Privacy Policy

Rumina · Last updated 17 October 2026

This Privacy Policy explains how Rumina Labs(“we”, “us”) collects, uses, shares, protects, and deletes information when you visit ruminalabs.com or use the Rumina web application at app.ruminalabs.com (together, the “Service”). Rumina is a social media management platform that lets you plan, schedule, publish, and review content and conversations for the social accounts you connect.

The short version: we only access the accounts you choose to connect, only for the features you use. We never sell your data, never use it for advertising, and never use data from Google APIs to train generalized AI or machine-learning models. You can disconnect accounts and delete your data at any time.

1. Who we are

Rumina is a product of Rumina Labs, a sole proprietorship registered in Indonesia and run by Restu Trio Kumara, based in Lampung, Indonesia. For the purposes of Indonesia’s Personal Data Protection Law (UU No. 27 Tahun 2022), Rumina Labs is the controller of your account information and of how the Service itself works.

The content, conversations, and contact details inside a workspace belong to the organisation that owns it. For that information we act on the organisation’s instructions: it decides which accounts to connect, who can see what, and when data is deleted. If you are a customer or follower of one of our users and have a request about your data, you can contact that organisation or write to us and we will pass it on.

2. Information we collect

a. Account information

  • Your name, email address, and (optionally) profile picture, provided when you sign up with email or with Google.
  • Your password, stored only as a one-way cryptographic hash. If you use Google to sign in, we never see your Google password.
  • Your organisation, workspaces, team memberships, roles, timezone, and notification preferences.
  • The date you accepted the Terms of Service and this policy.

b. Connected social accounts

When you connect a social account (for example a Facebook Page, an Instagram professional account, a YouTube channel, or a Google Business Profile location), you sign in on that network’s own page and approve the permissions shown there. We then receive:

  • OAuth access and refresh tokens. These are encrypted before they are stored and are never shown to anyone.
  • Account identifiers and public profile details: account ID, name, handle, avatar, and follower or subscriber count.

c. Content you create

  • Ideas, drafts, captions, comments, notes, tags, templates, schedules, approval decisions, and feedback ratings.
  • Images and videos you upload to the media library, along with alt text and generated platform-ready variants.

d. Data retrieved from connected accounts

  • Your published posts and their status, so you can see what went live where.
  • Comments, mentions, direct messages, and reviews addressed to your connected accounts, so your team can read and reply to them in the inbox.
  • Performance metrics such as views, reach, impressions, engagement, follower growth, and watch time.

e. Technical information

  • Server logs (IP address, browser type, timestamps, and requested pages) used for security and troubleshooting.
  • Cookies that are strictly necessary to keep you signed in and protect forms (session and CSRF cookies). We do not use advertising or cross-site tracking cookies. This marketing site does not set cookies.

3. How we use information

  • To create and secure your account and sign you in.
  • To publish, schedule, and manage the content you create, on the accounts and at the times you choose.
  • To show comments, messages, and analytics for your connected accounts, and to send the replies you write.
  • To compute per-workspace insights, such as the training loop’s post scores and next-post recommendations. These are calculated from your own workspace’s posts and are shown only to that workspace.
  • To draft automatic replies to direct messages, only on the accounts where a workspace admin turns on AI replies (see section 6).
  • To send notifications you have enabled (in-app, email, or webhooks) and essential service emails.
  • To keep the Service secure, prevent abuse, fix errors, and comply with the law.

We do not use your information for advertising, and we do not sell or rent it to anyone.

4. Information we receive from Google

Rumina requests access to Google user data only when you choose a feature that needs it. The table below lists every Google permission (OAuth scope) we request and what we use it for.

Google productScopeWhat we use it for
Sign in with Googleopenid, email, profileYour name, email address, and profile picture, used to create your Rumina account, sign you in, and show who you are to your teammates.
YouTubeyoutube.uploadPublish the videos and Shorts you compose and schedule in Rumina to your channel.
youtube.readonlyIdentify the connected channel (name, avatar, subscriber count) and list its videos so you can see published content and its status.
youtube.force-sslShow comments on your videos in the unified inbox, post the replies you write, and add the first comment you attach to a scheduled video. Rumina only comments when you tell it to.
yt-analytics.readonlyShow views, watch time, and engagement for your videos in the Rumina analytics dashboard.
Google Business Profilebusiness.managePublish the updates you schedule to the locations you choose and show their performance insights. Rumina does not change your business information.

How we use and protect Google user data

  • We use Google user data only to provide and improve the user-facing features described above — signing you in, publishing the content you schedule, showing comments and analytics, and sending the replies you write.
  • We do not sell Google user data, and we do not use or transfer it for advertising, retargeting, or interest-based ads.
  • We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models.
  • We do not transfer Google user data to others except as needed to provide the features you use (for example, to an AI client you connect yourself — see section 6), to comply with the law, or as part of a merger or acquisition with notice to you.
  • People at Rumina Labs do not read Google user data unless you give us explicit permission (for example, in a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.
  • OAuth tokens for Google services are encrypted at rest, and all data is transmitted over HTTPS.
Limited Use disclosure. Rumina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services

Rumina uses YouTube API Services to publish videos, read channel information, manage comments, and show analytics for the YouTube channels you connect. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google’s collection and use of your data is governed by the Google Privacy Policy.

We refresh the YouTube data we display (such as video lists, comments, and metrics) from the API regularly while a channel is connected, and we do not keep unrefreshed YouTube API data for more than 30 days. When you disconnect a channel, its YouTube API data (analytics, comments, imported video list, and channel details) is deleted 30 days later unless you reconnect it first; the posts you created in Rumina are kept. You can revoke Rumina’s access to your Google data at any time from your Google Account permissions page or by disconnecting the channel inside Rumina.

5. Other connected platforms

Connections to Meta (Facebook, Instagram, Threads), LinkedIn, TikTok, Pinterest, Bluesky, Mastodon, and DEV.to work the same way: you approve permissions on the network’s own screen, and we use them only to publish what you schedule, show your comments, messages, and insights, and send the replies you write. For example, on Meta we request permissions such as pages_manage_posts, pages_read_engagement, instagram_business_content_publish, instagram_business_manage_comments, instagram_business_manage_messages, and instagram_business_manage_insights. Each network’s own privacy policy also applies to data you share with it.

6. AI clients, MCP, and AI replies

AI clients, MCP, and the Agent API

Ruminaoffers an optional MCP server and Agent API so that AI assistants (such as Claude or ChatGPT) or your own tools can work with your workspace. Nothing is shared until an organisation admin creates a scoped API key or you approve an AI client on our OAuth consent screen. When you do, that client can read and act on only the workspaces and capabilities you granted — which can include post analytics and inbox messages from connected accounts — and the data it receives is then also governed by that provider’s own terms and privacy policy. You can revoke a key or a connected client at any time from your organisation settings.

AI replies in the inbox

A workspace admin can turn on AI replies for a connected Facebook Page or Instagram account. AI replies are off by default. When they are on, the text of an incoming direct message, the recent conversation, and any image in it are sent to the AI model provider your workspace configured (for example Google Gemini, OpenAI, or Anthropic), using your workspace’s own API key, so it can draft the reply. If the AI cannot help, it tells the customer a teammate will follow up and notifies your team. This feature only handles direct messages; it never processes data from Google APIs.

7. How we share information

We share information only in these cases:

  • With the networks you connect, when we publish content or send replies on your instruction.
  • Within your organisation, with teammates and clients according to the roles and approval settings your admins choose.
  • With service providers that host and run the Service for us (cloud hosting, database and file storage, email delivery, and error monitoring), under contracts that limit their use of the data to providing those services.
  • With AI clients or tools you authorise, and with the AI model provider your workspace chooses for AI replies, as described in section 6.
  • For legal reasons, when required by applicable law, court order, or a lawful request from authorities of the Republic of Indonesia or other competent jurisdictions.
  • In a business transfer, such as a merger or acquisition, in which case we will notify you before your information becomes subject to a different policy.

8. Security

  • OAuth tokens and other credentials are encrypted at rest.
  • All traffic between your browser, our servers, and the networks’ APIs is encrypted with HTTPS/TLS.
  • Each organisation and workspace is isolated, and members only see what their role allows.
  • Access to production systems is limited to the people who need it to operate the Service.

No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

9. Retention and deletion

  • Disconnecting a channel revokes and deletes its access tokens immediately and moves its scheduled posts back to drafts. Its post, analytics, and inbox history stay in your workspace so that reconnecting restores it. For a YouTube channel, the YouTube API data is deleted 30 days after it is disconnected.
  • Removing a channel permanently deletes that account and all of the posts, analytics, inbox threads, queues, and posting slots attached to it.
  • Deleting your organisation starts a 14-day grace period during which an owner can cancel the deletion. After that, the organisation and everything in it are permanently deleted.
  • Publishing audit logs are kept for 90 days. Backups are overwritten on a rolling basis.

See the Data Deletion instructions for step-by-step guidance, or email us to delete your account.

10. Your rights

Subject to applicable law — including Indonesia’s Personal Data Protection Law (UU No. 27 Tahun 2022) — you can ask to access, correct, export, or delete your personal data, withdraw consent, or object to certain processing. Most of this can be done directly in the app; for anything else, contact us at [email protected]. We respond within 30 days.

11. Children

The Service is meant for businesses, creators, and professionals. It is not directed at children, and you must be at least 18 years old (or the age of majority where you live) to create an account.

12. International transfers

Rumina is operated from Indonesia, and our service providers may process data in other countries. When data is transferred, we take steps to keep it protected as described in this policy and as required by law.

13. Changes to this policy

We may update this policy as the Service changes. We will change the “Last updated” date above and, for material changes, notify account owners by email or in the app before the change takes effect.

14. Contact