Privacy Policy

Introduction

At Outstand ("we," "our," or "us"), we are committed to protecting your privacy and ensuring transparency in how we collect, use, and safeguard your personal data. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our API-only social media scheduling service. We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Our Role as Controller and Processor

Outstand is a service provided by FortyTwo Eleven Consulting AB (Org.nr: 559358-1746), a company registered in Sweden. Our role under GDPR depends on the data:

• Outstand as controller: for your account, billing and website usage data, we decide why and how it is processed. This Privacy Policy describes that processing.
• Outstand as processor: for personal data that you or your end users submit to the Service, such as connected social accounts, post content, media, comments and messages, you are the controller and we process it only on your instructions. That processing is governed by our Data Processing Agreement.

Information We Collect

Personal Data

When you create an account, we collect information that identifies you as an individual, including your name, email address, and billing information necessary to provide our services.

API Usage Data

We collect information about your API usage, including request logs, response times, API endpoints accessed, error logs, and usage patterns to ensure service quality, security, and accurate billing.

Website Usage and Tracking Data

When you visit our website or use our services, we automatically collect certain information about your device and usage patterns, including:

• IP address and geolocation data
• Browser type, version, and language preferences
• Device type, operating system, and screen resolution
• Pages visited, time spent on pages, and navigation paths
• Referring website or source
• Date and time of access
• Click data and interaction patterns

This data is collected through cookies, web beacons, and similar tracking technologies. We use analytics services (including PostHog) to analyze this data and improve our website's functionality and user experience.

Social Media Content

We temporarily process the social media content you schedule through our API to deliver it to the appropriate platforms. This includes post text, images, videos, metadata, and scheduling information. This content is processed in real-time and is not stored permanently on our servers after delivery.

Social Media Account Credentials

We store encrypted OAuth tokens and access credentials for your connected social media accounts to enable post scheduling and publishing on your behalf.

Instagram Direct Messages

Where an Instagram account is connected with messaging permission, we receive and, in some cases, store direct messages. See the Instagram Direct Messages section below for details.

Legal Basis for Processing Personal Data

Under GDPR, we process your personal data based on the following legal grounds:

• Contractual Necessity: Processing is necessary to provide our services under our Terms of Service
• Legitimate Interests: We process certain data (like usage analytics and IP addresses) for security, fraud prevention, service improvement, and business operations, provided these interests don't override your rights
• Consent: Where required by law, we obtain your explicit consent for specific processing activities, such as marketing communications and non-essential cookies
• Legal Obligations: Processing is necessary to comply with legal requirements, such as tax laws and regulatory obligations

How We Use Your Information

We use the collected data for the following purposes:

• To provide, maintain, and improve our API services
• To process and schedule your social media posts on connected platforms
• To calculate usage-based billing ($19/month base fee including 3,000 posts, then $0.007–$0.005/post at volume)
• To authenticate users and secure accounts
• To provide customer support and respond to your inquiries
• To analyze website usage and user behavior to improve our services
• To monitor and prevent fraudulent activities, security threats, and abuse
• To develop new features and functionality
• To send service-related communications and updates
• To comply with legal obligations and enforce our terms

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your website usage. Cookies are small data files stored on your device. We use the following types of cookies:

• Essential Cookies: Required for website functionality, authentication, and security
• Analytics Cookies: Help us understand how visitors interact with our website
• Performance Cookies: Track and improve website performance and user experience

You can control cookies through your browser settings. However, disabling certain cookies may limit your ability to use some features of our service.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal data to third parties. We may share your information with:

• Service Providers: The subprocessors listed below, who help us operate the Service (hosting, database, payments, email and analytics) under written data protection agreements
• Social Media Platforms: To deliver your scheduled content to Twitter, LinkedIn, Facebook, Instagram, and other connected platforms
• Legal Authorities: When required by law, legal process, or to protect our rights, safety, and property
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to you)

Subprocessors

We use the following subprocessors to operate the Service. Each is bound by a written agreement with data protection obligations no less protective than those in our Data Processing Agreement.

Social media platforms that you connect, such as X, LinkedIn, Meta, TikTok, YouTube, Pinterest and Bluesky, are not our subprocessors. We send them your content because you instruct us to, and they process it as independent controllers under their own terms.

We give at least 30 days' notice before a new subprocessor starts processing customer personal data, by updating this list and emailing account owners. This list was last updated on September 15, 2026.

Data Processing Agreement

Our Data Processing Agreement (DPA) meets the requirements of Article 28 GDPR for the personal data we process on your behalf. It forms part of our Terms of Service and applies automatically to every customer, with no signature needed. It covers our processing obligations, subprocessors, international transfers under the EU Standard Contractual Clauses, security measures, breach notification, audits and deletion.

Read the full Data Processing Agreement. If your organization needs a countersigned copy, contact support@outstand.so.

International Data Transfers

Our primary database, task scheduling and product analytics are hosted in the European Economic Area (EEA). Some of our subprocessors are based in, or may access data from, countries outside the EEA, such as the United States. When personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions recognizing equivalent data protection standards
• The EU-U.S. Data Privacy Framework, where the recipient is certified

Data Security

We implement comprehensive technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including:

• End-to-end encryption for all API communications using TLS/SSL protocols
• Encrypted storage of sensitive data, including social media access tokens
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection and security practices
• Incident response and breach notification procedures

While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but continually work to enhance our security measures.

Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy:

• Account Information: Retained for as long as your account is active, plus 90 days after account deletion (for recovery purposes)
• Social Media Content: Processed and delivered immediately, not stored permanently after delivery
• Instagram Direct Messages: Handled as described in the Instagram Direct Messages section below
• Usage Logs and API Data: Retained for up to 2 years for billing, analytics, and service improvement
• Website Analytics Data: Retained for up to 26 months
• Billing Records: Retained for 7 years to comply with tax and accounting regulations

After the retention period, we securely delete or anonymize your data.

Facebook, Instagram and Threads. If you remove an app that uses Outstand from your Facebook, Instagram or Threads settings, or ask Meta to delete the data that app holds about you, Meta notifies us and we delete the accounts you connected through that app, together with their access tokens, imported posts and direct messages. Billing records that must be kept are stripped of your identifiers. For a deletion request Meta gives you a confirmation code, and you can check its progress on the status page linked from that request.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights under GDPR:

• Right to Access: Request confirmation of whether we process your personal data and obtain a copy of your data
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data under certain conditions
• Right to Restrict Processing: Request limitation on how we process your data in specific circumstances
• Right to Data Portability: Request transfer of your data to another organization in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Withdraw previously given consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority if you believe your rights have been violated
• Right to Automated Decision-Making: Not be subject to decisions based solely on automated processing that produce legal or significant effects

To exercise any of these rights, please contact us at support@outstand.so. We will respond to your request within 30 days in accordance with GDPR requirements. We may need to verify your identity before processing your request.

YouTube API Services

Our service uses the YouTube API Services to enable video uploading and access to channel information and video metrics on your behalf. By using our YouTube integration features, you agree to be bound by the YouTube Terms of Service.

Data We Access via the YouTube API

When you connect a YouTube account through our platform, we may access and process the following data:

• YouTube channel information (channel name, ID, and profile details)
• Video metadata (titles, descriptions, tags, and publishing status)
• Video analytics and performance metrics (views, likes, comments counts)
• Upload capabilities to publish videos on your behalf

How We Use YouTube Data

We use YouTube data exclusively to provide our social media management services, including:

• Uploading videos to your YouTube channel as instructed through our API
• Retrieving channel and video metrics to display within our platform
• Managing your YouTube content alongside other social media platforms

We do not use YouTube API data for advertising, profiling, or any purpose unrelated to providing our services to you.

Storage of YouTube Data

We store encrypted OAuth tokens to maintain your YouTube account connection. Video content submitted for upload is processed and transmitted to YouTube immediately and is not permanently stored on our servers after delivery. Channel and video metrics may be cached temporarily to improve performance but are refreshed regularly from the YouTube API.

Revoking Access

You can revoke Outstand's access to your YouTube data at any time by visiting the Google security settings page. Revoking access will disconnect your YouTube account from our platform, and we will delete your stored YouTube OAuth tokens within 30 days.

Google Privacy Policy

Our use of information received from the YouTube API adheres to Google's privacy requirements. For more information about how Google handles your data, please refer to the Google Privacy Policy.

Instagram Direct Messages

This section applies only to Instagram professional accounts that the account owner has connected through an Outstand customer's application, and only where the account owner explicitly granted the Instagram messaging permission (instagram_business_manage_messages). If that permission was not granted, we do not receive the account's direct messages.

What Meta Sends Us

Once the permission is granted, Meta sends us notifications for all direct message activity on the connected account. This includes personal conversations that have nothing to do with the customer's application. Meta does not let us limit this to certain conversations, so we handle each type of message as described below.

• Messages received by the connected account: messages other people send to the account, including their content, are stored so the Service can deliver them to the customer's application through our API and message.received webhooks
• Messages sent by the account owner outside Outstand: messages the account owner sends from the Instagram app or any tool other than Outstand are not stored. We pass the notification through to the customer application's webhook endpoint so its inbox stays in sync, and then discard it
• Messages sent through Outstand: messages sent through our API are stored so that we can deliver, schedule and bill them

How We Use Direct Messages

We use direct messages only to provide and support the Service, and for security and abuse prevention. We do not use direct message content for advertising or profiling, we do not sell it, and we do not use it to train AI models.

Access by Outstand staff is limited to authorized personnel, is logged, and is used only for customer support and security purposes.

Messages sent through our API may be metered for billing, for example by counting active conversations. Billing uses counts and identifiers, not message content.

Retention and Deletion

Stored direct messages are kept for as long as needed to provide the Service. When the Instagram account is disconnected from Outstand, its stored conversations and messages are deleted immediately. We also delete them from our production systems within 90 days after the customer's account is closed, as described in our Data Processing Agreement. Residual copies in backups are deleted as those backups expire.

The Customer's Role

The Outstand customer whose application you connected receives your direct message data and is responsible for how it handles that data. We process direct messages on that customer's behalf, as described in Our Role as Controller and Processor. If you are an account owner, please review that customer's privacy policy and contact them first with questions or requests about your messages. You can stop sharing direct messages at any time by revoking the application's access to your Instagram account through Meta's settings.

Third-Party Services

Our service integrates with various social media platforms (Twitter/X, LinkedIn, Facebook, Instagram, YouTube, etc.) and third-party service providers to deliver your content and operate our services. Each platform and provider has its own privacy policy and terms of service that govern how they handle your data. We are not responsible for the privacy practices of these third parties.

Key third-party services we use include:

• YouTube API Services (governed by the YouTube Terms of Service and Google Privacy Policy)
• The subprocessors listed in the Subprocessors section above
• Social media platforms for content delivery

Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information, please contact us immediately at support@outstand.so, and we will take steps to delete such information.

Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and 34.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of any material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to your registered email address
• Displaying a prominent notice on our website

Your continued use of our services after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, including exercising your GDPR rights, please contact us at:

We are committed to resolving any concerns you may have about your privacy and personal data in a timely and transparent manner.