Privacy Policy

1. Who We Are

ChannelStack ("we," "us," or "our") is operated by ChannelStack, accessible at channelstack.net and through our community platform at skool.com/channelstack. Our primary contact email is matt@channelstack.net.

ChannelStack is a multi-creator automation tool that helps content creators script, produce, and automatically publish faceless videos to platforms including TikTok and YouTube. We act as a data controller with respect to personal data we collect directly, and as a data processor with respect to content data you provide for automation purposes.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: Name, email address, and payment information when you join the ChannelStack community.
• Platform credentials: OAuth access tokens and refresh tokens for TikTok and YouTube accounts you connect to ChannelStack. These tokens authorize ChannelStack to post content on your behalf and are stored securely.
• Content data: Video files, scripts, metadata (titles, descriptions, tags), thumbnail images, and other content you provide or that ChannelStack generates on your behalf for automated posting.
• Communications: Messages you send to us via email or community platforms.

2.2 Information We Collect Automatically

• Usage data: Information about how you interact with our tools, including automation run logs, posting schedules, and system activity.
• Device and technical data: IP address, browser type, operating system, and referring URLs when you access our website.
• Error and diagnostic data: Logs generated when the automation system encounters errors, to help us diagnose and fix issues.

2.3 Information Received from Third-Party Platforms

When you connect a TikTok or YouTube account to ChannelStack via OAuth, we receive limited profile information from those platforms consistent with the permissions you grant. For TikTok specifically, ChannelStack requests only the permissions necessary to post content on your behalf. We do not request access to your TikTok followers, messages, direct messages, or any data beyond what is strictly necessary for content publishing.

TikTok data received may include:

• Your TikTok username and open ID (to identify which account to post to)
• Post creation permissions (to publish video content on your behalf)

We do not access, store, or process any TikTok user data beyond the minimum required to authenticate and publish content.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To authenticate your connected accounts and automatically post content to TikTok and YouTube on your behalf according to your configured schedule.
• Account management: To create and maintain your ChannelStack account, process payments, and communicate with you about your subscription.
• System monitoring: To monitor automation health, detect posting failures, and send alert notifications when action is required.
• Analytics and improvement: To understand how our tools are used and to improve ChannelStack's features, reliability, and performance.
• Legal compliance: To comply with applicable laws, respond to legal requests, and protect the rights and safety of ChannelStack and its users.
• Support: To respond to your questions, troubleshoot issues, and provide technical assistance.

We do not sell your personal information. We do not use your TikTok data for advertising profiling or any purpose other than enabling the automation services you have requested.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for processing your personal data is as follows:

• Contract performance: Processing your account data and OAuth tokens is necessary to deliver the automation services you have subscribed to.
• Legitimate interests: We process usage and diagnostic data to maintain the security and reliability of our service.
• Legal obligation: We may process data to comply with applicable laws and regulations.
• Consent: Where required by law, we will seek your explicit consent before processing, particularly for optional communications such as marketing emails.

5. TikTok API Data Use Policy

ChannelStack uses the TikTok Content Posting API to enable automated video publishing on behalf of connected creator accounts. Our use of TikTok API data is governed by the TikTok Developer Terms of Service and TikTok's Platform Policy.

Specifically regarding TikTok data:

• We access only the minimum permissions required to post content (Content Posting API scope).
• We do not access private user data, follower lists, messages, or analytics beyond what is necessary for publishing.
• TikTok OAuth tokens are stored in encrypted GitHub Actions secrets or equivalent secure storage and are never exposed in logs, public repositories, or third-party systems.
• TikTok data is not shared with third parties except as described in Section 6 below.
• TikTok data is deleted upon account disconnection or account termination as described in Section 9.
• We do not use TikTok data to build profiles, target advertising, or any purpose beyond operating the content automation service.

6. Sharing Your Information

We do not sell your personal information. We may share information only in the following limited circumstances:

6.1 Service Providers

We use the following third-party services to operate ChannelStack. Each processes data only as necessary to provide their service:

• GitHub Actions — Automation workflow execution and secret storage
• OpenAI — AI-generated script content (content text only; no personal identifiers)
• Anthropic — AI content generation fallback (content text only; no personal identifiers)
• Skool — Community platform and membership management
• Google (YouTube Data API) — Video publishing to connected YouTube accounts
• TikTok (Content Posting API) — Video publishing to connected TikTok accounts
• Pexels — Stock video and imagery sourcing
• Google Sheets / Gmail — Internal monitoring logs and alert delivery

6.2 Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfill the purposes described in this policy:

• Account data: Retained for the duration of your subscription plus 90 days following cancellation, to allow for account reactivation and final billing reconciliation.
• OAuth tokens: Retained while your account is active and the platform connection is enabled. Tokens are deleted immediately upon disconnection of the linked platform account or upon account termination.
• Content and posting logs: Retained for up to 12 months to support troubleshooting and performance review.
• Diagnostic and error logs: Retained for 30 days.
• Financial records: Retained for 7 years as required by applicable tax and accounting laws.

Upon expiration of the applicable retention period, we securely delete or anonymize your data.

8. Security

We implement industry-standard security measures to protect your personal information:

• OAuth tokens and API credentials are stored as encrypted secrets in GitHub Actions secret storage and are never committed to source code or exposed in logs.
• All data in transit is encrypted using TLS 1.2 or higher.
• Access to user data is restricted to authorized personnel only.
• We conduct periodic reviews of our security practices and update them as necessary.

Despite these measures, no transmission over the internet or electronic storage method is 100% secure. If you believe your data has been compromised, please contact us immediately at matt@channelstack.net.

9. Your Rights

9.1 Rights Under GDPR (EEA / UK Residents)

If you are located in the EEA or UK, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten"), subject to certain legal obligations.
• Right to restriction: Request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: Request a machine-readable copy of the personal data you have provided to us.
• Right to object: Object to processing of your personal data based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Lodge a complaint with your local data protection supervisory authority.

9.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your information.
• Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to opt-out of sale: We do not sell personal information. There is no need to opt out.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.

To exercise any of these rights, contact us at matt@channelstack.net. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving a verifiable request.

10. TikTok Data Deletion

In compliance with TikTok's Platform Policy, we provide a clear mechanism for users to request deletion of all TikTok-related data held by ChannelStack:

• Email matt@channelstack.net with the subject line "TikTok Data Deletion Request" and the TikTok username associated with your account.
• We will delete all stored TikTok OAuth tokens and any TikTok-derived data within 30 days of receiving your request.
• You may also revoke ChannelStack's access to your TikTok account at any time directly through your TikTok account settings under Settings → Security → Authorized Apps.

Revoking access via TikTok settings immediately invalidates any stored tokens. ChannelStack's automated systems will detect the revocation and cease all posting activity for that account.

11. Cookies and Tracking

Our website (channelstack.net) is a static informational page that does not set first-party cookies or use tracking pixels. We do not use Google Analytics or any behavioral advertising technology on our website.

Third-party platforms linked from our site (Skool, TikTok, YouTube) may use their own cookies in accordance with their respective privacy policies. We recommend reviewing those policies if you have concerns.

12. Children's Privacy

ChannelStack is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at matt@channelstack.net and we will promptly delete such information.

13. International Data Transfers

ChannelStack operates in the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For users in the EEA or UK, we rely on Standard Contractual Clauses or other approved transfer mechanisms to ensure that any international transfers of personal data receive an adequate level of protection.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or via our community platform.

Your continued use of ChannelStack after any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: matt@channelstack.net
• Website: channelstack.net
• Response time: We aim to respond to all privacy-related inquiries within 5 business days.

For data deletion requests specifically, please include your full name, the email address associated with your ChannelStack account, and any connected platform usernames (TikTok, YouTube) in your request.