IfLooksCouldKill Social: Privacy Policy
Last updated: 19 October 2026
1. Who we are
IfLooksCouldKill Social (“the App”) is a social media scheduling and approval tool run by If Looks Could Kill Ltd, a company registered in England and Wales under company number 06557792, registered office 27 Old Gloucester Street, London WC1N 3AX (“IfLooksCouldKill”, “we”, “us”). We are registered with the UK Information Commissioner’s Office (ICO) under registration number ZA710563. Our data protection contact is Jonathan Smith (jonathan@iflookscouldkill.co.uk); we are not required to appoint a Data Protection Officer.
The App lets IfLooksCouldKill and the businesses we work for (“Clients”) connect their own social media accounts, prepare posts, approve them, and publish them at a chosen time. It is offered only to IfLooksCouldKill and its Clients.
For the social media data handled by the App, we act as:
- data processor for each Client, when we prepare, store and publish content on the Client’s behalf and under the Client’s instructions; and
- data controller for our own brands’ accounts and for the account details of the people who log in to the App.
Contact: jonathan@iflookscouldkill.co.uk, or by post to If Looks Could Kill Ltd, Summit House, 4-5 Mitchell Street, Edinburgh EH6 7BD.
2. What data we collect
We only collect what the App needs to schedule, approve and publish posts and to show how those posts performed.
2.1 From the people who use the App
- Name, business email address and role (for example “approver”) for each person who logs in.
- A record of actions taken in the App (who drafted, approved, rejected or published a post, and when).
2.2 From the social platforms, when you connect an account
When an authorised person connects an account, the platform shows a consent screen listing the permissions requested. We receive and store only the following:
| Platform | Data we receive | Why |
|---|---|---|
| Facebook (Meta) | Your Facebook user ID and name; the list of Pages you manage; Page IDs, names and Page access tokens; post IDs and basic engagement counts for posts the App published | To let you choose which Page to post to, publish approved posts and confirm they went live |
| Instagram (Meta) | The Instagram professional account ID, username and profile picture linked to your Page; media IDs and basic engagement counts for posts the App published; where enabled, public profile information and public post counts for other Instagram business or creator accounts you name (Business Discovery) | To publish approved posts, confirm they went live and, where requested, show public benchmark figures for competitor accounts |
| Your LinkedIn member ID, name and profile photo; the LinkedIn Pages you administer; post IDs, basic engagement counts, and comments on posts the App published (commenter name, headline and comment text) | To publish approved posts to your Page and show the response to them | |
| TikTok | Your TikTok open ID, display name and avatar; posting options TikTok returns for your account (such as allowed privacy levels); post IDs and publish status | To send approved videos to your TikTok account and confirm status |
| Your Pinterest user ID, username, and the boards you own; Pin IDs for Pins the App created | To publish approved Pins to the board you choose | |
| YouTube (Google) | Your YouTube channel ID and title; video IDs and upload status for videos the App uploaded | To upload approved videos to your channel and confirm status |
We do not collect your social media passwords. We do not read your private messages. We do not collect data about your followers beyond the public engagement counts and comments described above.
2.3 Access tokens
When you connect an account, the platform gives us an access token (and sometimes a refresh token) that lets the App act within the permissions you granted. See section 5 for how we protect them.
3. How we use the data
We use the data only to:
- show you the accounts you connected and let you pick where each post goes;
- store draft posts, images and videos until they are approved and published;
- route each post to the right approver and record the decision;
- publish approved posts at the scheduled time, and never publish anything that has not been approved;
- show basic results for posts the App published (for example likes, comments, views);
- where a Client asks for it, show public benchmark figures for named competitor business accounts (Instagram Business Discovery only);
- keep the App secure, fix faults and meet our legal obligations.
We do not sell data, use it for advertising, build profiles of individuals, or share it with data brokers. We do not use data received from the platforms to train AI models. Post text may be drafted with the help of an AI writing tool; no access tokens or platform account data are sent to that tool, only the brief for the post, and every post is approved by a person before it is published.
Our use of data received from Google APIs (including YouTube) follows the Google API Services User Data Policy, including the Limited Use requirements. By connecting a YouTube channel you also agree to the YouTube Terms of Service; Google’s privacy policy is at https://policies.google.com/privacy.
4. Lawful basis (UK GDPR)
- Contract (Article 6(1)(b)): to provide the App to our Clients and to the people they authorise.
- Legitimate interests (Article 6(1)(f)): to keep an audit trail of approvals, secure the App and publish content for our own brands.
- Consent at the platform: you choose to connect each account through the platform’s own consent screen, and you can withdraw it at any time (section 7).
5. How we keep data separate and secure
- Separate per Client and per brand. Each Client, and each of our own brands, is a separate owner in the App. Posts, approvals, media and access tokens are stored against that owner, and one owner’s data is never shown to, or usable by, another owner.
- Encrypted tokens. Access and refresh tokens are encrypted before they are stored (AES-256 or equivalent), with keys held separately from the data. Tokens are never shown in the App, emailed or written to logs.
- Least access. Only IfLooksCouldKill staff who run the App can operate it, and only through authenticated access.
- Hosting. The App runs on servers in the European Union provided by Hetzner Online GmbH (Germany). Data is transferred to each social platform only when you publish to it.
- Encryption in transit. All connections use HTTPS/TLS.
6. How long we keep data
| Data | Kept for |
|---|---|
| Access and refresh tokens | Until you disconnect the account, the token expires and cannot be renewed, or the Client relationship ends - then deleted within 7 days |
| Draft and rejected posts, and uploaded media | Up to 90 days after the post is published or rejected, then deleted |
| Published post records (text, platform post ID, date, approver) | For the life of the Client relationship plus 12 months, for the audit trail |
| Engagement figures and comments for published posts | Refreshed while the account is connected; deleted within 30 days of disconnection |
| Competitor benchmark figures (public data) | Up to 24 months, as dated snapshots |
| App user accounts and audit log | Life of the Client relationship plus 12 months |
Data received from YouTube API Services is not stored for longer than the YouTube API Services Developer Policies allow, and is deleted within 30 days of a deletion request or of access being revoked.
7. Your choices and deletion
- Disconnect any account at any time in the App, or remove the App directly in the platform:
- Facebook / Instagram: Settings and privacy > Settings > Business integrations (or Apps and websites) > remove “IfLooksCouldKill Social”
- LinkedIn: Settings > Data privacy > Permitted services
- TikTok: Settings and privacy > Security and permissions > Apps and services permissions
- Pinterest: Settings > Security and logins > Apps
- Google / YouTube: https://myaccount.google.com/permissions
- Ask us to delete your data: see https://iflookscouldkill.co.uk/data-deletion or email jonathan@iflookscouldkill.co.uk with the subject “Data deletion - IfLooksCouldKill Social”. We complete deletion within 30 days and confirm by email. If you removed the App on Facebook or Instagram, email us as well and we will delete your data.
Deleting data from the App does not delete posts already published on a platform. Delete those on the platform itself.
8. Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. If you are a person connected through one of our Clients, we may pass your request to that Client as the controller. Contact jonathan@iflookscouldkill.co.uk. We reply within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113.
9. Who we share data with
Only:
- the social platform you publish to, when you publish;
- Hetzner Online GmbH (hosting, EU);
- Amazon Web Services (email notifications sent to approvers via Amazon SES, UK (London) region);
- Buffer Inc., where a scheduling bridge is used for an account (USA, covered by Buffer’s own data processing terms);
- authorities, if the law requires it.
10. Children
The App is a business tool and is not for anyone under 18.
11. Changes
We will post changes on this page with a new “Last updated” date, and tell Clients by email about any significant change.