Buibui is operated by Issabu Tech (Baraka Issabu). This page describes what the service stores, where it is kept, and who else it reaches. Questions, requests and complaints go to mreflat@gmail.com.
What we store
- Your account. An email address and a password stored only as a bcrypt hash. We never hold your password itself.
- Your workspace. Workspace and client names, and who has been given access to what.
- Connected social accounts. For each account you connect: the platform’s own account id, the handle, the granted scopes, and the access and refresh tokens. Tokens are encrypted at rest with AES-256-GCM and are never stored in plain text.
- What you create. Captions, uploaded images and video, scheduling times, and approval decisions.
- Performance figures fetched back from the platforms you connect — reach and engagement per post — and, if you connect an advertising account, campaign spend.
- Comments, mentions and direct messages fetched from platforms that support it, so they can be read and replied to in one place. Direct messages are read only from Instagram and Facebook Pages you connect yourself, and a reply is only ever sent when a person on your team writes it and presses send.
- A record of AI usage when you use an AI feature: what was asked for and what it cost.
Where it lives
On a single server rented from DigitalOcean in Amsterdam, the Netherlands. The database and the media store both run on that machine. Nothing is copied to another provider for storage.
Who else sees it
- The platforms you connect. Publishing a post sends that post — its text and its media — to the platform it is going to. Each platform then handles it under its own privacy policy, not this one.
- AI providers, only when you use an AI feature. Image and video generation goes to Fal.ai. Caption generation goes to Anthropic. Neither runs unless you ask for it, and caption generation is currently switched off.
- DigitalOcean, as the company hosting the server.
Nobody else. Your data is not sold, not shared for advertising, and not used to train anything. Buibui carries no third-party analytics, no advertising pixels and no tracking scripts of any kind.
Cookies
One cookie, holding your sign-in session. It exists so you stay logged in between pages. There are no analytics or advertising cookies, which is why you are not being asked to consent to any.
Keeping it, and deleting it
Data is kept while your account exists. Disconnecting a social account removes its stored tokens immediately.
There is no self-serve account deletion yet — this is early software and that is an honest gap rather than a policy. Email mreflat@gmail.com and your account and its data will be deleted by hand, within 30 days.
Security
Traffic is served over HTTPS. Passwords are hashed with bcrypt. Platform tokens are encrypted with AES-256-GCM. Workspaces are isolated from one another at the database level, so one workspace’s queries cannot read another’s rows.
No system is perfectly secure, and this one is operated by one person. If you find a problem, please report it to the address above rather than disclosing it publicly.
Your rights
If you are in the EU or UK, you can ask for a copy of your data, ask for it to be corrected or deleted, object to how it is handled, or ask for it in a portable form. Write to mreflat@gmail.com. You can also complain to a supervisory authority — in Finland, the Office of the Data Protection Ombudsman.
Changes
If this page changes in a way that affects you, the date at the top changes with it and you will be told before the change takes effect.