with Argon2id. Access tokens are encrypted at rest with a key kept outside the database. Access to production systems is limited to staff who need it and is logged. If we ever learn of a breach that affects you, we will tell you without undue delay.

International transfers

Our servers are in the United States. If you are outside the United States, your data is transferred there. We rely on standard contractual clauses and our providers’ certifications to protect it.

Children

Baciio is not for people under 16, and we do not knowingly collect their data. If you believe a child has an account, email us and we will delete it.

Changes

When this policy changes in a way that matters, we email account owners and show the new date at the top of this page at least 14 days before it takes effect.

Contact

Privacy questions: privacy@baciio.com. Everything else: support@baciio.com.