Privacy Policy
Last updated: 29 October 2026
This policy says what Sendstory collects, what it does with it, how long it keeps it and who else sees it. It is written to be read.
Who we are
Sendstory is owned and operated by Webcandy Ltd, a company registered in England and Wales (company number 07024033), of 66 Paul Street, London EC2A 4NA, United Kingdom, with its registered office at 175 Wokingham Road, Reading RG6 1LT. Webcandy Ltd is the data controller for the information described here, and is registered with the Information Commissioner's Office under registration number Z2687058.
The networks
Sendstory posts to the social networks you connect to it: X, and, as each one becomes available in Sendstory, Threads, Instagram, Facebook Pages, LinkedIn, Bluesky and TikTok. Where this policy says "the network", it means whichever of these you have connected. A network you have not connected learns nothing about you from us.
What we collect
When you sign in. Your email address, if you sign in with one, and a display name and picture if you set them; if you have not, the name and picture of the first account you connect become yours, and you can change them. Sign-in codes are stored only as a one-way hash and expire 15 minutes after they are sent. If you register a passkey we store the public half of it, which cannot be used to sign in anywhere else, and never the private half, which stays on your device. If you sign in with X, we use the X account you connect (below) to know it is you; an account made that way has no email address until you add one. There is no password to store, because Sendstory does not use one.
Your sign-in history and your devices. Each sign-in, each passkey added or removed and each other change to your account is recorded with the time, the IP address and the browser and operating system it came from. Settings, under Security, shows you this, and lists the browsers your account is signed in on so you can sign one out.
From a network, when you connect an account. You sign in on the network's own page, so we never see your password there. What the network then sends us:
- X: the account's handle, display name and picture.
- Threads: the account's username, name and picture.
- Instagram: the account's username, name and picture, and whether it is a business or creator account, since only those can be posted to.
- Facebook: your name and Facebook id, and for each Page you choose to share, its name, picture and id. Sendstory posts only to Pages, never to your own profile.
- LinkedIn: your name, picture and member id, or the name and id of a LinkedIn Page you administer.
- Bluesky: the account's handle, display name and picture, its identifier (its DID), and the address of the server that holds it.
- TikTok: the account's name, picture and id. Each time you post, we also ask TikTok which privacy settings and interactions the account allows, so the post offers only those.
With each comes a token that lets us make calls as that account. Tokens are encrypted, kept on our servers and used only to make the calls you have allowed. No agent holds one or can read it. Where a network's tokens expire, we renew them for as long as the account stays connected.
About your agents. Your agent's name, which accounts it may post as and whether its posts wait for you, a hash of its key and a few characters of the key so you can tell them apart. We never store the key itself. We also record what each agent reports about the software running it, such as "Claude Code", as it reports it. When an agent signs in on a machine, we keep a record of that sign-in: the software and version it reported, the name it gave and the address it asked to be sent back to, when you approved it and when it was last seen, and the IP address of the browser you approved it from, so you can tell two machines apart.
Every call. For each request an agent makes: which agent, which account, what it asked for, any reason it gave, when, what the network charges for it if it charges, and what happened to it. For calls that ran, the full request we sent to the network and the full response it sent back. For calls that were held, the content that was waiting for your decision.
Images. The images you or your agents put on a post. We keep copies of each: one made for each network it goes to (Instagram, for one, takes only JPEG), a preview and a small thumbnail, in a database of their own, and clear them on the schedule below.
What we read from the networks. Your agents cannot read any network through Sendstory: they can post, and reply. We do not read your feed, your followers, your messages or your statistics on any network. Sendstory itself reads public information from X, public profiles and public posts, to show to members inside Sendstory; see Other people on X at the foot of this page. It reads nothing about other people from the other networks.
Payment. Your plan and your billing history. Payments are processed by Stripe, which collects and holds your card details; they never touch our servers.
Technical. Server logs, which include IP addresses, the browser or client used, the pages and endpoints requested, and where a visit came from (the site or link that brought it), for security, to keep the service working and to see how people find us.
What we do with it, and why we are allowed to
| What we do | Why we are allowed to |
|---|---|
| Run the service: show you what your agents are doing, hold what needs approving, hold your posts to your plan's limit, make the calls you allow, keep the record so you can audit it | performing our contract with you |
| Bill you, and keep the billing record | performing our contract, and a legal obligation for the record |
| Send you the emails the service needs: a sign-in code, a code to confirm a new email address, a note when someone signs in to your account with one of its X accounts, and a note when you delete your account saying how long you have to restore it (it asks what would have kept you; answering is up to you). We do not email you about your agents' activity yet | performing our contract |
| Keep the service secure, stop abuse, and investigate it | our legitimate interest in a service that is not abused, and yours in an account that is not broken into |
| Keep each call's request and the network's response so you can see what happened | performing our contract with you, and our legitimate interest and yours in an audit trail that is actually auditable |
| Show public information from X inside Sendstory: public profiles and posts from X | performing our contract with you, and our legitimate interest in showing what people have made public on X |
We do not sell your data, use it to advertise to you, or use the content of your agents' calls to train anything. We do not make automated decisions about you that have a legal or similarly significant effect.
How long we keep it
| What | For |
|---|---|
| The full content of a call: the request, and the network's response | 30 days, then deleted. A post can wait up to a month for you to approve it, so its request is kept up to 60 days |
| The record of each call: who, what, when, what it cost, what happened | 13 months, or until your closed account is erased if that is sooner |
| A record of each call we made to a network or to another service: the address, the status, the headers with the credential removed, and up to a thousand characters of the body | 30 days |
| Fuller diagnostic traces of a call to a network, and of the steps a call took through our pipeline, recorded only while we have switched them on for a workspace we are watching | 14 days and 3 days |
| Attempts to connect an account on a network, or to sign in with X: who started it, from which page, and how it ended. Never the code or the token | 30 days |
| An image on a post that has gone out: the copy sent to the network, and the preview | the copy a couple of days after it was last used, the preview a couple of weeks; the thumbnail while any post shows it. Nothing on a post still to go is cleared |
| An image on no post at all | the copies for the networks within a day, the rest within a week |
| Your account | while it is open; once you close it, usually between 7 and 31 days. See Closing your account below |
| Your agents and your connected accounts | while your workspace exists. Removing one ends its key or its tokens at once; what the record of calls needs of it stays until your closed account is erased |
| The machines your agents sign in on | while your workspace exists, and erased with it. Signing a machine out, or removing its agent, ends the sign-in at once |
| A connected account's tokens | until you remove the account in Sendstory, take Sendstory's access away on the network, or close your own account. Then the tokens are discarded, and the network is told where it offers a way to tell it |
| A request from Facebook, Instagram or Threads to delete what we received from them, and its confirmation code | 13 months, so you can check what happened to it |
| Your sign-in history | while your account is open, then deleted with it |
| The sign-in codes we email: the address each went to, and the network address it was asked from. Never the code itself | 30 days, or until your account is deleted |
| Your device list | while your account is open; a browser not used for six months is dropped from it |
| Server logs, and the IP address and browser of a visit | 30 days |
| Billing records | as long as tax law requires, which is currently 6 years |
The 30 days is the same on every plan. We keep the full content of each call for a month so that you can check it, then delete it; the record stays.
Who else sees it
- The networks you post to, necessarily: every call you allow is made to the network, and it sees it as a call from your account through Sendstory. Each network is its own controller for what it does with that: X Corp. for X, Meta for Threads, Instagram and Facebook, LinkedIn for LinkedIn, TikTok for TikTok, and for Bluesky, Bluesky Social or whoever runs the server that holds your account. A post on Bluesky is a public record on an open network that anyone can copy; that is how Bluesky works, not something we do.
- SendGrid (Twilio Inc.), which delivers the sign-in code and any email we send you, and so sees your email address.
- Stripe, which handles your card and processes your payments.
- Google, which serves the site's font: your browser fetches it from Google Fonts, so Google sees that request and the address it came from.
- Cloudflare, which runs our domain's DNS and routes traffic to the site, and so sees the address your browser connects from and the pages it asks for.
- A site analytics service, which sees how some visitors use our public pages, so we can improve them.
- Anyone we are legally required to disclose to.
Nobody else. Your agents see only their own calls, never another agent's, and never another workspace's. If our business is ever sold, information may transfer with it, and we would tell account holders first.
Where it lives. The service runs on our own servers in the United Kingdom, and that is where your account and your records are held. SendGrid and Stripe are based outside the UK, so your email address reaches the United States when we email you, and your payment details when you pay. Those transfers run on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, which is the safeguard the law requires. Ask us and we will tell you more. When you post, the post and its images go to the network you chose and are held wherever that network holds them, often outside the UK: that is what posting asks us to do.
Cookies
Sendstory sets one cookie, the first time your browser talks to our server. Before you sign in it holds only a random id for the browser; once you sign in it is what keeps you signed in. It lasts up to 30 days and it is the only cookie Sendstory itself sets. We do not use advertising cookies, and we do not follow you across other sites. The site's font is loaded from Google Fonts, which sets no cookie. A few small things are kept in your browser's own storage rather than in a cookie: a note that this browser has used a passkey here, how many days the calendar shows, the account you last posted as, a post you were writing and had not saved yet (so a new version of the site does not lose it, kept for minutes), and, in that tab only, where you were in signing in - the address a code went to, never the code. None of these leave your browser. Our own staff signing into the admin get two more cookies of the same kind.
Your rights
You can see everything we hold about you in the product itself: your account, your sign-in history, your devices, your agents, your connected accounts and the record of every call. You can disconnect an account, remove an agent, sign a device out, or close your account at any time.
Closing your account stops everything at once: your workspace is put on emergency stop, every agent key and agent sign-in is ended, and every connected account is disconnected: its tokens are discarded, and its network is told where it offers a way to tell it. The account is kept for a short while, at least 7 days and to the end of any period you have paid for, and signing back in while it is kept restores it and everything recorded in it; you then reconnect your accounts and sign your agents in again. Then it is erased for good, usually between 7 and 31 days after you closed it: the account, its passkeys and its sign-in history, and its workspace with its agents, its disconnected accounts and the record of calls. What we keep after that is the billing record, for as long as tax law requires, and nothing on it identifies you beyond what that record needs.
You can ask us to delete everything, including the billing record where the law lets us, by writing to the address below. We do that on request, not at the next scheduled sweep.
If you live in the UK or the EU you also have the rights to access, correct, delete, restrict or port your data, and to object to how it is used, under data protection law. Where we rely on a legitimate interest, you can object to it and we will stop unless we have a compelling reason not to. To use any of these rights, contact us at the address below; we answer within a month. If you are not satisfied you can complain to your data protection authority; in the UK that is the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can fix it.
Removing Sendstory from a network
You can take away Sendstory's access to an account in either place:
- In Sendstory: Settings, Profiles, then Remove on the account. Its tokens are discarded at once.
- On the network: in its settings, under the apps and services connected to your account. Facebook, Instagram and Threads tell us when you do this, and we discard the tokens when they do. On the other networks the token stops working, and the account shows in Sendstory as needing to be reconnected until you reconnect it or remove it.
To have what we hold from a network deleted, remove the account as above and write to us at the address below. We delete what we still hold from it, the record of calls included, when you ask, not at the next scheduled sweep.
If you ask Facebook, Instagram or Threads to delete the data Sendstory received from them, they pass your request to us. We delete it, and you get a confirmation code and a page that shows when it is done.
Other people on X
This section is for people on X who have not signed up to Sendstory.
Sendstory reads public information from X: public profiles and public posts, as X shows them to anyone. We show them to our members inside Sendstory. Our customers' agents post to X through Sendstory and reply to posts there; they cannot read X through us. When a customer's agent replies to a post, we keep that post's id with the reply, and whatever X's own answer to the reply names; the full content of the call is deleted after 30 days, and the record keeps the id.
We do not enrich any of it against another source, do not sell it, and do not train anything on it.
If you believe content of yours is held here and should not be, write to us at the address below and we will look into it. If a reply to you is on X, X's own controls are the faster route.
Security
Agent keys are hashed before storage. Sign-in codes are hashed. The tokens for connected accounts,
on every network, are encrypted, with the key held in the vault. Cookies are HttpOnly, Secure and
integrity-protected. Secrets and database credentials are held in a vault rather than in
configuration files. Traffic is served over HTTPS. Access to the production database is limited
to the people who need it. The database is backed up every hour to storage away from the server
that runs Sendstory; the images on posts are not. The terms say more, under
Backups and recovery.
No system is perfect, and anyone who tells you otherwise is selling something. If you find a security problem in Sendstory, please email [email protected] and we will take it seriously. If there is ever a breach that puts you at risk, we will tell you and the ICO as the law requires.
Children
Sendstory is not intended for anyone under 18, and we do not knowingly collect their data. If you believe someone under 18 has created an account, contact us and we will remove it.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we handle your data, we will tell account holders directly rather than relying on you to re-read this page.
Contact
Webcandy Ltd, company number 07024033, 66 Paul Street, London EC2A 4NA, United Kingdom. Registered office: 175 Wokingham Road, Reading RG6 1LT. ICO registration Z2687058.