Legal · Privacy

MatrixHubx Privacy Policy

Effective: October 28, 2026 · Last updated: October 28, 2026 · Version 2.0

MatrixHubx (“we”, “us” or “our”) provides multi-platform content scheduling, approval, publishing and analytics services. This Privacy Policy explains how we collect, use, store, share and delete your information when you visit MatrixHubx, use the MatrixHubx application, or connect third-party social media accounts.

1. Scope and operator

This Policy applies to the MatrixHubx website, web application, mobile pages, APIs and related services (collectively, the “Service”), operated by the MatrixHubx team (“we”, “us” or “our”).

This Policy does not apply to third-party social platforms, payment providers or other services provided independently by third parties. Your information on those platforms is governed by their own privacy policies and terms. We encourage you to review them before use.

If you use the Service on behalf of a company or other organization, you confirm that you are authorized to accept this Policy on its behalf.

2. Information we collect

We follow the principle of data minimization and collect information only for the functions described below. You may decline to provide optional information, but this may affect the related features.

We do not intentionally collect government ID numbers, biometric data, precise location, address books or the content of your social platform direct messages. If a feature requires additional information, we will explain it and obtain your consent before use.

3. Purposes and legal bases

We process your information only for the following purposes:

• Creating and maintaining your account, verifying identity and keeping you signed in;
• Publishing content through official platform APIs on your behalf after you approve it;
• Reading data from accounts you authorize to generate publishing records and analytics;
• Providing customer support and handling disputes and data requests;
• Protecting the Service against unauthorized access, abuse and attacks;
• Billing, invoicing and complying with tax and other legal obligations;
• Improving product features and reliability using aggregated or anonymized data.

Where the EU or UK General Data Protection Regulation (GDPR) applies, our legal bases are performance of our contract with you, our legitimate interests (securing and improving the Service), your consent (for optional cookies or optional data), and compliance with legal obligations. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We do not sell your personal information and do not use it for cross-site behavioral advertising. We do not use your private content to train general-purpose public AI models without your consent; when you actively use an AI feature, we process the relevant content only to generate the requested result.

4. Platform authorization data

4.1 How authorization works

When you connect a social account, we use the platform’s official OAuth flow. You are redirected to the platform, where you choose which permissions to grant. We receive only the scopes you approve and never ask for or store your platform password. Tokens are encrypted at rest on our servers and protected by least-privilege access controls and audit logs.

4.2 TikTok Login Kit and Share Kit

This product obtains and transmits data through TikTok Login Kit and Share Kit. We collect, store, use and delete your TikTok user data (including OpenID, avatar, display name and similar data) as follows.

• Collection: Only after you click “Connect TikTok” and complete authorization, through official TikTok APIs. Shared content is transmitted only after you select and confirm it in the interface.
• Use: Account binding and identification, displaying account information, publishing or sharing content you approved, and returning publishing results and analytics. We do not use TikTok data for ad targeting, profiling, credit assessment or sale to third parties.
• Storage: TikTok tokens and account identifiers are stored on our servers with encryption at rest, protected by least-privilege access, two-factor authentication and audit logs.
• Retention: For as long as your authorization is valid. Within 30 days after you revoke authorization or delete your account, we delete the tokens and associated TikTok account data, unless retention is required by law.
• Sharing: We do not sell, rent or trade your TikTok user data. We share it only with infrastructure providers bound by data processing agreements, or when required by law. We do not share TikTok data with advertisers or data brokers.
• Deletion: You can disconnect TikTok in MatrixHubx’s account management, email matrix@matrixhubx.com, or revoke MatrixHubx’s access in the TikTok app under “Settings and privacy → Security and permissions → Manage app permissions”. After verifying your identity, we complete deletion within 30 days and also delete account-binding records derived from that data.
• What we do not collect: Your TikTok password, direct messages, address book, device contacts, or any non-public data you have not authorized.
• Automation boundaries: Share Kit sharing is confirmed by you in the TikTok app. We do not bypass that confirmation, and we do not perform bulk registration, artificial engagement, mass direct messages or rate-limit circumvention.

Our processing of TikTok data also complies with the TikTok Developer Terms and TikTok’s privacy policy. If this Policy conflicts with a mandatory TikTok requirement, the stricter requirement applies.

4.3 Google and YouTube API Services

When you sign in with Google or connect a YouTube channel, we request only the data required for the features you enable:

• Basic profile information (name and avatar) and email address;
• Basic channel information, video metadata, publishing status and authorized analytics for channels you authorize.

We use this data only to verify your identity and link your account, upload videos to channels you authorize, display analytics dashboards, and handle support requests related to YouTube features. We do not sell, rent or trade Google or YouTube user data, do not use it for advertising, and do not share it with advertisers or data brokers. We share it only with infrastructure providers bound by confidentiality and data processing agreements, or when required by law.

Google and YouTube data is transmitted over HTTPS/TLS and stored using industry-standard safeguards, with access limited to authorized personnel. Tokens are retained only as long as necessary to provide the Service. After you revoke authorization or terminate your account, we stop accessing the data and delete or anonymize it within a reasonable period.

You can revoke access at any time at Google Account third-party connections. Our use of Google API data complies with the Google API Services User Data Policy, including its Limited Use requirements. Use of YouTube API Services is also subject to the YouTube Terms of Service and the Google Privacy Policy.

4.4 Meta platforms (Facebook, Instagram, Threads)

When you connect a Meta platform, we obtain through Meta’s official OAuth the Pages, Instagram professional accounts or Threads profiles you authorize, together with the permissions needed for publishing. We call APIs only within the scopes you grant, to publish content and read publishing results and analytics.

We comply with the Meta Platform Terms and Developer Policies. We do not sell Meta user data, do not use it for ad targeting, and do not continue accessing it after you revoke authorization. You can remove MatrixHubx in your Meta account’s “Apps and Websites” settings, or contact us under Section 12 to request deletion. Where a platform provides a data deletion callback, we complete deletion as required upon notice.

4.5 Other platforms

4.6 How to revoke authorization

You can disconnect any platform at any time in MatrixHubx’s account management, or revoke access in that platform’s “authorized apps” settings. After revocation, we stop accessing data through that authorization and delete the corresponding tokens and associated data within 30 days, unless the law requires otherwise.

5. Cookies and local storage

We use a small number of cookies and browser storage entries to operate the Service:

• Essential: sign-in session, security checks and load balancing. The Service cannot function without them.
• Preferences: language, theme and sidebar state, stored in localStorage and removable at any time.
• Analytics: if enabled, used only in aggregate for traffic and error rates, not to identify individuals or track you across sites. You can opt out through browser settings or our notice.

We do not use advertising cookies and do not participate in cross-site behavioral advertising networks. You can clear or block cookies in your browser, though this may affect sign-in and some features.

6. Sharing, processing, transfer and disclosure

We do not sell your personal information. We share it only in the following circumstances:

• With your explicit consent or at your request, when sending a publishing request to the relevant platform;
• With providers of cloud hosting, object storage, email, payment and logging infrastructure, solely to support the Service under confidentiality and data processing agreements;
• To comply with law, valid legal process, or to protect the rights of users, the public or ourselves;
• In a merger, acquisition, restructuring or insolvency, where the recipient remains bound by this Policy; if the purpose changes, we will seek your consent again.

We do not publicly disclose your personal information except with your consent or as required by law. All processors are required to apply appropriate safeguards and may not use the data for their own purposes.

7. Storage, security and retention

Your information is stored on cloud infrastructure used by us and our processors, which may be located outside your country or region. We protect it through encrypted transmission, access controls, audit logging and employee confidentiality obligations. No internet transmission is absolutely secure, and we continually review and improve our safeguards.

If a personal data breach occurs, we will assess the risk as required by applicable law and notify you and regulators where necessary.

When the retention period ends, we delete or anonymize the information. If deletion is temporarily impossible for technical reasons (such as backup media), we isolate the data and delete it during the next backup rotation.

8. Your rights

To the extent permitted by applicable law, you have the right to:

• Access and obtain a copy of the information we hold about you;
• Correct or complete inaccurate or incomplete information;
• Delete your information where the law provides;
• Withdraw consent at any time for consent-based processing;
• Restrict or object to certain processing in specific circumstances;
• Data portability in a structured, commonly used format;
• Close your account through account management or email;
• Complain to your local data protection authority.

Email matrix@matrixhubx.com. To protect your information, we may first verify your identity. We respond within 30 days; for complex or numerous requests, we may extend by 30 days and will notify you. Where the law sets a shorter period, that period applies.

Regional notes: If you are in the European Economic Area or the UK, you may complain to your local supervisory authority and request information about safeguards for transfers to third countries. If you are a California resident, we do not sell or share your personal information for cross-context behavioral advertising, and you have the right to know, delete, correct, and to be free from discrimination for exercising those rights.

9. Minors

The Service is intended for businesses and adult creators and is not directed to children under 16. We do not knowingly collect personal information from minors. If we learn that we have inadvertently done so, we will delete it promptly. Guardians who become aware of such collection may contact matrix@matrixhubx.com.

10. International transfers

Because our providers may be located in different countries or regions, your information may be transferred to and processed in locations outside your country. We apply appropriate safeguards such as contracts, access controls and security assessments so that transferred information remains protected under this Policy. Where required by law, we use standard contractual clauses or other recognized transfer mechanisms.

11. Policy updates

We may update this Policy when our Service, data practices or legal requirements change. We will notify you of material changes through a notice on this page or by email and will update the “Last updated” date above. We will not reduce your rights under this Policy without your explicit consent. Please review this page periodically.

12. Contact us

For questions, comments, complaints or data requests regarding this Policy:

• Email: matrix@matrixhubx.com
• Website: https://matrixhubx.com
• Response time: within 30 days after identity verification
• Product: MatrixHubx multi-channel content platform

If you are not satisfied with our response, you may also complain to your local data protection authority.

13. Appendix: platforms and scopes

Scope names may change as platforms update their APIs. The authorization screen always controls what is actually requested. If you have questions about a scope, contact us before authorizing.