Privacy Policy

Website contact form: your name, email, phone number (optional) and message.

Management platform: for people we grant access to, their name, email, password (stored hashed, never in plain text) and last sign-in date.

Social media accounts connected by our clients (Facebook, Instagram, YouTube, TikTok), with their explicit authorization:

• the ID and name of the Page, account or channel;
• access tokens issued by the platform, stored encrypted;
• the posts our clients prepare and schedule through the platform (text, images, videos);
• statistics for those accounts and posts (views, reach, engagement, followers);
• public comments received on those posts, so our clients can reply to them.

Audience measurement for our clients' websites: when a client's website is linked to our platform, we receive the pages viewed, the visit source (UTM parameters, referrer), the device and browser type, and a non-reversible fingerprint of the IP address — never the address itself. Requests sent through those websites' forms reach us with the contact details the person entered. We also read, on a read-only basis, the Google Analytics reports our clients authorize us to access.

Server logs (IP address, date, requested page), for security purposes.

• to answer your requests and provide our production services;
• to let our clients plan, publish and track content on their own accounts;
• to publish content only when our client has prepared and scheduled it in the platform;
• to show our clients statistics for their accounts, campaigns and incoming requests;
• to keep our systems secure and prevent abuse.

We do not sell personal information. We do not use it for targeted advertising, and we do not use data obtained from social platforms to train artificial intelligence models.

Your information is hosted on servers located in Canada. It is only shared with the providers needed to deliver the service, each for the stated purpose:

• Meta (Facebook, Instagram), Google (YouTube, Google Analytics) and TikTok, when our client publishes or views statistics on their platform;
• Anthropic (United States), only when a member of our team requests a suggested reply to a public comment: the comment text and the necessary context are sent. Nothing is published without human approval;
• our hosting provider, to operate the servers.

When information is transferred outside Québec, we make sure it receives adequate protection, as required by law. We may also disclose information when required by law.

Our platform uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service, and your data is also governed by the Google Privacy Policy.

With your authorization, we use this access to: upload to your channel the videos you have scheduled (youtube.upload) and read basic channel information, namely its name and ID (youtube.readonly). We do not access any other data in your Google Account.

Studio Machine's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained from YouTube API Services is refreshed or deleted at least every 30 days. You can revoke our access at any time from your Google Account permissions page or by disconnecting the channel in our platform; we then delete the access tokens.

Facebook, Instagram and TikTok access is only used for the purposes described in section 2: publishing content scheduled by our client, reading statistics and public comments on their accounts, and replying to them. You can revoke our access in your Facebook settings (Settings & privacy → Business integrations) or TikTok settings (Settings → Security → Authorized apps), or by contacting us.

• Social media access tokens: until the account is disconnected or the client engagement ends, then deleted.
• Statistics, posts and comments: for the duration of the client engagement, then deleted within 90 days of its end.
• Contact form messages: 3 years at most.
• Server logs: 90 days at most.

Connections are encrypted (HTTPS). Access tokens and service keys are encrypted in the database, passwords are hashed, and platform access is restricted to authorized people: each client only sees their own data.

You may request access to your information, its correction, its deletion or its transfer in a structured technological format, and withdraw your consent at any time. Write to info@studiomachine.ca; we respond within 30 days. If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec.

To have data linked to a connected account (Facebook, Instagram, YouTube, TikTok) or any other data about you deleted:

• email info@studiomachine.ca with the subject "Data deletion", specifying the account or address concerned;
• or, if you have platform access, disconnect the account on the Integrations page;
• and revoke our access in the relevant platform's settings (see sections 4 and 5).

We confirm the deletion by email within 30 days.

The studiomachine.ca website sets no cookies and uses no advertising measurement tools. The management platform only uses the cookies required for the session and for protection against forged requests.

Bruno Chasse — info@studiomachine.ca. Productions IDEO inc., Québec, Canada.

We may update this policy. The update date appears at the top of this page; in case of a significant change, we notify our clients.