Privacy Policy

Who we are

Queuarium is a social media scheduling and analytics service operated by Quantum Solutions d.o.o., Ulica don Frane Bulića 2, Popovec, 10360 Sesvete, Croatia (VAT ID HR32713130038). We are the data controller for the personal data described here. You can reach us at queuarium@quantum-solutions.hr.

This policy explains what we collect, why, who we share it with and how long we keep it. It applies to queuarium.com and the Queuarium API.

What we collect

Account data

Your name, email address, a hashed password, workspace names and your plan. We need this to give you an account and to bill you.

Data from the social networks you connect

When you connect a channel, the network asks for your permission and then gives us an access token. We never see or store your password for that network. For each connected account we store the access and refresh tokens (encrypted), the account identifier, display name, username, profile picture and, where the network provides it, public statistics such as follower and video counts. We use this to show you which account is connected and to publish and measure on your behalf.

For TikTok specifically, we request only what the product needs: your basic profile and username so you can tell your connected accounts apart, your account statistics and the list of videos we published for you so we can show their performance, and permission to post the content you schedule. We do not read your private videos, your direct messages or anyone else's data, we do not build advertising profiles, and we do not use TikTok data to train machine learning models.

Content you upload

The text, images and video you compose, together with your schedule. We store this so we can publish it at the time you chose and show you what happened.

Usage and technical data

Two cookies, both strictly necessary: q_session keeps you signed in (30 days, or until you log out) and q_workspace remembers which workspace you have open (30 days). We use no analytics, advertising or third-party cookies. Server logs contain IP addresses, timestamps and error details, which we use to keep the service secure and working.

Payment data

Card details are handled entirely by Stripe and never reach our servers. We store the billing details required on an invoice, the amount, and the identifiers Stripe returns.

YouTube API Services

Queuarium uses YouTube API Services to publish videos to the YouTube channels you connect and to show you how they performed. By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

What we access

We ask for the two narrowest scopes that let the product work, and nothing else:

• youtube.upload — to upload the video you composed to your own channel at the time you scheduled, with the title, description, tags and visibility you chose.
• youtube.readonly — to read your channel's name, avatar, subscriber and video counts, and the view, like and comment counts of videos we published for you, which we show on your Analytics page.

We do not read channels or videos other than your own, we do not access comments or private videos, and we do not use the YouTube Analytics API.

What we store, and for how long

• Access and refresh tokens for the connected channel, encrypted, until you disconnect it or close your account.
• The channel name and avatar, refreshed from YouTube several times a day rather than kept as a stale copy.
• Public statistics (views, likes, comments, subscriber counts) for up to 36 months, so your history charts work. Your plan decides how much of it is shown.

Revoking access

You can disconnect a YouTube channel at any time from the Channels page in Queuarium. That revokes Queuarium's access at Google and immediately deletes the tokens, the channel details and every statistic we collected for the channel. If the same channel is still connected in another Queuarium workspace, Google's access stays in place for that workspace until it is disconnected there too. You can also revoke Queuarium's access directly from your Google account at https://security.google.com/settings/security/permissions; if you do and do not reconnect, we delete the same data within 30 days. Revoking access stops all future publishing to that channel; videos already published stay on YouTube and are managed by you in YouTube Studio.

We do not sell YouTube data, do not use it for advertising, and do not use it to train machine learning models.

Queuarium's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram and Facebook

Queuarium uses the Instagram Platform and the Facebook Graph API to publish to the Instagram professional accounts and Facebook Pages you connect, and to show you how those posts performed. Meta's own handling of your information is described in the Meta Privacy Policy.

What we access

• Instagram — your professional account's profile and media (instagram_business_basic), permission to create the posts you compose (instagram_business_content_publish), and the view, like, comment and reach figures for those posts (instagram_business_manage_insights).
• Facebook — the list of Pages you manage (pages_show_list), permission to publish the posts you compose to a Page you chose (pages_manage_posts), and the Page and post statistics we show you (pages_read_engagement, read_insights). business_management is used only to find the Pages you manage through a business portfolio, which Facebook does not list otherwise; Queuarium does not read or change anything else in your Business Manager.

We do not read your direct messages, we do not access other people's accounts, we do not use Instagram or Facebook data for advertising or to build advertising profiles, and we do not use it to train machine learning models.

What we store, and for how long

• Access tokens for the connected account or Page, encrypted, until you disconnect it or close your account.
• The account name, username, profile picture and follower count, refreshed from Meta rather than kept as a stale copy.
• Statistics for the posts we published for you, for up to 36 months. Your plan decides how much of it is shown.

Deleting this data

Disconnect the account on the Channels page and the tokens, the account details and every statistic we collected for it are deleted immediately. You can also remove Queuarium from your Facebook or Instagram settings, and Meta will tell us; we then delete the same data for every matching account automatically. Full instructions, and a page for checking a deletion request, are at queuarium.com/data-deletion.

Pinterest

Queuarium uses the Pinterest API to save the Pins you compose to the boards you choose, and to show you how they perform. Pinterest's own handling of your information is described in the Pinterest Privacy Policy.

What we access

• Your account's username (user_accounts:read), so you can tell your connected accounts apart.
• Your boards (boards:read, boards:write), listed when you compose so you can choose where a Pin goes.
• Permission to create the Pins you compose, with their title, description, link and alt text, and to read their statistics (pins:read, pins:write).

What we store, and for how long

• Access and refresh tokens, encrypted, the account's Pinterest ID and username, until you disconnect the account or close your Queuarium account.
• The board you chose for each post and the IDs of the Pins Queuarium created for you, as part of your post history.

We do not store anything else read from Pinterest. Your boards are listed fresh each time you compose, and Pin statistics are read from Pinterest when you open a post and shown without being saved. We do not read other people's accounts, do not use Pinterest data for advertising, do not combine it with other accounts' data, and do not use it to train machine learning models.

Deleting this data

Disconnect the account on the Channels page and the tokens and account details are deleted immediately. To withdraw Queuarium's access at Pinterest as well, remove Queuarium from the apps that have access to your account in your Pinterest settings.

Why we are allowed to use it

• To perform our contract with you: running your account, publishing your posts, collecting your analytics, taking payment.
• To comply with the law: issuing and keeping invoices, and reporting them to the Croatian tax authority as required for card payments.
• Our legitimate interests: keeping the service secure, preventing abuse and fixing faults.

Connecting a channel is something you ask us to do as part of that contract: the network asks you to authorise Queuarium, and you can withdraw that authorisation at any time by disconnecting the channel. You need an email address and a password to have an account, and billing details to buy a paid plan (the law requires them on invoices); connecting channels is optional, but we cannot publish to a network you have not connected. We do not make decisions about you based solely on automated processing.

Who we share it with

We do not sell personal data and we do not share it for advertising. These service providers process data for us, under contracts that oblige them to protect it:

Data also goes to others who decide for themselves how to use it, under their own terms and privacy policies:

• TikTok, Google (YouTube), Meta (Instagram, Facebook) and Pinterest: what you publish, and the requests we make on your behalf to the channels you connected.
• Stripe, for its own fraud prevention and legal obligations.
• The Croatian Tax Administration: invoice details, as fiscalization law requires.
• The other members of a shared workspace, who see its channels, posts and statistics.
• Services you connect yourself through the Queuarium API, webhooks or n8n, which receive what you send them or ask us to send them.
• Authorities, where the law requires it, for example in response to a valid legal order.

Our hosting is in the EU. Stripe and Google may process data in the United States; those transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Amazon Web Services may access data from outside the EU only to provide support or security, under the Standard Contractual Clauses.

How long we keep it

• Account and content data, and data obtained from YouTube, TikTok, Instagram, Facebook and Pinterest: while your account is open. Deleting your account (Settings → Profile → Delete account) removes it immediately; if you ask us by email instead, data from the networks is deleted within 7 days and everything else within 30 days.
• Database backups: overwritten within 7 days, so deleted data leaves them within that time.
• Uploaded media: 180 days, after which the file is removed from our storage. Posts already published stay on the network itself.
• Channel tokens, details and statistics: until you disconnect the channel or close your account, whichever is first, and at most 30 days after the network stops granting us access.
• Invoices and the records behind them: 11 years, because Croatian accounting law requires it.
• Server logs: up to 90 days.
• Records of data deletion requests sent by Meta (confirmation code, the account's Meta ID, dates): 3 years.
• Emails you send us: as long as needed to handle your request, and at most 3 years.
• Links we email you expire: email confirmation after 24 hours, password reset after 1 hour, team invitations after 7 days.

Your rights

Under the GDPR you may ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Write to queuarium@quantum-solutions.hr and we will answer within one month (for complex requests we may extend this by two more months, and will tell you so within the first month). Where we rely on our legitimate interests, you may object to that use at any time. You can disconnect any channel yourself at any time, which deletes everything we hold from that network for it, and you can delete your whole account yourself under Settings → Profile → Delete account, or ask us to by writing to the same address. If you think we have handled your data badly you can complain to the Croatian Personal Data Protection Agency (AZOP) or to the authority where you live.

Security

Traffic is encrypted in transit with TLS. Access tokens and other secrets are encrypted at rest with AES-256-GCM. Passwords are stored only as bcrypt hashes. The database is encrypted and not reachable from the public internet. Access to production is limited to the operator of the service.

If you find a security vulnerability, please report it to queuarium@quantum-solutions.hr (see also security.txt).

Children

Queuarium is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy we will update the date at the top and, for anything significant, email you before it takes effect.