SkedlarkPrivacy Policy
Last updated 8 November 2026
This policy explains how AI Merge Studio LTD (company no. 16370224, Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom), trading as Areza ("we", "us"), handles personal data in Skedlark: this website (skedlark.com), the Skedlark app (app.skedlark.com) and the service that connects Skedlark to social networks (api.skedlark.com). We are the data controller. This policy follows the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR.
1. What we collect
Your Skedlark account
- Sign-in details: your email address and name. If you sign in with Google, Microsoft, Apple, Facebook, X, LinkedIn, GitHub, Slack or Twitch, we receive your name, email address, profile picture and that provider's account ID. We never receive your password for those services. If you add a passkey, we store only its public key.
- Workspace details: workspace names, members and their roles.
Social accounts you connect
- Account details: the account or Page ID, name, username and profile picture, and which permissions you granted.
- Access tokens: the tokens the network gives us so we can act for you. They are stored encrypted and used only for the actions described below.
Content
- Posts you create: text, images and videos, the networks and times you choose, and the result of publishing (for example the post's ID and link on the network, or the error the network returned).
- Comments and messages: when you use the inbox, we fetch comments on your posts and direct messages sent to your connected accounts, including the sender's name, username, profile picture and the message text, so we can show them to you and send your replies.
Payments
- When you buy credits, Stripe processes your card. We receive your Stripe customer ID, the amount, the date and the payment status. We never see or store your full card number.
Technical data
- Your IP address, browser user agent and the pages and actions you request, in our server and security logs.
- Cookies that keep you signed in and protect forms against forgery. We do not use advertising or analytics cookies in Skedlark, and this website sets no cookies.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, publishing and scheduling your posts, showing your comments and messages and sending your replies | Contract (Art. 6(1)(b)) |
| Sending sign-in links and service emails | Contract (Art. 6(1)(b)) |
| Selling credits and keeping invoices | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Keeping the service secure, preventing abuse, and fixing errors | Legitimate interest (Art. 6(1)(f)) |
We act on your connected accounts only when you ask: when you publish, schedule, edit or delete a post, reply to a comment or message, or open your inbox. We do not post anything you did not create or schedule.
We do not sell personal data, and we do not use it for advertising or to build profiles of you or of the people who comment on or message your accounts.
3. Data from Google, YouTube and other networks
Google. Skedlark's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data (for example your YouTube channel or Business Profile) only to provide the features you use in Skedlark. We do not use it for advertising, we do not sell it, and people at Areza do not read it unless you ask us to for support, it is needed for security, or the law requires it.
YouTube. If you connect a YouTube channel, Skedlark uses the YouTube API Services. By connecting it you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can remove Skedlark's access at any time on your Google Account permissions page.
Meta, LinkedIn, X, Pinterest, Bluesky, Mastodon and Telegram. We use each network's official API under its developer terms, only for the features above. You can also remove Skedlark's access in each network's own settings; when Facebook, Instagram or Threads tells us you removed access or asked for deletion, we delete that account's data as described on our data deletion page.
4. Who we share it with
- The networks you publish to. When you publish or reply, your content goes to the network you chose. Each network is then responsible for it under its own privacy policy.
- Hetzner Online GmbH (Germany): hosts the Skedlark app, the connection service and their databases.
- Cloudflare, Inc. (US/EU): DNS and delivery of this website.
- Resend (Plus Five Five, Inc., US; emails are sent from its EU region in Ireland): delivers sign-in and service emails.
- Stripe Payments Europe, Ltd. (Ireland): processes payments.
- The sign-in provider you choose (for example Google or Microsoft): confirms who you are when you sign in.
We may also disclose data if the law requires it, or to protect the rights and safety of our users and of Areza.
5. International transfers
Our servers are in the EU. Some providers above are based in the United States. For those transfers we rely on adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.
6. How long we keep it
- Your account and content: while your account exists. When you delete your account, we delete it within 30 days.
- Connected accounts: when you disconnect an account, we delete its access tokens straight away and its fetched comments and messages within 30 days.
- Backups: kept for 14 days, then overwritten.
- Payment and invoice records: 6 years, as UK tax law requires.
- Security logs: only as long as needed to keep the service secure.
7. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to how we use it, and to withdraw consent where we rely on it. Email [email protected] and we will answer within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
8. Security
We use encrypted connections (TLS), encrypt access tokens at rest, limit staff access to what is needed, and protect administrator accounts with multi-factor authentication. If a breach is likely to put you at risk, we will tell you and the regulator within 72 hours as the law requires.
9. Children
Skedlark is not meant for anyone under 16, and we do not knowingly collect their data. If you think a child has given us data, email us and we will delete it.
10. Changes
We will post any changes on this page with a new date. If a change affects how we use data we already hold, we will tell you in advance by email or in the app.
11. Contact
AI Merge Studio LTD, Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom (company no. 16370224)
Email: [email protected]