Privacy policy: bellette Social Publisher

Version 1.0 · Effective 29 October 2026 · Last updated 29 October 2026

This policy is published by Bellette Media Pty Ltd (ABN 34 089 989 417) ("bellette", "we", "us"). It explains how we handle information in bellette Social Publisher (the "tool"), the social publishing tool our staff use to manage social media for our clients.

Summary

What the tool is. An internal, staff-only tool. Our staff use it to schedule and publish posts on behalf of our client businesses to Facebook Pages, Instagram professional accounts, LinkedIn, YouTube and Google Business Profile, and to see how those posts perform. Clients do not log in to it.
What we hold. The access each connected account has given the tool (access tokens), each account's name, handle and picture, the posts and media we prepare, comments clients leave on preview links, staff account details, and technical logs.
What we don't do. We don't read or collect followers' comments, messages, reviews or profiles, or any advertising data. We don't sell personal information, use it to target or measure advertising at people, or combine one client's information with another's. The tool itself contains no advertising or analytics trackers (two optional features load content from other services; see section 12).
Where it is kept. On a server in Sydney, Australia, which our sister company HutSix runs for us on Amazon Web Services. Some services we use are overseas, mainly in the United States (see Overseas recipients).
How long. While an account is connected. When we remove an account from the tool, or receive a deletion request about it, we delete its access tokens within 1 business day and, for YouTube and Google Business Profile, also revoke the tool's access with Google unless the same Google sign-in connects another account we manage. We delete the rest of its information from the tool within 7 calendar days. Our data deletion instructions explain how these times work if we first need to check a request. If access is removed on the platform instead, we delete the information within 10 days of the removal, unless the access is restored. Encrypted backup copies are deleted automatically within about 30 days of being made.
Your choices. You can ask us for access to, correction of or deletion of your information, and you can remove the tool's access on the platform at any time. See our data deletion instructions.
Contact. support@bellette.com.au (subject "Privacy request" or "Data deletion request")

1. About this policy

This policy covers personal information handled through the tool, including information we receive from Facebook, Instagram, LinkedIn, YouTube and Google Business Profile. It applies to:

people who connect a social media account to the tool (usually our staff);
people who own, run or appear in the accounts and content we manage for clients;
people who comment on a preview link we send them;
staff who use the tool.

It supplements our general Policy on Privacy. If the two differ, this policy applies to information handled through the tool. In particular, the general policy's statement that client files are kept for at least 7 years does not apply to the access tokens, account details and other platform information described here.

We handle this information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). This policy does not add to any client's obligations under our client agreement.

2. Who we are

Company: Bellette Media Pty Ltd
ABN: 34 089 989 417 · ACN: 089 989 417
Address: Suite 9, 11 Todd Street, Alice Springs NT 0870
Email: support@bellette.com.au
Phone:(08) 8953 3250

3. How the tool works

The tool is our own installation of Postiz, open-source social media scheduling software. It runs on a server set up only for this purpose. On the platforms' permission screens it appears as "bellette Social Publisher".
Only named staff of bellette, and of HutSix, which runs the tool for us, have accounts, plus one training login kept in a separate workspace that has no client accounts. Public sign-up is switched off, except during short supervised windows when we create staff accounts.
Staff connect each client's account through the platform's own sign-in and permission screen (OAuth). Sometimes the account's owner approves the connection themselves, in a session with our staff. The platform then gives the tool an access token, which lets it publish and read performance for that account. The tool never receives or stores the account's password.
Staff write posts, or our AI assistants prepare drafts for them (see section 10). A person reviews and schedules every post, and the tool publishes it at the scheduled time.
We may send a client a preview link so they can review a draft and comment on it.
The tool uses YouTube API Services to upload videos to YouTube and to read channel performance (see section 11).

4. Information we collect and hold

We collect this information:

from our staff, when they set up their accounts and use the tool;
from our clients, who give us the content to publish;
from the platforms, through their permission screen when an account is connected, and when the tool publishes or reads performance;
from people who comment on a preview link;
automatically, in our web server's logs.

Information about people who appear in content usually comes from the client, not from the person.

4.1 Connected accounts

For each Facebook Page, Instagram account, LinkedIn Page or profile, YouTube channel or Business Profile location that is connected, the tool stores:

the platform's ID for the account, Page, channel or location;
its name on the platform, and a display name our staff give it for our internal use;
its profile picture or logo (the platform's address for it, or a copy saved on the tool's server);
its public handle or profile address (for example a username or LinkedIn custom URL);
the access token, a refresh token where the platform issues one, and when the token expires;
the platform user ID of the person who connected it;
which client it belongs to, and status flags (for example "needs reconnecting");
any automatic repost or follow-up comment settings for the account (we don't use this feature).

For YouTube channels, LinkedIn Pages and profiles and Business Profile locations, the tool keeps the name on the platform, the picture and the handle only until its next daily clean-up (within a day of connecting or reconnecting); after that it keeps our staff's display name instead of the platform's name, and no picture or handle.

Most of these accounts belong to businesses, but a name, picture or handle can identify a person, for example a sole trader.

4.2 The person who connects an account

This is usually a member of our staff. During the connection, the tool reads that person's own name and profile picture from the platform and saves a copy of the picture on its server. It keeps their platform user ID. For Facebook and Instagram, it also keeps their long-lived user access token, because Meta gives the tool access to a Page through the person who connected it. For a LinkedIn Page, the access token the tool keeps is the connecting person's own LinkedIn token. Google sends the person's email address during the connection; the tool does not store it.

One LinkedIn personal profile is connected, by its owner, who is a member of our staff. When it is connected or reconnected, the tool reads that person's name, LinkedIn member ID, profile photo and public profile address; within a day it keeps only the member ID and our staff's display name, for as long as the profile stays connected.

4.3 Posts and media

The tool stores captions, titles, descriptions, tags and per-platform settings (for example the Instagram handles of collaborators, or a YouTube video's visibility), and the images, videos and thumbnails that our staff and AI assistants upload. When staff upload a file through the tool, it keeps the file's original name and any description with the media record; files our AI assistants upload are stored without their original names.

Content can show or name people; it is usually supplied by the client. Content can include sensitive information, for example a health testimonial, or images or statements that reveal a person's cultural or religious background, and it can show children. We hold and publish sensitive information only with the consent of the person concerned (or, for a child, a parent or guardian). Our client agreement requires clients to obtain the consent of the people whose images, video, audio or statements they give us. We don't use the tool to collect sensitive information for any other purpose.

So that the platforms can fetch media when a post is published, media files are stored at long, random, unlisted web addresses on the tool's server. Anyone who has one of these addresses can open the file.

4.4 Performance data

The tool reads totals such as views, reach, engagements, followers gained and clicks (details in section 5). It fetches them from the platform when a staff member looks at them, keeps them in a temporary cache for up to 1 hour, and does not store them in its database.

4.5 Preview links and comments

Anyone who has a preview link can see, without logging in: the draft post and its settings (for example collaborator handles and video tags); its media and image descriptions; the scheduled time; our internal labels for it; any error message from the platform and, once it is published, its address on the platform; the account's name, picture and handle; and the comments on the draft with the commenters' names.

To comment, a person enters a display name and their comment. We don't ask for an email address. The tool stores the name, the comment, any quoted excerpt and the time. The commenter's browser remembers the display name for next time (see section 12). The commenter's IP address is used only to limit how many requests one address can make in an hour, and it is not stored with the comment. Our web server's access log does record visitors' IP addresses (see section 4.8).

4.6 Staff accounts

For each staff account the tool stores the email address, first and last name, the password in hashed (scrambled, one-way) form, an optional profile picture and bio, timezone, when the person was last active, notification preferences and role. It also stores the IP address and web browser details recorded when the account was created.

4.7 Notifications and emails

The tool keeps in-app notifications. It emails staff about account activation, password resets, team invitations, whether posts were published or failed (sometimes as an hourly digest), and posting-streak reminders. These messages name the account and platform, and can include the platform's error message or the address of the published post. The tool does not email clients.

4.8 Logs and operational records

Web server access log: the visitor's IP address, browser details, the address requested, the result and the timing. Cookies, passwords, sign-in and invitation tokens and OAuth codes are removed before anything is logged, and the account-activation and password-reset pages are not logged at all. The tool's internal web server keeps no access log of its own.
Error records: when a post fails, the tool records the error and a copy of the post's details, which can include the connected account's access and refresh tokens (for Facebook and Instagram, including the connecting person's user token).
Application logs: technical messages from each part of the tool.
Alerts: our monitoring sends internal alerts about failed posts, accounts that need reconnecting and new client comments (see section 7).
Operations logs: technical records of what our maintenance scripts did. They identify records by ID, and our scripts don't write client, account or commenter names to them.

4.9 Client details

The tool stores each client's business name, which it uses to group that client's accounts, and our organisation name. The key that our AI assistants use to create drafts is stored encrypted.

5. What the tool accesses on each platform

Staff, or the account's owner, grant these permissions on the platform's own consent screen when they connect an account. We use them only as described here. The permission names below are the platforms' own technical names.

Facebook Pages

Permissions: pages_show_list, business_management, pages_manage_posts, pages_manage_engagement, pages_read_engagement, read_insights.
Used to: list the Pages the connecting person manages, including Pages shared with them through Meta business portfolios; publish posts, photos, videos and stories; add a first comment to our own posts; and read Page and post totals (views, engagements, follows, reactions by type and clicks).
Not used to: read comments, messages, advertising data or lists of the people who reacted.

Instagram (professional accounts linked to a Facebook Page)

Permissions: instagram_basic, instagram_content_publish, instagram_manage_comments, instagram_manage_insights, pages_show_list, pages_read_engagement, business_management.
Used to: find the Instagram accounts linked to the connecting person's Pages; publish images, carousels, reels and stories, including collaborator tags; add a first comment to our own posts; search Instagram's audio library; and read account and post totals (followers, reach, views, likes, comments, shares, saves and replies).
Not used to: read comments or messages. Posting a first comment is the only use of instagram_manage_comments.

LinkedIn (company Pages and one personal profile)

Permissions: w_member_social, r_basicprofile, rw_organization_admin, w_organization_social, r_organization_social. The standard version of the software also asks for openid and profile (used only to read the same basic profile); our updated version for LinkedIn Community Management does not.
Used to: read the connecting member's basic profile (name, photo and profile address); list the Pages that member administers; publish posts as the Page, or as the member for the personal profile; add a first comment to our own posts; look up organisations so a post can @mention them (the tool keeps the names and logos it looked up for up to 30 days, to speed up later look-ups); and read Page totals (page views, follower gains, clicks, shares, engagement and comment counts) and post totals (impressions, unique impressions, clicks, likes, comments and shares).
Not used to: fetch information about any other LinkedIn member.

YouTube

Permissions: userinfo.profile, userinfo.email, youtube, youtube.force-ssl, youtube.readonly, youtube.upload, youtubepartner, yt-analytics.readonly.
Used to: identify the Google account during the connection (its ID, name and picture; the email address is received but not stored); list the account's channels; upload videos with their title, description, tags, visibility and "made for kids" setting, and set thumbnails; and read channel and video totals (views, watch time, average view duration and percentage, subscribers gained and lost, likes and comment counts).
Not used to: read or manage comments, or use content-owner (partner) features.

Google Business Profile

Permissions: userinfo.profile, userinfo.email, business.manage.
Used to: list the Business Profile accounts and locations the connecting person manages; read a location's name, address and photo when connecting it (only the name and photo are stored); publish updates, offers and events; and read location totals (website clicks, call clicks, direction requests and Maps impressions).
Not used to: read or reply to reviews, or read customer information.

6. Why we use information

We use the information described above to:

schedule and publish content on behalf of our clients, as they instruct us;
show staff how posts and accounts are performing, so we can report to clients;
share drafts with clients for review, and act on their comments;
run, secure, monitor, troubleshoot and back up the tool, and alert staff when something fails;
respond to requests and complaints, and meet our legal obligations.

We don't use it to market to individuals, and we don't sell it, use it to target or measure advertising, build profiles of people, or combine one client's information with another client's or with information from other sources. We don't collect, export or combine information about followers or other members of the platforms. Each client's accounts are kept as separate connections, and we never combine different clients in one Page or account.

When we publish a post, its content and media go to the platform the client has chosen: Meta (Facebook and Instagram), LinkedIn, or Google (YouTube and Google Business Profile). The platform fetches the media from the tool's server. Published posts are public and available worldwide, and each platform handles them under its own terms and privacy policy.

Our service providers

HutSix(Hut Six Pty Ltd, ABN 64 641 834 344), our sister company, hosts, maintains and supports the tool for us. HutSix staff can access the server and the tool to do this.
Amazon Web Services(Sydney, Australia), in HutSix's AWS account: the server and its encrypted disks; encrypted backups (Amazon S3); the tool's stored passwords and keys (AWS Systems Manager); server performance figures only (Amazon CloudWatch); alarm emails (Amazon SNS); and the emails the tool sends to staff (Amazon Simple Email Service).
Slack(United States): the internal alert and drafts channels, in HutSix's Slack workspace. Alerts can include client business names, the label our staff give each connected account (not its name on the platform), the platform, scheduled times, preview links, a short platform error message with any token removed, and, for a new client comment, the commenter's display name and the first 300 characters of the comment. Drafts-channel messages name the client and include scheduled days and times, preview links and work ticket numbers. Neither includes the text of the post.
Google Workspace(United States and other countries): our staff email (bellette.com.au), and the mailboxes of HutSix staff who use the tool, including HutSix's support mailbox. These receive the tool's notification emails and, if Slack is unavailable, email copies of the alerts.
Our project-management provider (Atlassian), which may store data outside Australia: we track our work in Jira and in our service desk, which receives the emails sent to support@bellette.com.au. Tickets can include client names, preview links, posting schedules and the requests people send us.
AI services: we use service providers, including AI services, some of which are located in the United States, to help prepare content (see section 10).

HutSix handles the information only on our instructions, to provide its services to us, and we are putting a written agreement in place with it before any account is connected to the tool. Our other service providers handle it under their business terms, which limit how they may use it.

We may share other information with our professional advisers or insurers, or with authorities where the law requires or allows it. Information we receive from Google APIs, LinkedIn or Meta (such as access tokens, account details and performance data) is shared only with the service providers listed above, or where the law requires it.

8. Overseas recipients

Information in the tool is held in Australia, on AWS in Sydney. Some recipients are overseas:

the social platforms (Meta, LinkedIn and Google): the United States and other countries where they operate. Publishing a post also makes it available worldwide;
Slack: the United States;
Google Workspace: the United States and other countries;
our project-management provider (Atlassian): may store data outside Australia;
service providers, including AI services, that help us prepare content: some are located in the United States.

Our client agreement requires clients to obtain the consent of the people whose images, video, audio or statements they give us. We ask each client to confirm, for the content it gives us that shows a person, that the person was told, on our behalf, that the content will be published worldwide on platforms run by overseas companies (mainly in the United States), and that if they consent, Australian Privacy Principle 8.1 will not apply to that disclosure.

9. How we protect it

All connections to the tool use HTTPS.
The application and its scheduling engine accept connections only from the server itself. The server accepts only web traffic. Administrators connect through AWS's secure management service (AWS Systems Manager Session Manager), and the server has no remote-login (SSH) access open.
Public sign-up is switched off (except while we create staff accounts), and interfaces we don't use, such as the tool's MCP (AI connector) and OAuth-provider endpoints, are blocked at the web server.
Each staff member signs in to their own account with an email address and a unique password, which is stored only in hashed form. Staff accounts are not limited to particular clients, so we keep the number of accounts small.
The tool's own passwords and keys are stored as encrypted parameters in AWS Systems Manager, and its configuration files can be read only by the server's administrator account.
The server's disks are encrypted, including the disk that holds the database where access tokens are kept.
Backups are encrypted on the server before they leave it. The keys that can read them are kept in a password manager and are never stored on the server (a key is placed in the server's memory only while we test or carry out a restore), and the server has no permission to delete stored backups.
Security updates are installed automatically.
Logs stay on the server and are not sent to any outside logging or error-tracking service.

No system is completely secure. If we suspect a data breach, we will assess it promptly, and we will notify the people affected, the Office of the Australian Information Commissioner (OAIC) and the platforms where the law or the platform's terms require it.

To report a security vulnerability in the tool, email support@bellette.com.au with the subject "Security report".

10. AI assistants

We use service providers, including AI services, some of which are located in the United States, to help prepare content. Our AI assistants help prepare draft posts, captions and video edits from material our clients give us. They run outside the tool. They are set up to create drafts only, through a program we control, and to read the posts already in the tool (their text, dates, status and tags), including the drafts they made. The key they use is not technically limited to drafts, so this is a rule we enforce, and a person reviews and schedules every post.

The material we give the assistants can include images, video and text that show or name people. We use the AI services under business or API terms that do not allow the provider to use our material to train its models, and that limit how long the provider keeps it.

Our assistants are set up so that information the platforms give the tool, such as account details, lists of Pages, channels and locations, and performance data, is not given to the AI services; this is a rule we enforce. They refer to connected accounts only by internal labels that our staff set up, and we do not use information from Google APIs to train AI models.

We do not use computer programs to make decisions about individuals that could significantly affect their rights or interests.

11. Google and YouTube information

The tool uses YouTube API Services. Use of YouTube is subject to the YouTube Terms of Service, and Google's own handling of information is described in the Google Privacy Policy.
What the tool accesses, stores, uses and shares from YouTube and Google Business Profile is set out in sections 4, 5 and 7. In short: access tokens, the Google account's ID, name and picture, channel and location names and pictures, the videos and posts we upload, and performance totals, which are not stored.
Our use of information received from Google APIs, and any transfer of it to another app, will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the tool's features for the accounts that were connected. We don't sell it, use it for advertising, or use it to develop, improve or train generalised AI or machine-learning models.
Apart from an optional tutorial video embedded from YouTube and the optional image editor's content from Polotno (see section 12), no advertising or other content is served in the tool by third parties.
For cookies and device storage, see section 12.
Whoever connected a YouTube channel or Business Profile to the tool can revoke the tool's access to that Google account at any time on Google's security settings page: https://security.google.com/settings/security/permissions. If our staff connected your channel or profile, you can instead remove our staff's access, as our data deletion instructions explain. This is in addition to our own deletion procedure. If access is removed on the platform, we delete the information we hold for that account within 10 days of the access being removed, unless it is restored. If you email us, we delete it within 7 calendar days of your request (or, if we had to confirm that you are authorised to act for the account and you replied after that, within 1 business day of your reply).
We refresh or delete stored YouTube channel and Business Profile names and pictures at least every 30 days (copies in encrypted backups are not refreshed; they are used only as described in section 13, and expire as set out there).
Questions or complaints: support@bellette.com.au.

12. Cookies and similar technologies

Staff: when a staff member signs in, the tool sets session cookies (auth and showorg, plus impersonate when an administrator views the tool as another user). They are marked Secure and HttpOnly, and they keep the person signed in for up to a year or until they sign out. Accepting a team invitation sets a short-lived invitation cookie (org, 15 minutes), and changing the interface language sets a language cookie (i18next). The tool also uses the browser's local storage to remember a staff member's settings, such as timezone, units, interface language and which panels are open.
People who comment on a preview: the browser's local storage remembers the display name you entered, so you don't have to type it again, and may also remember the interface language. You can clear it in your browser settings.
The tool uses no advertising, analytics or tracking cookies of its own, and no third-party trackers, pixels, error-tracking or chat services.
Two optional features load content from other services: the onboarding tutorial video is embedded from YouTube, and the image editor ("Design Media") loads content from Polotno. If staff open them, those services receive the staff member's IP address and browser details, and may set their own cookies.

This section covers the tool only. These pages are on our public website, which is covered by our general Policy on Privacy.

13. How long we keep information

"Days" means calendar days unless we say business days.

Access tokens and account details: while the account is connected. Meta access has to be renewed by reconnecting about every 60 days. LinkedIn access lasts about 60 days; where LinkedIn issues a refresh token, the tool renews it automatically for up to a year, and it is then renewed by reconnecting. Google access tokens last about an hour and are renewed automatically while the account is connected.
Names and pictures from YouTube, LinkedIn and Google Business Profile: the account's own name is replaced with our staff's display name, and its picture and handle are deleted, within a day; the names and logos of LinkedIn organisations looked up for @mentions are deleted within 30 days; in any case these are refreshed or deleted at least every 30 days (copies in encrypted backups are not refreshed; they are used only as described under Backups below, and expire as set out there).
Copies of connecting people's profile pictures that are no longer in use: deleted at least every 30 days.
After we remove an account from the tool, or receive a deletion request: access tokens are deleted within 1 business day (the same day when our staff remove the account themselves), and for YouTube and Google Business Profile access is also revoked with Google unless the same Google sign-in connects another account we manage; everything else is deleted from the tool within 7 calendar days, as set out in our data deletion instructions.
If access is removed on the platform: deleted within 10 days of the access being removed, unless it is restored.
Accounts connected by a staff member who leaves: within 7 calendar days of their access ending, another staff member reconnects them or we disconnect them, and the departing person's platform user ID, access token and profile picture are deleted.
Posts, media and preview comments: kept while the client uses our social media services, so we have a record of what was published. They are deleted with the account's information, or within 7 calendar days after the engagement ends. Before deleting them at the end of an engagement, we offer the client a copy of its unpublished drafts, media and comments, as our client agreement requires.
Performance data: not stored; cached for up to 1 hour.
Short-lived sign-in, upload and rate-limit data: up to 1 hour.
Scheduling-engine records(which hold a copy of each scheduled post and its account's access details): kept while the post is scheduled, then deleted automatically within 7 days after it is published or cancelled. If the scheduling engine can't be reached when a post is cancelled, its record is deleted within 7 days after the time the post was scheduled for. When we process a deletion request, we end that account's scheduled jobs straight away.
Error records and in-app notifications: deleted after 30 days, or sooner with the account's information.
Slack alerts and drafts-channel messages: deleted automatically after 30 days.
Jira and service-desk tickets: kept as our work records. When we process a deletion request, we delete the ticket comments that name the account or the commenter, except our record of the request itself and our reply.
Alert and notification emails in staff mailboxes: kept only while staff need them for their work, and searched for and deleted when we process a deletion request.
Staff accounts: kept while the person works with us. When they leave, we remove their access straight away and delete or de-identify their account record within 90 days.
Web server access logs: deleted within about 30 days.
Application logs: deleted within about 30 days.
Operations logs: deleted within about 30 days.
Backups: made nightly and encrypted. The 7 newest are also kept on the server, and older ones there are deleted as new ones are made. Each copy stored in Amazon S3 in Sydney is deleted automatically within about 30 days of being made. Backups are used only to recover from a failure and, in an isolated copy that is deleted the same day, to test that recovery, software upgrades and our deletion and reconnection procedures work. If we ever restore one, we repeat every deletion made since that backup before the restored tool is used.
Disk snapshots taken before a software upgrade: deleted within 14 days.
Restore tests: each month we test a backup in an isolated copy on the server that cannot send data out (it can only download database software), and delete the copy the same day.
If we stop using the tool: we revoke its access on every platform and delete everything in it within 7 calendar days, and its backups expire as described above.

14. Access, correction and complaints

Access and correction: email support@bellette.com.au with the subject "Privacy request" to ask for a copy of the personal information we hold about you, or to correct it. It is free to ask. We may need to confirm your identity first. We will respond within 30 days, and if we can't do what you ask, we will tell you why and how to complain.
Deletion and withdrawing consent: see our data deletion instructions. You can also remove the tool's access on the platform at any time.
A copy of this policy in another format is free on request.
Complaints: email support@bellette.com.au with the subject "Privacy request", or write to us at the address in section 16, with the details. We will acknowledge your complaint within 2 business days, look into it (we may ask you for more information), and tell you the outcome and our reasons in writing within 30 days. If you are not satisfied with our response, or we haven't responded within 30 days, you may be able to complain to the Office of the Australian Information Commissioner (OAIC). The OAIC accepts complaints in writing only: use its online complaint form, email oaicintake@oaic.gov.au, or post to GPO Box 5288, Sydney NSW 2001. For enquiries, phone 1300 363 992 (Monday to Thursday, 10 am to 4 pm). More information: www.oaic.gov.au.

15. Changes to this policy

We will post any update on this page with a new version number and date. If we change how we use information received from Google, Meta or LinkedIn, we will tell the people who connected those accounts before the change takes effect, and ask them to agree again where the platform requires it.

16. Contact us

Bellette Media Pty Ltd (ABN 34 089 989 417)
Suite 9, 11 Todd Street, Alice Springs NT 0870
support@bellette.com.au · (08) 8953 3250