Privacy Policy

Next Step L.L.C-FZ (“we”, “us”) operates Ravenpost, a tool that helps you schedule and publish content to Instagram, TikTok, X, Telegram, LinkedIn, Threads, Bluesky, YouTube and Pinterest. This policy explains what we collect, how we use it, and your choices.

Next Step L.L.C-FZ is the data controller for the personal data described below. It is a limited liability company registered in Dubai, United Arab Emirates, with its principal office at Meydan Grandstand, 6th Floor, Meydan Road, Dubai, United Arab Emirates.

Information we collect

• Account data — your name, email, and profile image, provided via our authentication provider (Clerk).
• Connected social accounts — when you connect an account, page or channel on any supported platform, we receive that platform’s account ID, username, profile picture, and an access token (for Telegram, the channel id and our central bot’s token; for Discord, the webhook URL). We use these solely to publish content you create and to fetch analytics for your own accounts.
• Content you create — captions, media you upload, and scheduling details.
• Billing data — handled by Polar, our merchant of record; we store only a customer/subscription reference, never card numbers.

How we use information

• To publish and schedule the posts you create, on your behalf.
• To show analytics for the accounts you connect.
• To operate, secure, and improve the service.

We never sell your data, never share it for advertising or lending, and never use your content — or any data we receive from a platform you connect — to develop or train generalized artificial intelligence or machine learning models.

Data sharing

We share data only with the processors needed to run the service: the API of each platform you choose to connect (Instagram, TikTok, X, Telegram, LinkedIn, Threads, Bluesky, YouTube and Pinterest), Clerk (authentication), Polar (billing and merchant of record), and Cloudflare R2 (media storage). Nothing is sent to a platform you have not connected.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, and we use encryption to protect it both in transit and at rest.

• Encryption in transit — every connection to Ravenpost, to our API, and onward to each platform’s API is served over HTTPS.
• Encryption at rest — every access and refresh token we hold, on every platform including YouTube, is encrypted with AES-256-GCM before it is written to our database. The encryption key lives in the server environment, never in the database and never in our source code, so a copy of the database on its own yields no usable credential. Uploaded media is stored in Cloudflare R2, which encrypts objects at rest.
• Credentials are never exposed — a stored platform token is never returned by our API, never sent to the browser, and never shown in our own internal administration tools. Personal API tokens are stored only as a SHA-256 hash; the plaintext is shown once, when it is created, and cannot be recovered afterwards.
• Access control — users are authenticated by Clerk, and every request is re-checked against the workspace it addresses, so one customer’s data is not reachable from another customer’s session. Administrative access to production systems is limited to the people who operate the service.
• Least privilege — we request the narrowest permission scopes each platform offers for what the product actually does. On YouTube that is upload access plus read-only access to your own channel’s name and picture; we deliberately do not hold the broader channel-management scopes.
• Payment data — card details are entered directly with Polar and its payment processor, and never reach our servers.

Data retention & deletion

We keep data only as long as the service needs it.

• Connected accounts and their tokens — kept while the account is connected. Disconnecting it immediately deletes the token and the stored platform profile data, together with that account’s scheduled targets and analytics.
• Posts and uploaded media — kept until you delete them, or until your account is deleted.
• Analytics snapshots — deleted automatically 180 days after they are collected.
• Your account — to delete it and everything associated with it, email support@ravenpo.st and we will erase it within 30 days.

For Instagram and Threads we also honor Meta’s automatic deauthorize and data-deletion callbacks. See our Data Deletion page for all the ways to remove your data.

YouTube API Services

Our YouTube integration uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s handling of any data it receives is governed by the Google Privacy Policy.

We use the API only to publish on your behalf. We read your channel’s name and picture once, when you connect it, so you can see which channel is linked, and we upload the videos you schedule to that channel with the title, description and privacy setting you chose. We hold no permission to change or delete anything on your channel: deleting a post in Ravenpost removes our own copy, and the video stays on YouTube until you remove it there yourself. We do not read, display or download anyone’s YouTube content, and we do not use the YouTube player.

From YouTube we store only your channel id, channel name, channel picture, an encrypted access token, and the id and link of each video we published for you. That data is protected by the measures described under How we protect your data above: the token is encrypted with AES-256-GCM at rest, it travels only over HTTPS, it is never returned by our API or shown in our administration tools, and no YouTube data is used for advertising or to train AI or machine learning models.

You can revoke our access at any time from Google’s security settings page. Disconnecting the channel in Ravenpost deletes everything listed above immediately; revoking access at Google stops us publishing, and disconnecting the channel (or emailing us) removes what we stored.

Cookies

We use strictly necessary cookies for authentication and session management. We do not use advertising cookies.

Contact

Questions? Email support@ravenpo.st, or write to Next Step L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Dubai, United Arab Emirates.