Privacy Policy

1. Introduction

stxcel ("we", "us", "our") operates the stxcel platform at stxcel.co.ke. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service.

We are committed to protecting your privacy and complying with applicable data protection laws, including Kenya's Data Protection Act 2019.

2. Information We Collect

2.1 Account Information

• Email address and hashed password
• Display name and profile preferences
• Billing information (processed by third-party payment provider — we never store raw card data)

2.2 TikTok OAuth Data

When you connect your TikTok account, we receive and store:

• TikTok user ID and display name
• Encrypted OAuth access token and refresh token
• Authorised scopes: video.publish, user.info.basic

We never receive or store your TikTok password.

2.3 Content Data

• AI-generated slide text and images created for your posts
• Captions, hashtags, and posting schedules you configure
• Post history, IDs, and performance data returned by TikTok's API

2.4 Usage & Technical Data

• IP address, browser type, and device information
• Pages visited, features used, and time spent
• Error logs and API call logs (for debugging)

3. TikTok Data Handling

stxcel's use of TikTok data is strictly limited to operating the Service. Specifically:

Data	Purpose	Retained?
TikTok User ID	Link your stxcel account to your TikTok account	Until you disconnect
OAuth Access Token	Authenticate API calls to post on your behalf	Encrypted; refreshed every 24h
OAuth Refresh Token	Obtain new access tokens without re-authorisation	Encrypted; deleted on disconnect
Post IDs & Metadata	Track published content in your dashboard	Until account deletion
Engagement Metrics	Show analytics (views, likes) in dashboard	90 days rolling

We never access your TikTok DMs, followers list, comments, or any data beyond what is required for the video.publish and user.info.basic scopes.

You can revoke stxcel's access at any time via TikTok Settings → Security → Connected Apps.

4. How We Use Your Data

• Providing and operating the stxcel platform and its features
• Generating AI content via Google Gemini on your behalf
• Publishing posts to TikTok using the Content Posting API
• Sending service notifications, security alerts, and billing receipts
• Analysing aggregate usage to improve the platform
• Detecting and preventing fraud, abuse, or policy violations
• Complying with legal obligations

We do not use your data for advertising, sell it to data brokers, or use it for any purpose unrelated to operating stxcel.

5. Data Sharing & Third Parties

We share limited data with these third-party service providers solely to operate the Service:

Provider	Purpose	Data Shared
TikTok	Posting content via Content Posting API	OAuth token, image URLs, captions
Google (Gemini API)	AI content generation	Content prompts (no personal data)
Supabase	Database and authentication	Account data, post logs
Cloudflare R2	Image storage and CDN	Generated carousel images
Railway	Cloud hosting and automation	Application runtime data

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

6. Data Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted using HTTPS/TLS 1.3
• OAuth tokens are hashed using bcrypt before storage — never stored in plain text
• Passwords are salted and hashed with bcrypt (cost factor 12)
• Database access is restricted by row-level security policies
• Regular security audits and dependency vulnerability scans
• Cloud infrastructure with automatic backups and disaster recovery

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it immediately to security@stxcel.co.ke.

7. Data Retention

• Account data — retained for the life of your account, deleted within 30 days of account closure
• OAuth tokens — deleted immediately upon TikTok disconnection
• Post content & images — retained for 12 months, then archived or deleted
• Analytics data — retained for 90 days rolling
• Logs — retained for 30 days for debugging, then purged

8. Your Rights

Under Kenya's Data Protection Act 2019 and applicable laws, you have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Objection — object to specific types of data processing
• Withdrawal of consent — revoke TikTok OAuth access at any time

To exercise any of these rights, contact privacy@stxcel.co.ke. We will respond within 14 days.

9. Cookies

stxcel uses minimal, essential cookies only:

• Session cookie — keeps you logged in during your visit (expires on browser close)
• CSRF token — protects against cross-site request forgery attacks
• Preference cookie — remembers your dashboard layout settings

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You may disable cookies in your browser settings, but some features may not function correctly.

10. Children's Privacy

stxcel is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with their data, please contact privacy@stxcel.co.ke immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or prominent in-app notice at least 14 days before the changes take effect. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Continued use of stxcel after the effective date of any changes constitutes your acceptance of the revised Policy.

12. Contact Us

For any privacy-related questions, data requests, or concerns:

• Privacy email: privacy@stxcel.co.ke
• General support: support@stxcel.co.ke
• Website: stxcel.co.ke
• Address: Nairobi, Kenya