Privacy Policy
This Policy explains what data GLARE Studio (the “Service”, “we”, “us”) processes when you create videos, connect social networks, and publish content you select. It also explains how we use data received through TikTok and YouTube API Services, our retention periods, and how to request deletion.
1. Controller and contact
Data controller: Individual Entrepreneur Svetlana Sergeevna Burkova (ИП Буркова Светлана Сергеевна), INN 507802496936, OGRNIP 324508100265257.
Website: glarestudio.site. For privacy or deletion requests, email bur.sveta23@gmail.com. We may request information needed to verify that the request concerns your account.
We process data in accordance with applicable law, including Russian personal data legislation where applicable.
2. Data we process
| Category | Data | Purpose |
|---|---|---|
| Account and support | Email address, name if you provide it, internal account ID, and the content of your support requests. | Sign-in and account operation, order fulfilment, support responses, and account security. |
| Social network connection | Network name, account identifier or display name made available under the granted permission, OAuth access token and refresh token where issued by the platform, token expiry and granted scopes, and connection status. | Identify your selected account, make authorized requests, and show the connection status. |
| Media and publications | Uploaded photos and videos, lightweight working copies, completed videos, media analyses, title, description, selected visibility and interaction settings, commercial or AI-generated content disclosures, publication ID and status, and error messages. | Create and preview videos, obtain approval, publish at your instruction, display the result, and diagnose failures. |
| Operational records | Operation date and type, job ID, and the result of a platform request. | Security, support, prevention of duplicate publication, and records of completed operations. |
We do not ask for your TikTok or Google passwords. You connect accounts through the platform’s official OAuth screen. Connecting YouTube does not give us access to Gmail, contacts, Google Drive files, or other Google services.
3. Purposes and legal bases
We use data only to provide selected features: creating and storing media, showing previews, obtaining your approval, connecting your chosen network, uploading a specific video, displaying its status, providing support, and maintaining security.
Our legal bases are performance of our contract with you, your consent to connect and publish, compliance with applicable law, and legitimate interests in protecting the Service and its users. You may use features that do not depend on a social network connection without granting OAuth access.
4. User-controlled publishing
Connecting a network does not authorize us to publish any arbitrary video. Before each upload, you select the media, review the preview and settings, and confirm that specific publication. We send the platform only the selected video and its associated metadata.
We do not use data received from one social network to access another. We do not sell data or share it with advertising platforms, data brokers, or information resellers.
5. YouTube and Google user data
The Service uses YouTube API Services to upload your selected video to your channel. By using this feature, you also agree to the YouTube Terms of Service. Google’s processing of data is described in the Google Privacy Policy.
We request the https://www.googleapis.com/auth/youtube.upload permission to upload videos and the metadata you provide. We do not request a separate permission to read channel history, subscriptions, or playlists for this feature.
Google user data is used only for user-facing features visible to you: connecting, uploading, and displaying the result. We do not use it for advertising, creditworthiness decisions, sale, or AI model training. Our personnel and contractors do not read the contents of Google user data except with your separate agreement to specific support, where necessary to investigate a fault or abuse, to comply with law, or in other cases expressly permitted by Google’s policies.
You can revoke access in your Google security settings. Google will then reject requests using the revoked access. Revoking access with Google does not replace disconnecting the network in our dashboard or requesting deletion of our local connection record.
6. TikTok data
For TikTok, we request basic profile information to show which account is connected and the video.publish permission to obtain the creator’s available publishing settings, upload the selected video through Direct Post, and check its status.
You review visibility, permitted interactions, commercial content disclosure, and AI-content disclosure before publishing. TikTok’s own documents govern its processing of data. Revoking access in TikTok settings stops further use of that access by the platform, but you must disconnect in our dashboard or contact us to delete the stored connection record.
7. When we disclose data
- To your selected platform: the video, metadata, and technical requests needed for the specific publication.
- To technical infrastructure providers: hosting, database, object storage, and computing providers, only as needed to operate the Service and subject to data-protection obligations.
- To authorized parties: where disclosure is required by law or necessary to protect rights and safety.
Your selected platform may process data on infrastructure in other countries. That transfer occurs at your instruction to publish and is also governed by the platform’s own terms and policies.
8. Retention periods
| Data | Retention |
|---|---|
| OAuth access and connection record | While the network is connected. Reconnecting replaces the stored access. Disconnecting the network in the dashboard deletes the record containing encrypted access. |
| Original uploaded files | Up to 7 days after the file is stored. |
| Lightweight working copies | Up to 60 days after the relevant copy is stored. |
| Completed files | Up to 180 days after the relevant file is stored. |
| Media analyses and media cards | No automatic expiry: retained until account deletion, completion of a deletion request, or an earlier legal ground for deletion. |
| Publication history and support requests | For as long as needed to perform the contract, provide support, maintain security, resolve disputes, and meet mandatory legal requirements. |
Once an applicable period expires, automated cleanup deletes the relevant file. A media card remaining after the original is deleted does not mean the original file is still stored.
Deletion from production systems does not mean simultaneous physical erasure from every backup. Backup rotation periods depend on the infrastructure used; backups are not used for new processing purposes.
A video already published remains on the platform under its own rules. Disconnecting a network or deleting data from our Service does not delete the publication from TikTok or YouTube; delete it separately on that platform.
9. Disconnecting and deletion
To stop publishing, disconnect the relevant network in the dashboard. This deletes our stored record containing the encrypted access. You can additionally revoke the permission in the platform’s settings.
To request deletion of your account, media, history, or other data, email bur.sveta23@gmail.com. Include the account email and, for specific media, enough information to locate it. We will respond within the period required by applicable law. Data we are legally required to retain will be restricted in use and kept only for the required period.
10. How we protect data
OAuth access is stored encrypted, with the encryption key kept separately from the database. Plaintext tokens must not be written to the operational database or logs. Access to media is separated by account, and time-limited links are used to deliver files. We apply access controls and organizational safeguards, but no data transmission or storage system can guarantee absolute security.
11. Your rights
Subject to applicable law, you may request information about processing, a copy or correction of your data, cessation of processing, deletion, withdrawal of consent, and review of the controller’s actions. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.
12. Changes to this Policy
We will update this page and its version date if our features, providers, or processing practices change. Where separate consent is required, we will request it before the relevant processing begins. The current version is always available at glarestudio.site/privacy.