CACHALOT is an application and service that provides content-factory services: production of videos and SEO articles, and automated posting of content to social platforms (including TikTok, YouTube, Instagram, Pinterest, VK, and Telegram) on behalf of users who explicitly connect their accounts via OAuth.
The data controller for CACHALOT is:
When you submit the contact form on the Contact page, CACHALOT stores your name, contact (Telegram username or phone), the service category you selected, the message body, your IP address, and your browser User-Agent. This data is used only to reply to your inquiry and is kept in an append-only log on our server. A notification about the submission is delivered via Telegram to the CACHALOT operator.
When a CACHALOT client signs in with TikTok (or another platform) from
the Login page, CACHALOT receives
an access token and a refresh token from the platform, scoped strictly to
what the client granted (user.info.basic,
video.upload, video.publish). CACHALOT stores
these tokens encrypted at rest and uses them only to publish content
that the client has explicitly queued for posting through the CACHALOT
dashboard.
CACHALOT does not collect analytics about other TikTok users, does not read third-party content, and does not sell or share tokens with third parties.
CACHALOT uses the Instagram API with Instagram Login (Meta Platform). When a client connects an Instagram professional account from the Login page, CACHALOT requests exactly two permissions:
instagram_business_basic — the account's Instagram user ID,
username, account type and profile picture, used to show the client
which account is connected and to address publishing requests to it.
instagram_business_content_publish — creating media
containers and publishing them, used only for content the client has
explicitly queued in the CACHALOT dashboard.
From Meta, CACHALOT stores only: the Instagram user ID, the username, account type, profile picture URL, the long-lived access token (valid for 60 days and refreshed automatically), and a publishing log (media URL, container ID, published media ID, status, error). Media files themselves are hosted by CACHALOT and fetched by Instagram over a public HTTPS URL.
CACHALOT does not read comments, direct messages, follower lists, insights, or any data about other Instagram users. Data received from Meta is never used for advertising, never used to train machine-learning models, never sold, and never shared with third parties. CACHALOT complies with the Meta Platform Terms and Developer Policies.
CACHALOT uses the Pinterest API v5. When a client connects a Pinterest account from the dashboard of their content factory, CACHALOT requests exactly five permissions:
user_accounts:read — the account's username, used to show
the client which account is connected.
boards:read — the IDs and names of the account's boards,
used to let the client choose the board for publishing.
boards:write — required by Pinterest to create Pins on a
board. CACHALOT does not create, edit, or delete boards.
pins:read — the processing status of media uploaded for a
new Pin.
pins:write — creating Pins, used only for content the
client has explicitly queued in the CACHALOT dashboard.
From Pinterest, CACHALOT stores only: the username, the ID of the selected board, the access token (valid for 30 days) and refresh token (valid for 60 days), which are renewed automatically, their expiry dates and granted permissions, and a publishing log (Pin URL, status, error). Images and videos are uploaded by CACHALOT directly to Pinterest.
Tokens are kept in the content factory database on a server with restricted access, are sent only to Pinterest over HTTPS, and are used only to publish content the client has queued.
CACHALOT does not read follower lists, messages, analytics, or any data about other Pinterest users. Data received from Pinterest is never used for advertising, never used to train machine-learning models, never sold, and never shared with third parties other than the hosting provider named in section 5. CACHALOT complies with the Pinterest Developer Guidelines.
The server logs standard HTTP request metadata (IP, timestamp, path, response status) for security and diagnostic purposes. Logs are rotated every 14 days.
CACHALOT servers are physically located in the European Union (the Netherlands). Hosting is provided by Clodo Cloud Service Co. L.L.C, which acts as a data processor and has no independent access to your content. Content factory dashboards, including Pinterest tokens, run on a server in Germany hosted by Hetzner Online GmbH under the same terms. Data is not exported outside CACHALOT infrastructure and is not shared with third parties except as described in section 5.
CACHALOT shares data only with the following services:
CACHALOT does not sell personal data. CACHALOT does not use data for advertising and does not build marketing profiles.
At any time you may:
To exercise these rights, write to [email protected]. CACHALOT responds within 30 days.
CACHALOT uses HTTPS for all connections (via Cloudflare), stores OAuth tokens encrypted at rest, restricts server access to SSH keys, and enforces rate limits on public endpoints.
The CACHALOT service is not intended for users under 18 and does not knowingly collect data about minors.
CACHALOT may update this policy. The current version is always available at cachalot.cc/privacy-policy. Active OAuth clients will be notified by email about material changes.
Questions about the CACHALOT Privacy Policy:
[email protected]