Privacy Policy

Welder (weldergtm.com) is operated by Vladislav Smirnov, based in the United Kingdom, who is the data controller for personal data processed through Welder. You can reach us at hello@weldergtm.com for anything in this policy.

This policy covers the Welder website, the web app and the Welder MCP server that your agents connect to.

• Account details: your email address and, if you sign in with Google, your name and profile picture. To sign in, you confirm that you’re 13 or older and, if you’re under 18, that a parent or guardian has agreed to our Terms and given you permission. We don’t ask for your date of birth, identity documents or a parent’s contact details.
• Workspace details: your workspace name, publishing defaults, notification choices, setup progress, plan and monthly usage.
• Connected social accounts: each account’s ID, username, display name and avatar, plus the access and refresh tokens the network issues (for Bluesky, the app password you enter). Tokens are encrypted at rest with AES-256-GCM and are never shown to your agent.
• What you publish: the media files your agent uploads or imports, captions, titles, per-network options and schedule times, and what each network returns (post IDs, links and errors).
• Agent access: the names of the MCP clients you approve, API key names and prefixes (the keys themselves are stored only as hashes), and the client name and version your agent reports when it connects, with last-used times.
• Billing: payments are handled by Stripe. We store your Stripe customer and subscription IDs, plan, status and billing dates. We never see or store your full card number.
• Email records: which transactional emails we sent you and whether they were delivered.
• Technical data: IP address and request details in server logs, used for security, rate limiting and fixing problems. Logs never contain your tokens or captions. With your permission, Yandex Metrica uses browser identifiers and cookies to measure public-page visits and successful new registrations from our ads. It does not record screens, form inputs, captions, account IDs or authentication tokens. You can reject optional analytics or change your choice using Cookie preferences on this page.

• To provide Welder (performance of our contract with you): signing you in, connecting your accounts, storing media, publishing to the networks you choose, and showing you the results.
• To bill you (contract and legal obligation): subscriptions, invoices and tax.
• To keep Welder safe (our legitimate interests): rate limits, abuse prevention and protecting your accounts.
• To email you about your account (contract): sign-in codes, trial and payment notices, reconnect requests and, if you keep them on, daily summaries of failed posts. You can turn failure summaries off in Settings.
• To make Welder more reliable (our legitimate interests): aggregate, content-free metrics such as how many posts fail per network.

Optional advertising measurement uses your consent, which you can withdraw at any time using Cookie preferences.

We don’t sell or rent personal data, we don’t use your content to train AI models, and we don’t send marketing email.

We use a small set of service providers, each bound by a data processing agreement:

• Supabase: database, sign-in and file storage (EU and US).
• Vercel: hosting and serverless compute (Frankfurt region, with parts of its network in the US).
• Stripe: payments, invoices and tax calculation.
• Resend: delivery of transactional email.
• Google: sign-in, if you choose “Continue with Google”.

With your consent, Yandex Metrica provides optional advertising measurement. It loads only after you allow analytics cookies. Yandex privacy policy.

When you publish, we send your content and the needed token to each network you picked (TikTok, Instagram, YouTube, Threads, Bluesky or X) through its official API. From then on, that network’s own privacy policy applies to what it receives. We may also disclose information when the law requires it.

Posts you approve can be public. By default Welder publishes as publicly as each account allows: TikTok posts are visible to everyone (or as widely as a private account allows), YouTube videos are public, and posts on Instagram, Threads, Bluesky and X are as visible as the account they’re posted from. You can change the TikTok and YouTube defaults in Settings, or ask for a different setting on a single post.

Anyone may be able to see, share, save or comment on a public post, and each network’s own settings and policies decide who sees it. Posts already published stay on the network until they’re deleted there, even if you delete your Welder workspace. Before you approve a post, check what it shows and says, including faces, names and places, and who will be able to see it. If you’re under 18, take extra care with personal details such as your full name, your school or where you live.

Some providers process data in the United States. Where they do, transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or by an adequacy decision such as the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

• Original media files: deleted automatically 7 days after upload, or 7 days after the scheduled posting time for scheduled posts. A source may be kept briefly while its small preview is being saved.
• Posts, results and previews: captions, posting results, file metadata and one small image per media post are kept while your workspace exists, so you can see your history; deleted with the workspace. Full videos and photos are not kept in this history.
• Social account tokens: until you disconnect the account (which erases them) or delete the workspace.
• After a subscription ends: we keep your workspace for 30 days in case you return, then delete stored original media. Your connections, saved previews and history stay until you delete the workspace.
• Billing records: as long as tax law requires (in the UK, up to six years).
• Server logs: short-lived, typically up to 30 days.

Under UK and EU data protection law you can ask to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. Email hello@weldergtm.com from the address on your account and we’ll reply within one month. You can delete everything yourself at any time; see Data deletion.

Everyone who uses Welder has these rights, including teens aged 13 to 17, who can contact us themselves.

If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Welder’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Welder uses YouTube API Services to upload videos you ask it to publish. By connecting a YouTube channel you agree to the YouTube Terms of Service, and Google’s Privacy Policy applies to Google’s handling of your data. You can revoke Welder’s access anytime at Google security settings.

Traffic is encrypted in transit (TLS). Social tokens and refresh tokens are encrypted at rest, API keys and OAuth tokens are stored only as hashes, access to production systems is limited, and account changes such as connections, keys and agent approvals are written to an audit log.

• Under 13: Welder isn’t for children under 13. We don’t knowingly provide it to them or collect their personal data. If we learn that we have, we’ll close the account and delete that data within 30 days, except records the law requires us to keep; posts it already published stay on each network until they’re deleted there. If you think a child under 13 is using Welder, email hello@weldergtm.com.
• 13 to 17: teens can use Welder with a parent or guardian’s permission, as our Terms explain. They have the same privacy rights as everyone else and can contact us themselves. A parent or guardian can also contact us with questions about a teen’s use of Welder.
• Age confirmation: we rely on the confirmation given at sign-in. We don’t verify ages or check who a parent or guardian is.

If we change this policy in a way that matters, we’ll email you before the change takes effect. The date at the top shows the latest version.