facelessstudioPrivacy Policy
This policy applies to Faceless Studio, the web application at faceless-studio.com ("Faceless Studio", "we", "us"), operated by Faceless Studio SpA (RUT 78.509.586-3), a company registered in Chile, which is the controller of your personal data. Faceless Studio turns a topic or a script into a short vertical video and, if you choose, publishes it to your YouTube channel or TikTok account. This policy explains what data we collect, how we use it, who processes it for us, how long we keep it, and how you can control or delete it. Contact: contact@faceless-studio.com.
Contents
- Data we collect and why
- Google user data (Continue with Google and YouTube)
- TikTok data
- Who processes your data for us
- Cookies and local storage
- How long we keep data
- How to delete your data
- Your rights
- Security
- Children
- Changes and contact
1. Data we collect and why
| Data | Where it comes from | What we use it for |
|---|---|---|
| Account: email address, a hashed password (or, if you use Google, your Google account identifier instead of a password), whether your email is verified, your plan and the date you signed up. | You, or Google if you choose "Continue with Google". | To create your account, sign you in, send you verification and password-reset emails, and apply your plan. |
| What you create: the topics, descriptions and scripts you type, the options you choose (format, language, voice, style, music), songs you upload for a music video, and the videos, images, thumbnails and scripts the service generates for you. | You, and the service. | To generate, show, store and let you download your videos. |
| Usage records: when each video was requested, its status, and what it cost us to generate. | The service. | To count your monthly quota, run the service and set prices. Never shown to other users. |
| Billing: your Paddle customer and subscription identifiers, plan, subscription status and billing-period dates. | Paddle, when you buy a plan. | To activate, renew, pause or cancel your plan. We never receive your card number. |
| Connected accounts: YouTube channel or TikTok account identifier and name, access tokens, and a record of each video you publish through us. See sections 2 and 3. | Google or TikTok, only if you connect an account. | To publish the videos you choose. |
| Messages you send us: your email address and what you write to contact@faceless-studio.com. | You. | To answer and act on your request (support, access, deletion). Kept as long as needed for that request. |
| Technical and security data: IP address, browser type, counters of failed attempts and usage limits per IP address, per email address and per account, and server logs. | Your browser. | To serve the site and protect accounts against abuse (rate limits, brute-force protection). |
We do not sell personal data, we do not use advertising trackers, and we do not build advertising profiles.
2. Google user data (Continue with Google and YouTube)
Faceless Studio asks Google for access only when you start it yourself: "Continue with Google" on the sign-in page, or "Connect a YouTube channel" in Settings or in a video's "Publish on YouTube" panel. Each request asks only for the permissions (scopes) listed below.
2.1 Data we access, by permission
| Permission (scope) | When we ask for it | Data we access | What we use it for |
|---|---|---|---|
openid, email | "Continue with Google" | Your email address, whether Google has verified it, and your Google account identifier. | To sign you in to the Faceless Studio account that has that email address, or create it. That address is then your account email and is used only to sign you in, protect your account against abuse, send account emails and, when you open the checkout to buy a plan, link the purchase in Paddle (section 2.3). |
youtube.readonlyhttps://www.googleapis.com/auth/youtube.readonly | "Connect a YouTube channel" | Basic details of your own channel, read once when you connect it. We keep only the channel identifier and name and discard the rest. | To show you which channel is connected and let you choose it when you publish. |
youtube.uploadhttps://www.googleapis.com/auth/youtube.upload | "Connect a YouTube channel" | No data is read with this permission. We use it to send to YouTube the video you choose, with:
| To upload a video to your channel only when you press "Upload to YouTube" on that video. We never upload anything on our own. |
We do not access your Google password, contacts, Gmail, Drive, calendar or any other Google data. On YouTube we do not read, edit or delete your existing videos, playlists, comments, subscribers or analytics.
2.2 What we store, where, and for how long
- Continue with Google: we store your email address and, if the account was created or first verified through Google, your Google account identifier in our database. The identifier only marks that the account has no password of its own; it is removed if you set a password, and otherwise kept while your account exists. Your email address is kept while your account exists. We do not keep the Google token used to sign you in; it is used once to read your email address and then discarded.
- YouTube connection: we store the channel identifier and name, the refresh token Google issues to us (encrypted with AES-256-GCM before it is written to the database), and the current short-lived access token, which expires within an hour and is replaced on each renewal. Kept until you disconnect the channel, Google rejects the token (for example, because you revoked access), or your account is deleted, whichever comes first.
- Published videos: for each video you publish we store the YouTube video identifier, the channel identifier, its link, the privacy setting and the date, so the app can show you where it was published and avoid publishing it twice. These records are deleted together with the channel connection: when you disconnect the channel, when Google reports the access as revoked, or when your account is deleted. Deleting them does not delete the video from YouTube; you manage that in YouTube.
Our database and file storage run on Cloudflare's infrastructure. All connections use HTTPS.
2.3 Sharing and transfer
- We do not sell Google user data and do not share it with anyone for advertising, marketing or data brokering.
- We do not use Google user data to develop, improve or train artificial-intelligence or machine-learning models, and we do not send it to any AI model, including Cloudflare Workers AI or any other image-generation service listed in section 4; Cloudflare only stores it as our hosting provider.
- We transfer Google user data only as needed to provide the features you use: it is stored on Cloudflare (our hosting and database provider); your email address is used by Resend to deliver account emails; and, when you open the checkout to buy a plan, your email address and account identifier are passed to Paddle to link the purchase to your account. We may also disclose data if the law requires it. In a merger, acquisition or sale of assets, we would transfer Google user data only after obtaining your explicit prior consent.
- No person at Faceless Studio reads your Google user data, except with your explicit permission to view specific data (for example, when you ask for support and agree that we look at it), when needed for security purposes (such as investigating abuse), to comply with applicable law, when you ask us to act on your account (for example, a deletion or access request), or when the data is aggregated and anonymized for internal operations.
- We send you only service emails: email verification, password reset, and important notices about your account or these policies. We do not send marketing emails.
2.4 Limited Use
Faceless Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2.5 YouTube API Services
Publishing to YouTube uses the YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.
2.6 How to revoke access and delete Google data
- In Faceless Studio: Settings → YouTube → "Disconnect". We immediately delete from our database the stored tokens, the channel identifier and name, and the records of videos published to that channel, and ask Google to revoke the access.
- In your Google account: at any time, from myaccount.google.com/permissions (Google's security settings page). The next time we try to use the access and Google reports it as revoked, we delete the stored tokens.
- All Google data, including your email address: ask us to delete your account (section 7).
3. TikTok data
If you connect a TikTok account in Settings, we ask TikTok for the permissions user.info.basic (your account identifier and display name), video.upload and video.publish (to send to TikTok the videos you choose to publish, either as a post or to your drafts). When you open the TikTok publishing panel, we also read from TikTok your creator details (username, nickname, the privacy options available to you, whether comments, Duet and Stitch are allowed, and the maximum video length) to show you the publishing options TikTok requires; these details are not stored. We store the account identifier and display name, the refresh token (encrypted with AES-256-GCM), the current access token (it expires within 24 hours and is replaced on each renewal) and a record of each video you publish. We do not read your other TikTok videos, followers, messages or analytics. Settings → TikTok → "Disconnect" deletes the stored tokens immediately and asks TikTok to revoke the access. TikTok data is never used for advertising or to train AI models.
4. Who processes your data for us
To generate a video, parts of what you type are sent to the providers that do the work. Each receives only what it needs for its task. Only Cloudflare, our host, stores your Google and TikTok tokens (refresh tokens encrypted); the other providers below never receive them.
- Cloudflare (United States): hosting, database, storage of your videos and files, security, visit statistics and, as a fallback, image generation.
- Anthropic (United States): writes the script from your topic, or adds visuals and metadata to your own script. Receives the topic or script, not your email address.
- Microsoft Azure (United States / Europe) and ElevenLabs (United States, premium voices only): turn the script into speech.
- Runware and fal.ai (United States): generate the images of each scene from short descriptions derived from the script.
- Wikipedia (Wikimedia Foundation, United States): for some formats, receives search terms derived from your topic to find a source article. No personal data.
- Pexels (Germany): search of stock background clips using short keywords derived from the script.
- Resend (United States): delivers our service emails to your email address.
- Paddle (United Kingdom / United States): our merchant of record. Paddle processes payments, invoices and taxes and is an independent controller of the billing data you give it, under its own privacy policy. When you open the checkout, we pass to Paddle your email address and account identifier so it can link the purchase to your account.
- Google (YouTube) and TikTok: receive the videos you choose to publish, as described in sections 2 and 3.
5. Cookies and local storage
We use one session cookie to keep you signed in for up to 30 days, and short-lived cookies (10 minutes) while you sign in with Google or connect a YouTube or TikTok account, to protect that step against forgery. Your browser also stores your language and theme preference locally. Cloudflare Web Analytics measures visits to the site without cookies and without identifying you. We do not use advertising cookies.
Some pages load content from third parties, which receive your IP address and may store information on your device under their own policies: YouTube (when the homepage shows sample videos: thumbnails load from YouTube, and the player loads from youtube-nocookie.com only when you press play); Paddle (the checkout window, loaded only when you open "Plan and billing", which may use cookies for payment and fraud prevention); and Cloudflare (security and cookieless analytics). We do not allow third parties to serve advertising on Faceless Studio. Our typefaces are served from our own domain, not from Google Fonts.
6. How long we keep data
- Account, videos and usage records: while your account exists.
- A video you delete: its files (video, images, voice, script) are removed from storage immediately; copies cached on our network for faster playback expire within 24 hours. A short record of it (topic, title, options and dates; the options include the text of your own script, if you wrote one) is kept so it still counts toward your monthly quota, until your account is deleted.
- Free-trial videos: if your account has never had a paid plan, the files of its trial video are deleted automatically 3 days after it was created (the cleanup runs while the service is processing videos, so it can take longer).
- Inactive accounts: as the Terms of Service explain, if an account has no activity for 3 months we may email the account address and reduce the quality of its stored videos, and after 6 months without activity its videos may be deleted.
- Uploaded songs: while your account exists. You can keep up to 20; uploading a new one when you already have 20 deletes the oldest.
- YouTube and TikTok tokens: until you disconnect, the provider rejects them, or your account is deleted.
- Billing data: your Paddle customer and subscription identifiers, plan and billing dates are kept while your account exists. After your account is deleted we keep only those Paddle identifiers and billing dates, without your email address, for as long as tax law requires. Paddle keeps invoices and payment records as merchant of record, under its own policy.
- Counters of failed attempts and usage limits (by IP address, email address or account): kept as security records; those tied to your email address or account are deleted with your account.
- Server logs: a few days, at most 7.
- Database backups: up to 30 days, then they expire on their own. Deleted data disappears from backups within that period.
7. How to delete your data
- A video: delete it in the app at any time.
- A connected YouTube channel or TikTok account: Settings → "Disconnect" (sections 2.6 and 3).
- Your whole account: write to contact@faceless-studio.com from the email address of the account, asking to delete it. We confirm the request within 10 business days and complete the deletion within 30 days: we delete your account, videos, files, uploaded songs, usage records and connected-account tokens, which ends our access to your YouTube channel and TikTok account (you can also remove it from your Google and TikTok account settings). We keep only the Paddle identifiers and billing dates described in section 6, without your email address. If you have an active subscription, cancel it first (or ask us to), so that Paddle does not charge you again.
8. Your rights
You can download your videos at any time from the app. You can ask us to access, correct, export or delete your data by writing to contact@faceless-studio.com from the email address of the account; we answer within 10 business days. Chilean law on personal data (Law 19.628 and its successors) applies. If you are in the European Economic Area, the United Kingdom or another place whose law gives you additional rights, those rights also apply, including the right to complain to your data protection authority. International transfers to the providers in section 4 are necessary to provide the service you request.
9. Security
Passwords are stored hashed (PBKDF2). Sessions use secure, HTTP-only cookies. All connections are encrypted with HTTPS. Refresh tokens for connected YouTube and TikTok accounts are encrypted at rest with AES-256-GCM. The engine that generates videos never holds your account credentials or your Google or TikTok tokens. Each account can only reach its own videos and files. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you.
10. Children
The service is for people 18 or older. We do not knowingly collect data from children; if you believe a child has given us data, write to us and we will delete it.
11. Changes and contact
If this policy changes in a way that matters, we will update the date above and, for significant changes, tell you by email or in the app before they apply. We will not use Google user data in a new way without first asking for your consent.
Questions: contact@faceless-studio.com · Terms of Service · Refund Policy