Privacy notice

Information used

The workspace stores team account information, ideas and scripts, reference content, uploaded video versions, review comments, schedules and publishing results. Connecting a social account provides its account or channel identity, granted permissions, access credentials and, where supplied, refresh credentials and expiry information.

For YouTube, the application uses the authorized channel identity, video identifiers, metadata, privacy and audience settings, and upload/processing status to provide the requested publishing workflow. Google’s publishing permission also authorizes management of videos, ratings, comments and captions; the current YouTube publishing workflow uses channel and video operations.

Purpose and sharing

Account information and credentials support connections, token renewal, approved uploads, scheduling and reconciliation of publishing results. When a placement is released, the selected video, caption and platform settings are sent to its destination platform. Visibility is determined by the selected publishing settings and that platform’s controls.

Cloudflare provides application hosting and media storage, and Supabase provides the workspace database and authentication. If the team invokes AI copy generation, selected idea text, scripts, reference information and publishing history are sent to the configured DeepSeek service to draft copy. Publishing history can include connected-platform post links and statuses. Account access and refresh credentials are not included in that copy-generation context.

Kiyo’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google’s handling of information is described in the Google Privacy Policy.

Storage and retention

Social access and refresh credentials are encrypted in server-side storage. Server credentials are used by publishing and renewal jobs. Team permissions control access to private workspace records and publishing actions.

Workspace records and uploaded media remain until removed by an authorized operator. Stored account credentials remain until removed or replaced by the workspace owner. Revoking a provider connection stops its authorized access but does not, by itself, remove copies of existing workspace records or content already uploaded to that provider.

Control and removal requests

You can revoke Google access through Google account permissions, or use the corresponding connected-app settings on other platforms. Contact hello@kiyohq.com to request removal of a stored connection, uploaded media or workspace records. Content already published or uploaded to a social platform is also subject to that platform’s removal controls.