Privacy policy

This policy describes which personal data Uploadlane processes, what we use it for and which rights you have. We deliberately keep it short and in clear language. Have a question? Email support@uploadlane.com.

1. Who we are

Uploadlane is a platform for social media planning, based in Belgium. Uploadlane is operated by V&A Technics, registered in the Belgian Crossroads Bank for Enterprises under enterprise number BE0536397033. For privacy questions you can reach us at support@uploadlane.com. We are the data controller for the data you give to Uploadlane.

2. Which data do we process

Account data

Name, email address and (hashed) password
Profile photo (if you upload one)
Workspace name, time zone and posting preferences
Audit log of important actions (login, password change, etc.)

Content you upload

Posts, captions, media (videos and images) that you schedule
Scheduled publication times and channel connections
Analytics about your own posts (via the social media APIs)

Connected social media accounts

OAuth tokens from your connected channels (TikTok, Instagram, Facebook, Threads and YouTube) - stored encrypted (AES-256-GCM)
Username, display name and profile photo of your connected accounts

Billing and payment data

Subscription, chosen plan and billing status
Payment metadata via Stripe (for example card brand, last four digits, country and invoice id); we do not see your full card details, Stripe processes those
Invoices and payment history for our accounting

Audience and insights data from platforms

Reach, views, likes and other statistics about your own posts
Aggregated audience data (for example country or age group of your followers) to the extent the platform provides it

We fetch this audience and insights data, on your instruction, directly from TikTok, Meta and Google via their APIs. The source is therefore the relevant platform, not always you.

Technical data

IP address (in server logs, typically rotated within about 30 days by our hosting)
Browser type and device info (in web server logs)
Cookies - see our Cookie Policy

If you sign up for our newsletter, we process your email address, your language preference and an anonymized IP address and browser type (spam prevention). Your subscription is active immediately; we create a personal, one-time discount code for you with our payment provider Stripe. Legal basis: consent; you can withdraw it at any time via the unsubscribe link at the bottom of every newsletter. After unsubscribing we keep your email address on a suppression list so we do not email you again. We do not use open or click tracking in newsletters.

3. What do we use this data for

Service delivery: publishing your posts at the right moment to the right channels.
Account management: logging in, resetting passwords, verifying email, team invitations.
Security: blocking brute-force attempts, keeping an audit log, detecting fraudulent accounts.
Communication: important service emails (verification, reset, invites). No marketing without a separate opt-in.
Product improvement: if you have accepted analytics cookies, anonymized usage figures.
AI score (advisory): if you use that feature, we calculate an indicative score for your content. See the section on automated decision-making and AI.

4. Legal basis

We process your data per activity on the basis of:

Contract (art. 6(1)(b) GDPR): for your account, scheduling and publishing posts, and storing OAuth tokens of connected channels.
Contract and legal obligation (art. 6(1)(b) and (c) GDPR): for billing, payments and keeping accounting records.
Consent (art. 6(1)(a) GDPR): for analytics and marketing cookies and marketing emails; you can withdraw that consent at any time.
Legitimate interest (art. 6(1)(f) GDPR): to secure our service and users and prevent abuse, including fraud and affiliate-abuse detection; our interest is a safe, reliable, fraud-free service.
Contract or consent (art. 6(1)(b) or (a) GDPR): for the optional AI score on your content.
Legal obligation (art. 6(1)(c) GDPR): for tax retention duties and requests from competent authorities.

5. With whom do we share your data

We never sell your data to third parties. We only share what is strictly necessary with:

Hosting: Hetzner Cloud (Germany) - server infrastructure.
Email: Resend (EU) - to send transactional emails.
Social media platforms: TikTok, Meta (Instagram/Facebook/Threads) and Google (YouTube) receive your content and requests when you connect those channels and publish; they act as independent controllers under their own policies.
Payments: Stripe (Stripe Payments Europe) processes payments and subscriptions. We do not see your full card details.
AI provider: Google (Gemini API) processes the data needed to calculate your AI score, only when you use that feature.
Cookie consent: we manage your cookie preferences ourselves, first-party, without an external consent service. Analytics (Google Analytics 4, anonymized IP) only loads after your consent.
Database/storage: runs on our own servers within the EU.

With all these parties we have - where applicable - a data processing agreement (DPA) or they fall under a comparable protection arrangement.

Our processors and recipients

Hetzner Online GmbH (Hetzner Cloud) (processor, Germany (EEA)): Cloud hosting and infrastructure; storage of application data and encrypted OAuth tokens. Transfer: EEA (no third-country transfer; data hosted in the EU).
Stripe Payments Europe, Ltd. (independent controller (and processor for parts of the payment flow), Ireland (EEA), with group entities in the USA): Subscription billing, card payment processing, fraud prevention, dispute/chargeback handling. Transfer: Primarily EEA; EU-US Data Privacy Framework and SCCs for any onward transfer to Stripe US entities.
Google Ireland Ltd. / Google LLC (Gemini models via Vertex AI) (processor, Ireland (EEA) and USA): AI analyses (video score and thumbnail checker) of content you explicitly submit for analysis. Standard analyses are processed in an EU region; the Pro analysis runs Google's latest Gemini model on Google's global infrastructure, including the USA. Under the Google Cloud terms, Google does not use this content to train its models. Transfer: EU-US Data Privacy Framework and SCCs.
Google LLC (Google / YouTube OAuth platform data) (independent controller, USA and EU): YouTube channel connection, publishing and analytics via the YouTube API Services that the user chooses to connect. Transfer: EU-US Data Privacy Framework and SCCs.
Meta Platforms Ireland Ltd. (independent controller, Ireland (EEA) and USA): Instagram, Facebook and Threads account connection, scheduling and publishing via the Meta Platform. Transfer: EU-US Data Privacy Framework and SCCs.
TikTok Technology Ltd. (independent controller, Ireland (EEA), USA and Singapore): TikTok account connection, scheduling and publishing via the TikTok API. Transfer: Standard Contractual Clauses (and TikTok's own third-country safeguards).
Google Ireland Ltd. / Google LLC (Google Analytics 4) (processor, Ireland (EEA) and USA): Anonymized visitor statistics, only after your cookie consent (IP anonymization active). Transfer: EU-US Data Privacy Framework and SCCs.
Resend (processor, EU region): Transactional email (order confirmations, durable-medium withdrawal confirmations, account notifications). Transfer: EEA (EU sending region); EU-US Data Privacy Framework / SCCs for any US-routed processing.
Cloudflare, Inc. (processor, USA): Turnstile bot and spam prevention on the login, registration and affiliate signup pages; receives the visitor's IP address and the challenge data. Transfer: EU-US Data Privacy Framework and SCCs.

6. International transfers

Some of our processors are located in or process data outside the European Economic Area, for example in the United States (such as certain Stripe, Google or Cloudflare services). In that case we ensure an adequate level of protection: transfers go to parties certified under the EU-US Data Privacy Framework, or otherwise on the basis of the European Commission's standard contractual clauses (SCCs), with additional measures where needed.

When you connect a channel and publish, your content and requests go to the relevant platform (TikTok, Meta, Google), which may also process outside the EEA under its own policies and safeguards.

7. How long do we keep your data

Account data: as long as your account is active. If you delete your account, we erase everything within 30 days. OAuth tokens for connected accounts are deleted as soon as you disconnect a channel or delete your account.
Billing and accounting data: we keep for as long as Belgian tax retention rules require, as a rule 7 years.
Server logs: rotated and typically deleted within about 30 days by our hosting infrastructure.
Audit log: our security log is append-only (rows cannot be changed or deleted, to protect against tampering) and we keep it for as long as needed for security investigation and legal defence. If you delete your account, we remove the link to you (your user id) from those rows.
Cookie consent log: 24 months, as proof of given consent.
Backups: up to 30 days after deletion.

8. Security

Passwords hashed with bcrypt (12 rounds).
OAuth tokens encrypted (AES-256-GCM) at rest.
All traffic over HTTPS (TLS 1.2+).
HTTPS-only cookies with SameSite protection against CSRF.
Rate limiting on auth endpoints.
Audit log of security-relevant actions.

9. Your rights (GDPR)

You have the right to:

Access: request which data we hold about you.
Rectification: have incorrect data corrected.
Erasure: have your account and data deleted.
Restriction: pause processing during a dispute.
Objection: to processing based on legitimate interest.
Data portability: receive your data in a machine-readable format.
Withdraw consent: for example for analytics cookies, via the footer link "Cookie settings".

Do you have an account? The easiest route is via Account settings → Privacy & data: there you can download your data or delete your account directly.

Prefer a formal request, or do you no longer have an account? Email support@uploadlane.com or use the form below. We respond within 30 days.

If you disagree with how we handle your data, you have the right to lodge a complaint with the Belgian supervisory authority: the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. We would appreciate it if you tried to resolve it with us first via support@uploadlane.com.

10. Automated decision-making and AI

Uploadlane can show an AI score or recommendations to help you improve your content. This score is purely advisory: it is AI-generated and you decide yourself whether and how to publish. There is no solely automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR.

For the score we use Google's Gemini models via Vertex AI. Content you explicitly submit for analysis is processed for that purpose. Standard analyses are processed in an EU region (EEA). If you choose the Pro analysis, it runs on Google's latest Gemini model on Google's global infrastructure, including the USA, with the safeguards described in the 'International transfers' section (EU-US Data Privacy Framework and SCCs). Google does not use this content to train its models. In line with AI transparency rules (including Article 50 of the EU AI Act) we indicate that the score is AI-generated.

11. Children

Uploadlane is intended for users aged 13 and over. In Belgium, 13 is the age from which a minor can consent to information society services on their own. We do not target children under 13 and do not knowingly collect their data. If you think we have accidentally collected a child's data, email support@uploadlane.com and we will delete it.

12. Changes

We may amend this policy. We announce important changes by email or via a banner in the app. Today's version: last updated on August 13, 2026.