Privacy Policy
Effective 8 June 2026
BruuLabs (“we”, “us”), maker of the Gachapop content workspace, helps businesses create branded social content and publish it to their own social accounts. This policy explains what we collect, how we use it, and the choices you have. We keep it short and plain.
What we collect
- Account details — your name and email when you sign up.
- Social connections — when you connect an Instagram, Facebook, TikTok, or YouTube account, we receive an access token from that platform and your account’s public identifiers (account name/ID). We never see or store your social-media password.
- Content you create — the captions, images, and posts you make or schedule in Gachapop.
- Post performance — basic engagement numbers (views, likes, comments) we read from the platforms for the posts we publish on your behalf, to show you how they did.
- Usage data — standard logs (e.g. pages visited, errors) to keep the service working and secure.
How we use it
Only to provide the service: to let you create content and publish posts that you have approved to your own connected accounts, to show you how those posts performed, and to support and secure your account. We do not use your content to train models you didn’t ask us to, and we do not post anything without your approval.
Who we share it with
We act on your behalf, so we pass the content you approve to the platform you chose (Meta / Instagram / Facebook, TikTok, or Google / YouTube) through their official APIs. We use a few standard infrastructure providers (hosting, database) to run the product. We do not sell your data, and we do not share platform data with anyone except as needed to deliver the feature you asked for. Our use of information received from Meta APIs follows the Meta Platform Terms; our use of Google/YouTube data follows the Google API Services User Data Policy; our use of TikTok data follows the TikTok Developer Terms.
Your access tokens
The tokens that let us post for you are sensitive, so we encrypt them at rest, restrict access to them, and protect them with commercially reasonable safeguards. You can disconnect any account at any time, which revokes our access and removes the stored token.
Keeping and deleting your data
You can disconnect an account or ask us to delete your data at any time by emailing jin@bruulabs.com. We delete your connections and personal data within a reasonable period of your request, and we honour deletion requests forwarded by the platforms. We keep only what we need to run the service or meet legal obligations.
Cookies
We use a small number of essential cookies to keep you signed in. We do not use advertising trackers.
Children
Gachapop is a business tool and is not intended for anyone under 18.
Changes & contact
If we make a meaningful change to this policy, we’ll update the date above and, where appropriate, let you know. Questions or requests: jin@bruulabs.com.