Avitoholius Privacy Policy

Effective date: 18 October 2026

This policy explains what personal data AVITOHOLIUS LTD. processes when it provides Avitoholius, our content service for businesses, and when you visit avitoholius.com. It says why we process the data, how long we keep it and what rights you have. It covers the YouTube, Facebook, Instagram and TikTok accounts that businesses connect to Avitoholius. By connecting an account to Avitoholius, you agree to this policy.

1. Who we are

The data controller is AVITOHOLIUS LTD. (АВИТОХОЛИЙ ЕООД), a company registered in Bulgaria.

• UIC: 208601085
• VAT number: BG208601085
• Registered address: 1 Atanas Dukov Street, floor 6, Lozenets, 1407 Sofia, Bulgaria
• E-mail: contact@avitoholius.com or avitoholius@gmail.com

In this policy, "we" and "us" mean AVITOHOLIUS LTD., "the business" means a client business that uses Avitoholius, and "you" means any person whose personal data we process.

2. How Avitoholius works

A business connects its own accounts to Avitoholius through each platform's official consent screen: Google's consent screen for YouTube, Meta Business access for Facebook and Instagram, and TikTok Login Kit for TikTok. Our team prepares the content. A person approves every single item in the Avitoholius app before anything is sent to a platform. Nothing is published automatically. We never ask for, and never store, the passwords to your accounts.

3. What data we process

• Contact data: names, e-mail addresses and messages of the people at the business who deal with us, and of anyone who writes to us.
• Account connection data: the access tokens each platform issues when an account is connected (and, where the platform issues one, the refresh token used to renew that access), and the account's identifier and name (details for each platform are in Sections 9 to 11).
• Content: videos, images and captions that the business provides or approves. Content may show or name people.
• Platform data: the status of content we sent and, for YouTube, Facebook and Instagram, basic statistics about the business's own channel, Page or posts, received through the platforms' APIs.
• Website visit data: when you open avitoholius.com, the company that hosts our website receives your IP address and basic request data (for example your browser type and the page requested), which is needed to deliver the page. The page loads its fonts from Google Fonts, so Google also receives your IP address when the page loads. The website sets no cookies and contains no tracking or analytics scripts.

Account connection data and platform data come from the platforms when the business connects an account. Website visit data comes from your browser. All other data comes from the business itself or from the person who writes to us.

We do not collect passwords. We do not seek out or infer sensitive information such as health, gender identity, sexual orientation, political or religious beliefs, racial or ethnic origin, financial status or criminal history. Such information can appear only incidentally, if it is visible in content the business provides, and we use it for nothing other than preparing and delivering that content. We do not build profiles of viewers, followers or commenters, and we do not collect data about other channels or accounts through the platforms' APIs.

4. Why we use the data and our legal basis

• Delivering the service (connecting the business's accounts, preparing content, getting approval and sending approved content to those accounts). Data: account connection data, content, platform data. Legal basis: performance of our contract with the business (Art. 6(1)(b) GDPR). Where the person who connects an account or appears in content is not personally our contracting party, the legal basis is our legitimate interest, and the business's, in providing the service the business ordered (Art. 6(1)(f) GDPR).
• Reporting results to the business. Data: platform data. Legal basis: performance of our contract with the business (Art. 6(1)(b) GDPR); where the data relates to a person who is not personally our contracting party, our legitimate interest, and the business's, in receiving reports on the business's own accounts (Art. 6(1)(f) GDPR).
• Communicating with the business and answering messages. Data: contact data. Legal basis: performance of our contract (Art. 6(1)(b) GDPR) where you are personally our contracting party (for example, a sole trader); otherwise our legitimate interest in communicating with our client businesses and answering enquiries (Art. 6(1)(f) GDPR).
• Operating the website. Data: website visit data. Legal basis: our legitimate interest in delivering the website to its visitors (Art. 6(1)(f) GDPR).
• Meeting legal obligations, where the law requires us to keep or disclose data. Legal basis: Art. 6(1)(c) GDPR.

Authorising Avitoholius on a platform. An account is connected only after the account holder authorises Avitoholius on the platform's own consent screen. This authorisation is the platform's permission for us to act on the account; our legal basis under the GDPR is the one stated above for each purpose. The account holder can revoke it at any time (Section 12). After that we stop all processing through that connection and delete the data as described in Section 7.

Connecting an account is not a legal requirement. Without it, however, we cannot deliver content to that platform.

We use the data only for the purposes above. We do not use it for advertising or resale. We do not make decisions about anyone by automated means alone, and we do not use profiling.

5. Who receives the data

• The platforms. YouTube (Google), Meta (Facebook and Instagram) and TikTok receive the content the business approved and our requests to their APIs. They handle this data under their own terms and privacy policies.
• Our e-mail providers. Messages sent to avitoholius@gmail.com are handled by Google, and messages sent to contact@avitoholius.com by the provider that hosts the avitoholius.com mailbox. They handle our correspondence so that we can send and receive e-mail.
• Our media file host. To publish a video or image, the platform (or our system, before uploading it) must fetch the file from a web address. For this we upload each media file that the business has approved for publishing to a third-party file-hosting service, Catbox (catbox.moe), which gives the file an unlisted web address. Only approved content intended for publication is uploaded there; tokens and account data never are.
• Our website host and Google Fonts. The company that hosts avitoholius.com, and Google as the provider of the website's fonts, receive website visit data as described in Section 3.
• Public authorities, only where the law requires disclosure. In that case we tell the business, unless the law prevents us from doing so.

Within our company, only the team members who operate Avitoholius have access to the data. Apart from the recipients listed above, we do not sell, rent, trade or otherwise share personal data with any third party. Access tokens are never shared with third parties. Avitoholius shows no advertising and does not allow any third party to serve content or ads through it.

6. International transfers

The Avitoholius desktop app, access tokens, platform data and content are kept on AVITOHOLIUS LTD’s own computers. The only exception is approved media files placed on our media file host (Section 5), which may store them outside the European Economic Area. Google (for our Gmail mailbox, for YouTube and for the website's fonts), Meta and TikTok may process the data they receive in the United States and in other countries outside the European Economic Area. Those companies make these transfers under their own terms and the safeguards described in their privacy policies.

7. How long we keep data

• YouTube platform data (channel statistics, video status and statistics): no longer than 30 days. After that it is deleted or refreshed from the YouTube API.
• Facebook and Instagram post results, and the TikTok publish_id and its status: for the duration of our engagement with the business.
• Access and refresh tokens: while the account is connected.
• Approved media files on our media file host: these files are intended for publication. The file host keeps them under its own terms, and we cannot guarantee that it deletes them; for this reason we place nothing there except content the business has approved for public posting.
• Account identifiers and names: for YouTube (the channel ID and title), no longer than 30 days, after which they are deleted or refreshed from the YouTube API; for Facebook, Instagram and TikTok, while the account is connected.
• Content: for the duration of our engagement with the business.
• Contact data and correspondence: for the duration of the engagement and as long as needed to answer a request, unless the law requires us to keep it longer.
• Website visit data: in the server logs of the company that hosts our website, for the period that company sets. Google handles font requests under its own privacy policy.

Within 7 days after access to an account is revoked, we delete the tokens and all data obtained through that connection, whatever the periods above.

8. Your rights

Under the GDPR you have the right to:

• access: ask whether we process your data and get a copy of it;
• rectification: have inaccurate or incomplete data corrected;
• erasure: have your data deleted, unless we must keep it to comply with a legal obligation or to establish, exercise or defend legal claims (Art. 17(3) GDPR);
• restriction: ask us to limit how we use your data;
• data portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller, where we process it on the basis of a contract;
• lodge a complaint with the Commission for Personal Data Protection (КЗЛД / CPDP), Sofia, Bulgaria, https://www.cpdp.bg, or with the data protection authority of the EU country where you live or work, or where the alleged infringement took place.

Right to object. Where we rely on our legitimate interest (Section 4), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

To use any of these rights, e-mail contact@avitoholius.com or avitoholius@gmail.com. We may ask you to confirm your identity. We respond free of charge and within one month of receiving your request. If a deletion request is valid, we complete it within 30 days. Content that has already been published stays on the business's own account, under the business's control; the business or the platform can remove it there.

9. YouTube (Google) and YouTube API Services

Avitoholius uses YouTube API Services. By connecting a YouTube channel to Avitoholius, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy, which applies in addition to this policy.

What we access and how we use it. With the access the channel owner grants on Google's consent screen, we:

• upload videos that the business has approved to its own channel. Each upload is set to private by default, unless the business decides otherwise;
• read basic channel information and statistics (channel ID, title and public counts such as subscribers, videos and views) using channels.list;
• read the list of the channel's uploaded videos using playlistItems.list;
• read the status and basic statistics of those videos (for example processing status, privacy status and view counts) using videos.list.

We use this data only to deliver approved videos and to report results to the business. We do not use the YouTube Analytics API.

What we store. The access and refresh tokens for the channel, the channel ID and title, and the status and statistics data listed above. Data obtained through YouTube API Services is kept for no longer than 30 days; after that it is deleted or refreshed from the API.

What we share. We do not share data obtained through YouTube API Services with any third party. Only the team members who operate Avitoholius can access it.

Revoking access. You can revoke Avitoholius's access to your Google account at any time on the Google security settings page (the app is listed there under the name shown on Google's consent screen when you connected): https://myaccount.google.com/permissions. Within 7 days after revocation we delete the token and all data obtained through it. You can also ask us to delete your data at any time (Section 12).

10. Facebook and Instagram (Meta)

The business grants Avitoholius access to its Facebook Page and linked Instagram professional account in its Meta Business settings. Using the Meta Graph API, we:

• publish posts that the business has approved to its Facebook Page and to the Instagram professional account linked to that Page;
• read basic results of those posts (for example reach and interactions) to report them to the business.

What we store. The access token, the Page and Instagram account identifiers and names, and the basic post results. Post results are kept for the duration of our engagement with the business. We do not share this data with any third party.

Revoking access. Remove the app you authorised for Avitoholius from the connected business integrations in the Meta Business settings for that account (it is listed under the name shown when you connected). Within 7 days after revocation we delete the token and all data obtained through it.

Meta's handling of your data is described in the Meta Privacy Policy.

11. TikTok

Avitoholius uses TikTok Login Kit and the TikTok Content Posting API, with two scopes only:

• Login Kit, scope user.info.basic. When you connect a TikTok account, we receive its open_id, display name and avatar. We use them only to show which TikTok account is connected.
• Content Posting API, scope video.upload. After a video has been approved, we send it to your own TikTok inbox as a draft. We store the publish_id that TikTok returns and the status of that upload. You open the notification in your TikTok inbox, edit the video and decide whether to post it.

We never post publicly on TikTok and we do not use Direct Post. We do not collect TikTok analytics, follower counts or any other users' data through the TikTok API.

What we store. The access and refresh tokens, open_id, display name and avatar (while the account is connected), and the publish_id and its status (for the duration of our engagement with the business). The video we send is content the business provided or approved; we keep it on AVITOHOLIUS LTD’s own computers for the duration of our engagement with the business (Section 7). We do not share TikTok data with any third party.

Revoking access. In the TikTok app, go to Profile → ☰ → Settings and privacy → Security and permissions → App and service permissions → Avitoholius → Remove access (menu names may differ slightly between app versions) and remove Avitoholius. Within 7 days after revocation we delete the TikTok tokens and all TikTok data we hold.

If you connect TikTok, you remain bound by the TikTok Terms of Service. TikTok's handling of your data is described in the TikTok Privacy Policy.

12. Disconnecting accounts and deleting your data

You can withdraw our access at any time, without asking us first and without giving a reason:

• YouTube: remove the app you authorised for Avitoholius (listed under the name shown on Google's consent screen) at https://myaccount.google.com/permissions.
• Facebook and Instagram: remove the app you authorised for Avitoholius from the connected business integrations in Meta Business settings.
• TikTok: in the TikTok app, Profile → ☰ → Settings and privacy → Security and permissions → App and service permissions → Avitoholius → Remove access.
• By e-mail: write to contact@avitoholius.com or avitoholius@gmail.com and we will disconnect the account ourselves.

Within 7 days after access is revoked, we delete the tokens and all data obtained through that connection. You can also ask us at any time to delete the data we hold about you; if the request is valid, we will do so within 30 days.

13. Security

• The Avitoholius desktop app, where content is prepared and approved, and all access tokens are kept on AVITOHOLIUS LTD’s own computers.
• The desktop app is not reachable from the internet.
• Access tokens are never shared with third parties.
• Access is limited to the team members who operate Avitoholius.
• We never ask for or store passwords to your accounts.
• Avitoholius does not place, read or use cookies or similar technologies on your devices or browsers, does not collect information from your devices, and does not allow any third party to do so. The desktop app runs only on AVITOHOLIUS LTD’s own computers and keeps only its own display settings there.

14. Children

Avitoholius is a service for businesses and is not directed at children. Accounts must be connected by an adult (18 or over) who is authorised to act for the business and who meets each platform's own age requirements. We do not knowingly connect accounts of, or collect data directly from, children. If content provided by a business shows a child, the business must hold the consent of the child's parent or guardian before providing it (see our Terms of Service), and we delete such content at the request of the business or of the parent or guardian.

15. Changes to this policy

If we change this policy, we will update the effective date at the top and tell affected businesses directly before the change takes effect.

16. Contact

We aim to reply to data protection questions within five working days. Requests to exercise your rights are answered within one month at the latest (Art. 12(3) GDPR).