Share Motion

Rechtstexte in deutscher Sprache — die deutsche Fassung ist die verbindliche. English for convenience: Terms · Privacy · Data deletion

Privacy Policy

Version of 21 October 2026 · Version 2.2

Translation only. The binding version is the German one at /legal/privacy, which also carries the complete table of recipients and transfer safeguards. In case of discrepancy, the German version prevails.

1. Controller

Laurenz Fussenegger, sole trader, Dekan-Hausteiner-Weg 6, 6780 Schruns, Austria. Email: privacy@share-motion.com. No data protection officer is appointed; the conditions of Art. 37 GDPR are not met.

2. In short

We process account and brand data, the content you create, and the access tokens of the social accounts you connect. We use no tracking cookies, run no web analytics and sell no data. All content is AI-generated — see clause 7.

3. Data we process

  • Account data — email address, hashed password, registration and last-login timestamps.
  • Brand data — the website URL you submit, the screenshot taken of it and the derived brand profile.
  • Credentials for a test account you provide — only if you explicitly hand the brand scan a demo account for your own application so it can read what is behind the sign-in. The username and password are used in memory for that single run: they are not stored, not logged and never sent to the language model, and the sign-in happens in our own server function with no additional provider involved. Page text and screenshots captured there come from a restricted area and may contain third-party data, which you are responsible for supplying.
  • Content data — strategies, plans, captions, images, videos, avatars, schedules and the approval status of each post.
  • Material you supply — uploaded logos, photos, video and text. Where it shows or contains people, we process their data on your behalf (see the DPA).
  • Connected social accounts — access and refresh tokens, account ID, handle, profile picture, granted scopes and expiry. See clause 4.
  • Contract and payment data — package, subscription status, period end, credit balance, Stripe customer and subscription IDs. We never receive or store full card details.
  • Enquiries — name, email address and message when you write to us through the contact form or by email.
  • Usage and log data — IP address, timestamps, route, status code, user agent and error logs.

4. Social media access tokens

When you connect one of the supported platforms — Instagram, TikTok, YouTube, Facebook, Threads, X, LinkedIn, Pinterest or Bluesky — you authorise us through that platform's official OAuth flow (Instagram Business Login, with no Facebook page linkage). Bluesky offers no OAuth flow; there you create a revocable app password, which we exchange once for session tokens and do not store. We store the issued tokens and basic profile data only in our EU-hosted database, never in your browser. We use them exclusively to publish content you approved and to read that content's performance — never to read your messages, contacts or followers.

Tokens are deleted immediately when you disconnect under Channels or revoke access on the platform (for Instagram, Facebook and Threads, Meta notifies us of that automatically), when your account is deleted, and at the latest when they expire on the platform side (Meta: typically 60 days). See data deletion.

YouTube and Google.To connect YouTube, Share Motion uses the YouTube API Services. We only request permission to upload a video to your channel and to read your channel's name and ID, so you can see where a post goes. We do not read comments, subscribers, playlists or any other channel data. By connecting YouTube you agree to be bound by the YouTube Terms of Service, and Google's processing is governed by the Google Privacy Policy. You can revoke our access at any time via the Google security settings page; we delete the YouTube data we store when you disconnect, and at the latest 30 days after we learn of the revocation. Share Motion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or use it to train AI models.

5. Purposes and legal bases

  • Art. 6(1)(b) GDPR — performance of the contract: account, brand scan, strategy, generation, scheduling, approval, publishing, billing and support.
  • Art. 6(1)(c) GDPR — legal obligations, in particular retention of invoices under § 132 BAO.
  • Art. 6(1)(f) GDPR — legitimate interests: security, abuse and fraud prevention, rate limiting, diagnostics, answering enquiries, and the establishment or defence of legal claims.
  • Art. 6(1)(a) GDPR — consent, where we ask for it separately; revocable at any time with future effect.

No automated decision-making with legal effect under Art. 22 GDPR takes place. AI suggestions only take effect through your approval.

6. Recipients and third-country transfers

Processors: Supabase Inc. (database and authentication; data stored in the EU region, Frankfurt), Vercel Inc. (hosting, the browser that opens a test account you provide during a brand scan, and rendering edited videos in Vercel Sandbox), Anthropic PBC (language models), Features & Labels, Inc. / fal.ai (image and video generation, transcription and analysis of uploaded videos, and storage of all uploaded and generated image and video files in the US), ElevenLabs Inc. (speech synthesis), Microlink (website screenshot, processed in the US), Resend (sending the service's emails) and Cloudflare, Inc. (DNS and forwarding of incoming email). Stripe (payments), Google (the Gmail inbox our email arrives in) and the social platforms you connect — Meta Platforms Ireland Ltd. (Instagram, Facebook, Threads), TikTok, Google (YouTube), X, LinkedIn, Pinterest and Bluesky — act as independent controllers for their part of the processing.

Some providers are based in the United States, so personal data is transferred to a third country under Art. 44 ff. GDPR. Transfers rely on the EU-US Data Privacy Framework adequacy decision of 10 July 2023 where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (2021/914) contained in the providers' data processing agreements. The core data store — accounts, brand profiles, content plans, captions and tokens — is kept in the EU. Image and video files are stored by fal.ai in the US, at unguessable but publicly reachable addresses; that is how the platforms fetch a file for publishing. When the app or an approval link shows one of these files, the browser loads it directly from fal.ai, which, as with any web request, receives the IP address and technical browser details such as the user agent. Profile pictures of connected social accounts are likewise loaded directly from the respective platform. Fonts for the video preview are fetched by our server, not by your browser. We never send passwords, payment data or social tokens to model providers. The full table with seats, purposes and transfer bases is in the German version.

7. AI-generated content and transparency

All content produced in the service is AI-generated. Where a platform's API has a field for it, we label the post as AI-generated when publishing — currently TikTok (AI-generated content) and YouTube (altered or synthetic content); Instagram, Facebook, Threads, X, LinkedIn, Pinterest and Bluesky offer no such field. We treat the transparency obligations for AI-generated content under the EU AI Act (Regulation (EU) 2024/1689), applying from August 2026, as the benchmark for our own practice — this is our own commitment, not legal advice. AI output can be wrong or inconsistent; you review every post before approval, and photorealistic depictions of real people require their consent. We do not use your content to train our own models. Anthropic excludes training on API data in its commercial terms; at ElevenLabs, use for training is switched off in our account.

8. Retention

  • Account, brand and content data — for as long as your account exists. When a paid package ends, the account stays on the Free plan; it is only deleted when you ask for it, and then within 30 days.
  • Image and video files at fal.ai — on account deletion every reference to them is removed. We delete generated files at fal where fal offers a deletion function; uploaded files cannot currently be deleted individually at fal and remain reachable at their unguessable address, linked from nowhere.
  • Access tokens — as described in clause 4.
  • Invoices and accounting records — seven years after the end of the calendar year (§ 132 BAO).
  • Logs and error data — 30 days maximum.
  • Enquiries and support correspondence — three years after the case is closed. The contact form stores nothing itself; your message only reaches us as an email.

9. Cookies and local storage

We use only technically necessary cookies (login session and OAuth anti-forgery values); no consent is required for these under § 165(3) TKG 2021. The site additionally remembers your language choice, and the app keeps working state, in your browser's local storage, which you can clear at any time. No web analytics, no retargeting, no ad networks.

10. Security

All transport is TLS-encrypted. Database access is restricted per account at row level, passwords are stored hashed only, and access to production data is limited to the controller. Measures are reviewed regularly.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and may withdraw consent at any time. Write to the address in clause 1; for account deletion see data deletion. You may also lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

12. Obligation to provide data

Email address, password and payment data are required to conclude the contract; without them no account can be maintained. Connecting a social account is voluntary — without it, only automatic publishing is unavailable.

13. Changes

We update this policy when the service, the providers we use or the law change. The version published here applies; active customers are additionally informed by email of material changes.