Privacy

Ubee is the responsible party and operator under POPIA. Our Information Officer is Sunil Hiralal, registered with the Information Regulator of South Africa. For anything about your personal information, email ai@ubee.co.za.

• Your account. Your name, email address and profile picture, handled by our sign-in service (Clerk). We never see or store your password.
• Your business. Its name, type, city, description, website and the voice settings you choose (tone, usual call to action, words to avoid, hashtag style).
• Your social accounts. The name, username and profile picture of each Facebook Page and Instagram account you connect (TikTok too, once it can be connected), plus the access keys those networks give us so we can post for you. The keys are stored encrypted and are never shown to anyone.
• Your posts. The photos and videos you add, the sentence you type, the captions, when the post was scheduled or posted, and the results the networks report back (views, likes, comments and similar).
• Links you share. When your post is about a link, we open that page from our own server — each time you add it or press Try again, following up to three redirects, which can mean asking the site the link forwards to. We keep what we read: the address you gave us, the address it ended at if the link forwarded, the site’s domain, the page’s title and description, the site name, the address of the picture the page offers for previews, a short extract of its text (at most 2 000 characters) for writing the captions, whether we could read the page, and when we read it. We do not copy or store the picture itself — the preview you see is loaded straight from that site, so that site can see your browser asking for it. Nothing about you goes with our request: no cookies, no sign-in, no details. The site sees a request from Post Once, not from you. We also keep a timestamp for each page you ask us to read, so we can hold you to a sensible number per minute and per hour; those timestamps are cleared as you use the feature again, and when your business is erased.
• Payments. Your plan, the amount, the date and the PayFast reference. Card details go straight to PayFast. We never see, store or handle your card number.
• Activity records. Posts, changes to settings, payments and deletions, with the time, your user ID, a short reference code and whether it worked. Sign-in records (including device and network details) are kept by Clerk, our sign-in provider. We keep these so we can help you when something goes wrong and to keep the service secure.

Only to run Post Once for you: signing you in, posting to the accounts you connected, showing you your posts and results, taking payment, sending you the few emails the service itself needs, and answering support questions. We do not sell, rent or share your information for marketing. We do not use your photos, captions or business details to train any system.

We use your email address to run the service, not to market to you. When you finish setting up your business we send one welcome email: what Post Once does, a link to open it, and a link to add it to your phone. Today that is the only email Post Once sends you. If we later add emails about your own account — a payment, or a connected account that needs attention — they will be service emails of the same kind, and this page will say so before we send them.

Signing up is not consent to marketing. We run no newsletters and no campaigns, so there is no marketing list to leave. If you would rather not receive the welcome email, email the Information Officer and we will not send it.

Our emails carry no tracking pixel. We do not record whether you opened one or which link you clicked. Our email provider needs your email address to deliver the message; it is not given your photos, captions, posts or payment details.

We share information only with the services we need to run Post Once:

• A publishing service is how your posts reach the networks. It holds the connection to each account you connect, receives your caption and a private web address for your photo or video, and passes the results back to us. Nothing reaches a network any other way.
• Meta (Facebook and Instagram) receive your photo or video and your caption when you post, and report the results. When your post is about a link, the address is added to the end of the caption and the post goes to Facebook only. TikTok will receive posts the same way once it can be connected; today it cannot, so nothing goes to TikTok.
• A caption-writing service drafts the captions. It receives your business’s name, what it does, its industry, city and website, your voice settings (tone, usual call to action, words to avoid, hashtag style), the sentence you type, any rewrite instruction and the captions already written. For a photo it is given a private web address and fetches the photo from our storage; for a link it is given the address and what we read from that page (its title, description, site name and the short extract). It does not receive your personal name, your email address or your sign-in details.
• The website you link to is asked for that page by our server, and for the preview picture by your browser. It is not told who you are.
• Clerk (sign-in), Convex (database and file storage), Vercel (hosting), PayFast (payments) and Resend (sending the service emails above) process data on our behalf.

Some of these services store data outside South Africa, in countries with data protection laws that POPIA recognises as adequate or under contracts that require the same standard of protection.

We use no advertising trackers, no tracking pixels and no behavioural profiling on any Post Once screen.

• Photos and videos are deleted from our storage about 30 days after the post finished posting. The post itself, its captions and its results stay in your Posts list, and the networks host the published copy.
• Posts, captions, links and what we read from them, results and settings are kept while your account is active.
• Activity records are kept for 12 months.
• Payment records are kept for as long as South African tax law requires, currently five years.

Go to Settings and tap Delete this business. Your business is locked immediately and permanently erased 30 days later: posts, captions, photos, connected accounts and usage. Activity records are kept for the remainder of their 12 months with every link to you removed. The 30 days give you a window to change your mind. If you want it done sooner, email the Information Officer.

Deleting your business in Post Once does not delete anything already published on Facebook, Instagram or TikTok. Those posts live on your accounts and you manage them there.

Under POPIA you can, at any time:

• ask what personal information we hold about you;
• ask us to correct it;
• ask for a full copy of your data, which we send you as a file;
• ask us to delete it, as above;
• object to how we use it, or withdraw your consent;
• complain to the Information Regulator of South Africa at inforegulator.org.za.

Email ai@ubee.co.za and we will respond within 30 days.

Everything travels over encrypted connections. Access keys for your social accounts and other sensitive fields are encrypted where they are stored. Only the people who need access to help you have it, and every access is recorded.

Post Once is for businesses and their owners or staff aged 18 and over.

If we change this page in a way that matters, we will tell you in the app before it takes effect. The date at the top shows the current version. Our Terms explain the rest of the agreement between us.