1. Personal information items collected
The company collects only the minimum amount of information necessary to provide services. Here's what we collect:
go. Information collected when registering as a member
- Information entered directly by the user — Email address, password, display name
- Service settings information — Language used, time zone, default reservation time, whether to receive notification of publishing failure
- Information automatically recorded during the registration process — Access IP address, browser information (User-Agent), subscription path, subscription time, last login time
Since the original text of the password is not stored and is only stored as a hash value that cannot be restored, the company cannot know the user's password.
me. Information collected when connecting a social media account
- Account identifier, account name (handle), and profile image address issued by the platform
- Access token and refresh token to perform posting, token expiration time, and scope of permissions granted by the user.
- If there is a separate posting target, such as a Facebook page, the identifier and name of the page
all. Information stored in the process of using the service
- Image and video files uploaded by users, and file information such as file name, format, size, resolution, and playback time
- Posting options such as common text written by users and channel-specific captions, hashtags, and public scope
- Reservation time and posting status, posting identifier and address received as a result of posting, error code and error message in case of failure
- Log usage counts to calculate daily posting limits and platform limits
The posting body and media files are content entered directly by the user for the purpose of posting. The company does not use this content for any purpose other than processing postings and displaying history. It is not used for advertising or artificial intelligence model training.
2. Purpose of use of personal information
The collected information will be used only for the purposes listed below, and if the purpose is different, prior consent will be obtained.
- Member identification and login — Confirm yourself with your email and password and stay logged in.
- Posting and reservation processing — Publish content to the SNS channel selected by the user and execute the posting at the scheduled time.
- Check results and retry — Displays whether or not the posting was successful and the reason for failure on the history screen, and allows you to retry failed tasks.
- Send notification — A notification will be sent to the email address you signed up with only if the posting ultimately fails.
- service protection — Block unusual sign-ups and repeat requests, calculate daily posting limits and platform limits.
- Inquiry response — We check inquiries sent by users and reply with processing results.
3. SNS account connection and scope of authority
BLUE POST connects accounts only through the official authentication process (OAuth) provided by each platform. The company does not request or store users' SNS passwords. The scope of permissions granted on the connection screen is as follows, and the company will not send requests beyond this scope.
| platform | Permission to Request | Why use it |
|---|---|---|
| Threads | threads_basic, threads_content_publish |
Used to check basic account information and publish posts. |
instagram_business_basic, instagram_business_content_publish |
Used to verify basic information of a business or creator account and to publish posts. | |
| Facebook Page | pages_show_list, pages_read_engagement, pages_manage_posts, pages_manage_metadata |
Used to retrieve a list of pages managed by the member and publish posts on the selected page. |
| YouTube | youtube.readonly, youtube.upload |
Used to check connected channel information and upload videos. |
The company does not use this permission to view the user's friend list, follower information, or direct messages. Unlinking will immediately delete any stored tokens, so the company will no longer have access to your account.
4. Third party provision and overseas transfer
The company does not sell users' personal information and does not provide it to third parties except when requested by law. However, due to the nature of the service, content requested by the user to be posted will be transmitted to the platform selected by the user.
- Meta Platforms, Inc. — Send post body, media files, and publishing options for posting to Threads, Instagram, and Facebook pages.
- Google LLC — Send the video file, title, description, and privacy to upload the video to YouTube.
Since the above business operator has a server in the United States, the data is transferred overseas at the time of posting. The items and purposes to be transferred are the same as those described above, and transfer occurs only when the user requests posting or reservation. Users can refuse the transfer by disconnecting their account or canceling the reservation, in which case they will not be able to post to that channel.
The servers and storage space required for service operation use the facilities of cloud operators, and we do not outsource any other personal information processing tasks.
5. Retention period and destruction procedures
| division | retention period |
|---|---|
| Member information (email, display name, settings) | It will be kept until membership withdrawal, and will be deleted without delay upon withdrawal. |
| SNS access token and refresh token | If you disconnect or withdraw from your account, it will be immediately deleted and expired tokens will also be discarded. |
| Uploaded images and videos | It is automatically deleted 7 days after posting. |
| Posting history and error records | It is kept until membership withdrawal, and is also deleted when the user deletes the history. |
| Access IP address and browser information | It is stored to prevent fraudulent registration, and is deleted along with member information upon withdrawal. |
| Records of receipt of data deletion requests | Only the application number and processing time are left so that users can check the processing results using the application number, and no personally identifiable information is left. |
Information that has passed its retention period is deleted from the database, and media stored as files are completely deleted from the storage device. However, if there is information that requires preservation by relevant laws, such as the Act on Consumer Protection in Electronic Commerce, etc., it will be stored separately for the period specified in the relevant laws and then destroyed.
6. User rights and how to exercise them
Users can view, correct or delete their personal information at any time, and request that processing be stopped. You can process it directly within the service using the following methods.
- disconnect — Account linking When you disconnect a channel from the screen, any stored tokens are immediately deleted.
- Delete posts and reservations — Publishing history You can cancel your reservation or clear your history from the screen.
- Edit information — Account SettingsYou can change your display name, time zone, and whether you want to receive notifications.
- Check processing status — If you request deletion through the platform Data deletion request processing status You can check the results by application number on the page.
- Delete Account — If you would like to delete your entire account, please send a request to the contact information below. After verifying your identity, we will process it without delay.
If a user has an objection to the company's processing in relation to personal information protection, he or she may apply for consultation to the Personal Information Dispute Mediation Committee (1833-6972) or the Korea Internet & Security Agency's Personal Information Infringement Reporting Center (118).
7. Cookies and access records
- Login session cookie — Used to keep you logged in. This cookie contains only a session identifier and becomes unusable when you close your browser or log out. If you block these cookies, you will not remain logged in and will not be able to use our services.
- Visit analysis history — In order to determine page usage, the visited address, screen stay time, inflow path, and browser type are recorded on our own server. This record is used for statistical purposes only and is not provided to external advertisers.
Users can refuse to store cookies or delete stored cookies through their browser settings.
8. Measures to ensure safety
- SNS access tokens and renewal tokens are encrypted and stored using AES-256-GCM, and the encryption key is stored separately in a location that cannot be accessed from the web.
- Passwords are converted and stored using a hash function that cannot be restored.
- HTTPS is applied to all communication sections.
- Uploaded media files are stored outside the web root and made available to a signed temporary address for a limited time only when the platform needs to download the file.
- Databases that process personal information limit access to the minimum number of personnel and apply token verification to all change requests to prevent request forgery.
9. Personal information of children under 14 years of age
BLUE POST is not intended for children under 14 years of age and does not accept registration from children under 14 years of age. If we confirm that personal information of a child under 14 years of age has been collected, we will delete such information without delay.
10. Personal information protection manager and contact information
Please send inquiries regarding the processing of personal information and requests for viewing or deletion to the address below. We will check the received information and then reply.
- Service nameBLUE POST
- operateBlueCanvas Digital Studio
- Personal information protection officerBLUE POST operation manager
- emailopci1004@gmail.com
- contact pagebluecvs.com/#contact
11. Changes in policy
When adding or changing the contents of this policy, notification will be posted on this page at least 7 days prior to the effective date. If there is a change that is unfavorable to the user or has a significant impact on their rights, they will be notified at least 30 days in advance and, if necessary, notified by email.
Effective Date: August 23, 2026