UploadFlow ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, why we use it, how long we keep it and what rights you have. UploadFlow is operated by Cactus Media Producties (KvK 90645669, Netherlands), which is the controller of your personal data.
1. Information We Collect
- Account information: your name, email address, password (stored as a secure hash) or Google sign-in ID, country, billing address, and the IP address used when you signed up.
- Payment information: your plan, invoices and payment status. Payments are handled by Mollie; we never see or store your full card or bank details. If you have an account balance (see our Terms), we keep track of it together with your payments.
- Videos and photos: the media you upload to publish, schedule or save as a concept, together with their file names and folder names.
- Content and settings: titles, captions, hashtags, brand voices, scheduled posts and your preferences.
- Platform credentials: OAuth tokens and basic account details (such as channel or page name and ID) for the platforms you connect: YouTube, TikTok, Instagram, Facebook and LinkedIn. These are stored securely and never shared.
- Review and sharing data: feedback, approvals and the name a reviewer chooses to enter on a review link, and whether files were downloaded.
- Agency data: names and email addresses of your team members and clients, and client logos and banners you upload.
- Website visits: the page you view, the site you came from, your country and device type. We count visits without cookies, using a one-way hash of your IP address that cannot be turned back into the address. Visit records are deleted after 180 days.
- Usage data: credits used, uploads performed, notifications and technical logs needed to run and secure the service.
2. How We Use Your Information
- To provide the service: analyze your media with AI, generate titles and captions, and publish or schedule content to the platforms you connect (performance of our contract with you).
- To store and share your concepts through review links and client overviews, on your instructions (contract).
- To manage your account, credits, subscription and invoices (contract and legal obligation).
- To send service emails, such as email verification, password resets, payment confirmations and notifications about feedback, downloads and expiring concepts (contract).
- To keep UploadFlow secure, prevent abuse and fix problems (legitimate interest).
We do not sell your data and we do not use it for advertising.
We do not use data obtained through Google APIs (including your YouTube data) to develop, improve or train generalized AI/ML models. Our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3. Media Processing and Storage
- For AI analysis we extract a few still frames and the audio from your video. The frames are sent to Anthropic and the audio to OpenAI for transcription. Temporary working files on our server are deleted right after processing.
- Media for posts you publish or schedule is stored on Cloudflare R2 until it has been published, and is removed within a few hours after publishing.
- Media you save as a concept is stored until you delete it or until the retention period of your plan ends, after which it is permanently deleted.
- Files that are uploaded but never saved or published are removed automatically within a few hours.
4. Third-Party Services
We use the following service providers to run UploadFlow. They only process your data on our behalf and under appropriate agreements:
- Anthropic (Claude API): AI analysis of video frames and generation of titles, captions and report insights.
- OpenAI: transcription of audio and generation of thumbnails.
- Cloudflare: storage of your media (R2), content delivery and security of our website.
- Render: hosting of our application and database.
- Resend (and Twilio SendGrid as a backup): sending service emails.
We also share data with the following parties when this is needed to provide the service. They act as independent controllers, and their own privacy policies apply to the data they receive:
- Mollie: payment processing, including the checks that banking and anti money laundering rules require.
- Google: optional sign-in with your Google account.
- YouTube, TikTok, Meta (Instagram and Facebook) and LinkedIn: publishing to the accounts you connect, through their official APIs, on your instruction.
Some of these providers are based in or process data in the United States. In that case, transfers are protected by appropriate safeguards, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
4a. YouTube API Services
UploadFlow uses YouTube API Services. By using the YouTube features of UploadFlow, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
What we access and store: when you connect your YouTube channel, we store the OAuth tokens required to upload videos on your behalf, along with your channel ID and channel name. We use the YouTube Data API solely to upload your videos to your own channel, set video metadata (title, description, tags, category, language, thumbnail) and add videos to your playlists, always at your explicit request. We do not read, collect or store any other YouTube data, and we never access third-party YouTube content.
Data retention and deletion: your YouTube OAuth tokens are stored securely and are deleted immediately when you disconnect your YouTube account in Settings or when you delete your UploadFlow account. Uploaded video files are removed from our storage within a few hours after the upload to YouTube completes, unless you also saved them as a concept.
Revoking access: in addition to disconnecting within UploadFlow, you can revoke UploadFlow's access to your YouTube data at any time via the Google security settings page: security.google.com/settings/security/permissions.
4b. Cookies, Local Storage & Information on Your Device
UploadFlow stores, accesses and collects limited information directly on your device, using browser local storage and cookies or similar technology:
- Local storage (set by UploadFlow): we store a session token in your browser's local storage to keep you logged in, along with your interface preferences (such as selected language and platform selection). This information stays on your device, is only read by UploadFlow, and is removed when you log out or clear your browser data.
- Strictly necessary cookies (set by our infrastructure provider): our website is delivered through Cloudflare, which may place strictly necessary cookies (such as
__cf_bm) on your device for security and bot protection. These cookies do not track you across other websites.
- No tracking or advertising cookies: we do not place advertising, analytics or cross-site tracking cookies, and we do not allow third parties to place tracking cookies or access information on your device through UploadFlow.
You can remove this information at any time by clearing your browser's cookies and site data for uploadflow.app; note that you will then need to log in again.
5. Data Security
We take data security seriously. Passwords are stored as secure hashes, platform tokens are stored securely, all traffic is encrypted with HTTPS, and access to our systems is limited. If a data breach occurs that is likely to put your rights at risk, we will report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay.
6. How Long We Keep Your Data
- Account data: for as long as you have an account. When you delete your account, your data, concepts, files and platform tokens are deleted. Copies in our encrypted database backups are overwritten within 30 days.
- Media: as described in section 3.
- Review messages and feedback: messages and comments on a review link are deleted together with the concept or post they belong to, and at the latest 2 days after the post has been published.
- Invoices and payment records: 7 years, because Dutch tax law requires this.
- Technical logs: for a limited period, only as long as needed for security and troubleshooting.
7. Agencies, Teams and Clients
If you use UploadFlow as an agency, you decide what client information and content you add. For that data, you are the controller and we act as your processor: we only process it on your instructions to provide the service. You can sign our data processing agreement yourself under Settings in the app, and you immediately receive a copy signed by both parties.
8. Your Rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data;
- have your data deleted, for example by deleting your account in Settings;
- restrict or object to certain processing;
- receive your data in a portable format;
- revoke platform access at any time in UploadFlow or in the settings of YouTube, TikTok, Instagram, Facebook or LinkedIn.
To use these rights, email us at service@uploadflow.app. We respond within one month. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
8a. Children
UploadFlow is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it.
9. Changes to This Policy
We may update this Privacy Policy when our service changes. For material changes we will notify you by email or with an in-app notice.
10. Contact
If you have questions about this Privacy Policy, please contact us at: service@uploadflow.app
UploadFlow is a service of Cactus Media Producties · KvK 90645669 · VAT NL004830512B89 · Netherlands