Privacy Policy

Last updated: October 23, 2026

MStation ("we", "us", "our") provides software at mstation.co ("the Service") that helps brands publish to their social accounts and answer the comments and messages they receive. This policy describes what data we collect, how we use it, how long we keep it, and how you can delete it.

1. Data we collect

When you connect your Instagram Business or Creator account to MStation via Meta's OAuth flow, we receive and store:

2. Threads

When you connect your Threads account to MStation through Meta's Threads login, we store:

Finding conversations on Threads is switched on only once Meta approves MStation's use of Threads keyword search. From then on, for the searches you choose, we store the public Threads posts that match them: the post's text, its author's username, its link and the time it was posted, a note on whether it is worth answering, and the reply MStation drafts. A reply is posted under a post only when you click Approve.

To judge which posts are worth answering and to draft the replies, the post's text is sent to OpenAI, our AI provider (see Section 9). The posts MStation writes for your Threads account are drafted the same way.

To remove it: Disconnect Threads from /integrations, or remove MStation in Threads (Settings → Account → Website permissions), and your Threads account record (user ID, username, permissions and token) is deleted at once. A data deletion request sent through Meta reaches us at /threads/delete and deletes the same record at once. Posts already published stay on Threads until you delete them there. Conversations found on Threads stay in your brand's Community history until you delete your MStation account, or ask us at privacy@mstation.co.

3. TikTok

When you connect your TikTok account through TikTok's login, we store your TikTok user ID, display name and profile picture, and the permissions you granted. We also store an access token and a refresh token, encrypted at rest, which we use to send videos and renew access.

When you approve a video in MStation, we upload it to your TikTok inbox as a draft. Nothing is posted until you open it in TikTok and post it yourself.

We read your videos' public numbers (views, likes, comments, shares) to show what each one earned.

To remove access: Disconnect TikTok from Integrations in MStation, which deletes those tokens, or remove MStation in TikTok (Settings and privacy → Security → Manage app permissions).

4. Google and YouTube

When you connect Google, we store an access token and a refresh token, encrypted at rest, and read the Search Console, Analytics, Google Ads and Business Profile data of the accounts you choose, to show how your site, your ads and your listing are doing. Reviews on your Business Profile reach your inbox, and a reply is posted only when you approve it.

When you connect YouTube, MStation uses YouTube API Services: it uploads the videos you schedule to your channel, reads your channel's videos and their statistics, and posts the replies to comments that you approve. The text of a comment is sent to OpenAI to draft a reply (see Section 9). By connecting YouTube you agree to be bound by the YouTube Terms of Service. Google's Privacy Policy describes how Google handles your data.

To remove access: Disconnect Google or YouTube from Integrations in MStation, or remove MStation at security.google.com/settings/security/permissions.

MStation's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, and we do not use it to train AI models.

5. LinkedIn

When you connect a LinkedIn Page through LinkedIn's login, we store the Page's ID and name, the permissions you granted, and an access token, encrypted at rest. We publish to that Page only the posts a person at your company wrote or approved in MStation, and we read the Page's follower count and each post's numbers (impressions, reactions, comments, shares) to show what each post earned. We never post to a member's personal profile, never message members, and never collect member data beyond your Page's own posts and statistics. LinkedIn data is not used to train AI models.

To remove access: Disconnect LinkedIn from Integrations in MStation, which deletes the token, or remove MStation in LinkedIn (Settings → Data privacy → Permitted services).

6. Pinterest

When you connect a Pinterest business account through Pinterest's login, we store your Pinterest user ID and username, your boards' names, the permissions you granted, and an access token and refresh token, encrypted at rest. We publish to the board you choose only the Pins a person at your brand approved in MStation, and we read each Pin's impressions, saves and outbound clicks to show what it earned. Pinterest data is not used to train AI models.

To remove access: Disconnect Pinterest from Integrations in MStation, which deletes those tokens, or remove MStation in Pinterest (Settings → Security and logins → Apps).

7. How we use it

8. Data retention

9. Third parties

MStation uses the following third-party services to deliver the Service:

We do not sell, share, or rent your data to advertisers, data brokers, or any other third party for their own purposes.

Requests from public authorities. If a public authority asks us for data about you or your brand, we check that the request is lawful and properly made, challenge any request that is not, disclose only the minimum the law requires, and keep a record of each request and our answer. Unless the law forbids it, we tell you before we disclose anything.

10. Your rights

You can at any time:

11. Changes to this policy

We'll update this page if our practices change. Material changes will be announced via the in-app notification system and (if you have a contact email on file) by email at least 14 days before taking effect.

12. Contact

Questions, requests, or concerns: privacy@mstation.co.