日本語

This is a draft before publication ([Owner to fill] and [TBD] fields are not final).

This English version is provided for convenience. If there is any conflict, the Japanese version prevails.

Privacy Policy

Last updated: [TBD]

1. Information we collect

  • Email address
  • Password (stored in a form that cannot be reversed)
  • Photos, videos and text you upload
  • Details of your scheduled posts
  • Instagram connection information (access tokens are stored encrypted)
  • Usage records (such as counts)
  • Error records (only the type, location and count; we do not keep the content)
  • Payment status (vacans does not hold card numbers; they are handled by Stripe and Apple)
  • IP address at sign-up: to prevent fraudulent registrations, we use your IP address temporarily in a form that cannot be reversed, and delete it within 24 hours

2. How we use it

  • To provide the Service (creating captions and videos, scheduled posting)
  • To verify your identity and let you sign in
  • To bill fees
  • To find and fix problems
  • To send notices
  • To prevent fraud

3. Service providers (outsourcing) and countries

  • Vercel: delivering the web pages (United States)
  • Fly.io: API and background processing (Singapore)
  • Neon: database (Singapore)
  • Cloudflare R2: storing photos and videos ([To be confirmed])
  • AWS Lambda: exporting videos ([To be confirmed])
  • Stripe: payments (United States)
  • Apple: in-app payments (United States)
  • Meta: publishing to Instagram (United States)
  • Discord: error notifications, no personal information is sent (United States)
  • DeepSeek: generating caption text with AI (China)

Text you enter for caption generation is sent to DeepSeek, a company in China. This includes any personal information you put in that text. [TBD: information on provision to third parties in foreign countries (the country's personal-information protection system and the measures taken by the recipient), to be added after professional review]

4. Provision to third parties

We do not provide your personal information to third parties without your consent, except where required by law.

5. Retention periods

  • Account data: while your account exists, and deleted 30 days after you close your account (you can cancel the closure during those 30 days)
  • Error records: 90 days
  • Sign-in sessions: 30 days
  • Sign-up IP address: deleted within 24 hours (see section 1)

6. Security

  • Encrypted communications
  • Protection of passwords and tokens
  • Two-factor authentication for administrators
  • Administrators cannot view the contents of individual users' data (only aggregate figures)

7. Requests for disclosure, correction or deletion

We accept requests at [Owner to fill] (email address). For deleting data connected with Instagram, see the Data Deletion page.

8. Cookies

We use cookies only to keep you signed in. We do not use them for advertising tracking.

9. Contact

[Owner to fill]

10. Changes

We will notify you within the Service when we change this Privacy Policy.