Privacy Policy

Last updated: September 10, 2026

CreatorsBrains ("we", "us") provides an analytics workspace where professional content creators and the team members they authorize can view the statistics of the creator's own social media accounts. This policy explains what data we handle, why, and the rights you have over it. For any question: admin@creatorsbrains.com.

1. Data we collect

• Account data — when you create a CreatorsBrains account: name, email address, and authentication data.
• Connected platform data — when a creator connects one of their own social accounts (YouTube, Instagram, TikTok) through the platform's official login, we receive: the account's identity (ID, username, display name, avatar), content metadata (titles, descriptions, publication dates, permalinks), and statistics (views, watch time, followers, likes, comments and similar metrics).
• Conversations on the connected account — comments on the creator's own content and, on Instagram, the direct messages of the connected professional account: the message text, the time it was sent, and the public identity of the person who wrote it (their platform ID, username, display name and avatar). These people are third parties who have no account with us. We display these conversations to the creator and to the team members the creator has authorized — the same people who can already read them on the platform itself.
• OAuth tokens — the access and refresh tokens that let us read the data above. They are encrypted at rest (AES-256-GCM) and are never exposed to anyone, including workspace members.

We do not collect data from accounts that were not explicitly connected by their owner.

On the permissions we request. We only ever READ. We never publish, never send a message, never reply, never delete anything on a connected account. For most of what we read, the platform offers a permission that is read-only, and that is the one we ask for. For Instagram direct messages and comments there is no read-only permission: Meta only offers instagram_business_manage_messages and instagram_business_manage_comments, which also allow sending and deleting. Asking for them is the only way to read those conversations at all, so the consent screen will show you the word "manage". We say it here plainly rather than let you discover it there: the permission grants more than we do, and what we do is read.

2. How we use data

Connected platform data is used for exactly one purpose: displaying the creator's own statistics inside their private CreatorsBrains workspace, to the creator and to the team members the creator has explicitly authorized. We do not use this data for advertising, we do not sell it, we do not share it with third parties, and we do not use it to train machine-learning models.

3. YouTube API Services

CreatorsBrains uses YouTube API Services to retrieve the data described above for connected YouTube channels. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. You can revoke CreatorsBrains' access to your YouTube data at any time via the CreatorsBrains dashboard or via Google security settings. Data retrieved from YouTube API Services is stored no longer than 30 days without refresh, is refreshed only while your connection is active, and is deleted when you disconnect the channel.

4. Instagram and TikTok

Instagram data is retrieved through the Instagram API with Instagram Login (Meta Platforms) and TikTok data through the TikTok Display API, in both cases with scopes granted by the account owner — read-only for TikTok and for Instagram insights, and, for Instagram messages and comments, the "manage" scopes described in section 1, which we use for reading only. Access can be revoked at any time from the CreatorsBrains dashboard, from Instagram's "Apps and Websites" settings, or from TikTok's "Apps and services" settings. Revocation triggers deletion of the corresponding stored tokens and data, as described in our data deletion instructions.

5. Storage and security

Data is stored in the European Union. OAuth tokens are sealed with authenticated encryption before touching the database. Access to a workspace's data is enforced server-side on every request: only members of the creator's organization, with the appropriate role, can view it. Security-relevant events (connections, revocations) are logged.

6. Retention and deletion

• Disconnecting an account deletes its stored tokens immediately; its cached statistics are deleted within 30 days.
• Deleting a CreatorsBrains account, or emailing admin@creatorsbrains.com from the workspace's registered address, removes all associated data within 30 days.
• See Data Deletion for step-by-step instructions, including deletion requests initiated from Meta platforms.

7. Your rights

Under the GDPR and similar laws, you can request access to, correction of, or deletion of your personal data, and you can object to or restrict its processing. Write to admin@creatorsbrains.com; we answer within 30 days.

8. Changes

If this policy changes materially, we will announce it in the product and update the date above. Continued use after a change means acceptance of the new version.