Privacy Policy
BrandMongo Pty Ltd ("we", "us", "our") operates the Schedule & Share platform. This Privacy Policy explains how we collect, use, store, and protect your personal data.
Last updated: February 2026
Data We Collect
Account Data
- Email address, first name, and last name
- Password (stored as a bcrypt hash — never plaintext)
- Authentication provider (credentials or Google OAuth)
- Avatar URL (if provided via Google OAuth)
Social Media Platform Data
- Platform user IDs and usernames
- OAuth access tokens and refresh tokens (encrypted at rest)
- Platform-granted permission scopes
Content Data
- Post text, hashtags, and media file URLs
- Scheduling timestamps and publishing status
- Engagement metrics returned by platform APIs
Security & Audit Data
- Audit logs of security-relevant actions
- IP addresses and user agent strings (security only)
- Rate limiting counters (stored temporarily)
How We Use Your Data
Service delivery
Authenticating you, scheduling and publishing posts to your connected platforms
Security
Protecting your account with MFA, session management, and audit logging
Analytics
Displaying engagement metrics for your published content
Content moderation
Optionally analysing content for policy compliance (opt-in per platform)
Communication
Sending transactional emails (password resets, account notifications)
Security Measures
We implement robust security measures to protect your data with industry-leading encryption and authentication protocols.
AES-256-GCM encryption at rest
Google Cloud KMS key management
bcrypt password hashing
TLS 1.2+ transport security
TOTP multi-factor authentication
8-hour JWT session security
Audit Integrity
All security-relevant actions are logged with SHA-256 hash-chain verification for tamper detection, ensuring complete audit trail integrity.
Data Retention
Sub-Processors
We use the following third-party services to process your data:
International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area. Where such transfers occur, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission to ensure adequate protection of your data.
Your Rights (GDPR)
If you are in the European Economic Area, you have the following rights under the General Data Protection Regulation:
Access
Article 15Export all your data via Settings → Privacy → Export Data
Rectification
Article 16Update your profile via Settings
Erasure
Article 17Delete your account via Settings → Privacy → Delete Account
Restriction
Article 18Request restriction of processing by contacting us
Portability
Article 20Download your data in machine-readable JSON format
Objection
Article 21Opt out of analytics tracking via Settings
Children's Privacy
Our Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.
Contact Us
Privacy Inquiries
For privacy-related questions
Your privacy matters to us
We're committed to protecting your data and being transparent about how we use it.