Privacy Policy
Last updated 7 October 2026
Who we are
Ninecast is operated by System Magic Studio Ltd, registered in England and Wales under number 17459005, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are the data controller for the personal data described here. Contact us about anything on this page at support@getninecast.com. We are registered with the Information Commissioner's Office under ZC252441.
Ninecast previews and publishes social media content that you plan in a Notion database or an Airtable base. This policy explains what we collect, why, on what legal basis, and what you can do about it.
What we collect, and why
| What | Why we have it | Legal basis |
|---|---|---|
| Your email address, given when you start a trial or subscribe. | To send your planner link, confirm your address, and contact you about your account. | Performance of our contract with you |
| Your email address, again, for a few emails about getting set up. | To help you finish setting up and get the most from Ninecast — for example if your planner is still empty, or nothing has posted yet. At most one a week. Each has an unsubscribe link, and “I’m good” pauses them. They carry no tracking pixel. | Our legitimate interest in helping people who started a trial |
Where you came from: the referring website your browser reported, and any utm_source in the address you arrived at. | To know which channels bring people to the product. | Our legitimate interest in understanding how people find us. No profile is built and nothing follows you between sites. |
| Your Notion or Airtable connection: the access token that service issues, and the content of the database you explicitly choose to share — titles, dates, captions, statuses and attached files. | To draw your grid and publish the rows you schedule. | Performance of our contract with you |
| Your social accounts: the access token the platform issues, your account id, username and profile picture. | To publish on your behalf and to read back each post’s performance. | Performance of our contract with you |
| Copies of your media: the images and videos attached to the rows you share. | Notion and Airtable file links expire within hours, and the platforms will not accept them, so publishing requires a copy on storage we control. | Performance of our contract with you |
| Post performance: likes, comments, shares, saves, reach and views for posts we published for you. | To write them back into your own calendar, which is a feature you asked for. | Performance of our contract with you |
| An Instagram username, if you ask us for early access while Instagram publishing is invite-only. | It is the only thing we need in order to send you the invite. | Steps taken at your request before a contract |
| Operational records: sync and publishing activity, and error reports. | To tell you why something failed, and to fix it. | Our legitimate interest in a service that works |
Your IP address is read when you submit the sign-up form, purely to limit how many attempts one address can make in a few minutes. It is held in memory for that window and is never written to our database.
What we do not collect
- We do not read Notion pages or Airtable tables you have not shared with us.
- We do not read your direct messages, your followers, or anything on a social platform beyond the posts we published for you.
- We never see or store your password for any service.
- We run no analytics product, no advertising pixels and no session recording. See the Cookie Policy.
- We do not sell personal data, and we do not share it for advertising.
- We do not use your content to train machine-learning models.
- We make no automated decisions that produce legal or similarly significant effects about you.
How it is protected
Every access token is encrypted with AES-256-GCM before it reaches our database, and decrypted only inside the process that publishes on your behalf. Traffic is encrypted in transit. Your planner link is a random credential you can rotate at any time, which immediately invalidates the old one. Access to production data is limited to the people who run the service.
Found a hole in any of that? Our vulnerability disclosure policy says how to tell us and what we will do about it. We would rather hear it from you than from a customer.
Who else processes it
These providers process data on our instructions, under contract, and for no purpose of their own:
- Vercel — hosting and delivery of the site and API.
- Supabase — the database, and authentication for the subscriber dashboard.
- Cloudflare R2 — storage for the copies of your images and videos.
- Resend — sending the emails you receive from us.
- Notion, Airtable, and the social platforms you connect — each acting as an independent controller of the data you hold with them, within the permissions you granted.
- Stripe, which processes payments for us. Stripe receives your name, email, billing address and payment details, and handles them under its privacy policy. We never see your card number.
Some of these are based in the United States. Where personal data leaves the UK or the EEA, it is transferred under the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses, or to a country the UK considers adequate.
How long we keep it
- An unconfirmed sign-up: deleted within 30 days if you never confirm the email.
- Your account and planners: for as long as the account is open.
- Tokens: deleted immediately when you disconnect Notion, Airtable or a social account.
- Everything else: within 30 days of you deleting your account, except records we must keep for tax or accounting, which are kept for six years.
Your rights
Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider. Where we rely on legitimate interests you can object, and where we rely on consent you can withdraw it at any time without affecting what came before.
Email support@getninecast.com and we will answer within one month. There is no charge. You can also revoke our access at any time from Notion’s, Airtable’s or the platform’s own settings, without contacting us at all.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EEA. We would rather you told us first.
Deleting your data
Email support@getninecast.com from your account address with the subject “Delete my data”, or use the data deletion page. We confirm within 7 days and complete deletion within 30.
Children
Ninecast is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.
Changes
If we change this policy in a way that matters, we will email account holders before it takes effect, and the date at the top of this page will change.