1. Introduction
OctoSpark (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use OctoSpark, our multi-agent campaign and content platform (the “Service”).
By using OctoSpark, you consent to the data practices described in this policy. If you do not agree with our policies and practices, please do not use our Service.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, password, and profile details
- Payment information: billing details and payment method (processed by Stripe — we do not store card numbers)
- Content data: text, images, videos, and other content you create or upload
- Team and organization information: details about team members and organizations you create
- Communication: messages you send to our support team
2.2 Information from Social Media Platforms
When you connect social media accounts (X, LinkedIn, Instagram, TikTok, YouTube, Facebook, Threads), we collect:
- Account identifiers and profile information
- OAuth access and refresh tokens for publishing content
- Analytics data about your social media performance and engagement
- Content you authorize us to access for scheduling and analysis
- Publishing permissions and account-specific limitations
- Creator information including nickname and posting restrictions
- Lists of Facebook Pages and Instagram or Threads accounts you manage, so you can choose where to publish
- Post-level metrics and insights retrieved from the platforms for content you publish through the Service
We connect to all platforms, including X, exclusively through each platform's official OAuth flow. We never ask for, receive, or store your social media passwords.
We associate your X handle and user ID with your OctoSpark account only because you connect the account yourself or based on public information. We do not match X identities to third-party data, devices, households, or browsers.
2.3 TikTok Integration and Data Handling
When you connect your TikTok account, we handle your data with the following safeguards:
- User control: you maintain full control over all content posted to TikTok. Every post requires your explicit approval before publishing.
- OAuth security: we use TikTok's secure OAuth 2.0 protocol for authentication. Your TikTok password is never shared with or stored by OctoSpark.
- Limited access: we only request the minimum permissions necessary to provide our Service.
- Revocable access: you can revoke OctoSpark's access to your TikTok account at any time through TikTok's app settings or our platform.
- No unauthorized posting: we will never post content to your TikTok account without your explicit consent for each individual post.
- Compliance: we comply with TikTok's Developer Guidelines, API usage policies, and data handling requirements.
- No third-party sharing: your TikTok data, including any personal information we receive through the TikTok integration, is never shared with third parties without your consent.
When you use the TikTok integration, data flows in both directions: we receive account and creator information from TikTok and send TikTok the content and settings you ask us to publish. This may involve cross-border transfers, including for users in the EEA, UK, Switzerland, and Brazil, protected by appropriate safeguards such as standard contractual clauses. You can exercise access and deletion rights over TikTok-sourced data using the contacts in Section 15, and we cooperate with TikTok to fulfil such requests.
2.4 Google and YouTube API Services
OctoSpark uses YouTube API Services to connect your YouTube channel, upload videos at your direction, and retrieve analytics for your published content. When you connect a YouTube channel, we access your channel identifiers and profile information, upload videos you approve, and retrieve analytics for content you publish through the Service. We store OAuth tokens and the data listed below on our servers solely to provide publishing and analytics features.
The YouTube API Data we access, collect, and store is limited to:
- Channel identifiers and profile information
- Video metadata and upload status for videos you publish through OctoSpark
- YouTube Analytics metrics for your channel and videos
We use this data only to provide publishing and analytics features, we share it with YouTube/Google only to perform the actions you request, and we never use it for advertising.
OctoSpark's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google's handling of your personal data is described in the Google Privacy Policy at http://www.google.com/policies/privacy.
2.5 Connecting Your LinkedIn Account
We collect your LinkedIn profile identifiers and OAuth tokens when you connect, and the posts you publish through the Service. To request deletion of LinkedIn data we store, remove your LinkedIn account in Settings, then Social accounts, or email [email protected].
We never sell, rent, sublicense, distribute, or otherwise share LinkedIn member data with third parties, including advertising networks and data brokers.
2.6 Automatically Collected Information
- Usage data: features used, content created, and interaction patterns
- Device information: browser type, operating system, IP address
- Cookies: session cookies and preference cookies
- Analytics: performance metrics and error logs
3. How We Use Your Information
We use your information to:
- Provide and maintain our Service
- Process your transactions and manage credit-based billing
- Generate AI-assisted content including videos, images, captions, and copy
- Help you schedule and publish content to your connected social media accounts with your explicit approval
- Analyze content performance and engagement metrics
- Process video generation workflows
- Send service updates and marketing communications (with consent)
- Improve our AI models and features through anonymized data
- Provide customer support and technical assistance
- Comply with legal obligations and platform policies
- Detect and prevent fraud or abuse
Important: for content posted to third-party platforms, we only publish content after you have explicitly reviewed and approved it. You maintain full control over what content is published to your accounts.
4. Data Sharing and Disclosure
We do not sell your personal information. We may share information with:
4.1 Service Providers
- Stripe: payment processing
- Database and authentication providers: for storing your account and content data
- Cloud infrastructure (AWS / Google Cloud / Cloudflare): content storage and processing
- Sentry: error tracking and monitoring
- Analytics providers: usage analytics
- OpenRouter and underlying model providers: for AI inference (text, image, and video generation)
4.2 Social Media Platforms
When you connect social accounts, we share only the content and data necessary to publish on your behalf, as authorized by you.
4.3 Legal Requirements
We may disclose information if required by law, court order, or to protect our rights and safety.
4.4 Business Transfers
In case of merger, acquisition, or sale, your information may be transferred to the new entity.
5. Data Security
We implement appropriate security measures including:
- Encryption of data in transit and at rest
- Secure access controls and authentication
- Regular security audits and updates
- Limited access to personal data on a need-to-know basis
- Secure OAuth implementation for social media connections
However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
To report a security vulnerability in OctoSpark, email [email protected] and we will respond promptly.
6. Your Rights and Choices
6.1 Access and Correction
You can access and update your personal information through your account settings or by contacting us.
6.2 Data Deletion
You can request deletion of your account and associated data. Some information may be retained for legal or legitimate business purposes. For step-by-step instructions on deleting data we received from connected social media platforms, see Deleting Social Platform Data below.
6.3 Data Portability
You can request a copy of your data in a structured, machine-readable format.
6.4 Marketing Communications
You can opt-out of marketing emails through the unsubscribe link or account settings.
6.5 Social Media Permissions
You can revoke access to connected social media accounts at any time through our platform or the respective social media platform's settings. For Google and YouTube, in addition to our normal procedure for deleting stored data, you can revoke OctoSpark's access to your data via the Google security settings page at https://security.google.com/settings/security/permissions.
6.6 Deleting Social Platform Data
To delete data we received from Facebook, Instagram, or Threads (and any other connected social media platform):
- Sign in and open Settings, then Social accounts.
- Remove the connected Facebook, Instagram, or Threads account to delete its stored data.
- To delete all data, delete your OctoSpark account or email [email protected].
7. Data Retention
We retain your information for as long as:
- Your account is active
- Needed to provide you the Service
- Required for legal obligations
- Necessary for legitimate business purposes
Content data is retained for 90 days after deletion to allow for recovery. After this period, it is permanently deleted. Financial audit trails (usage records and credit ledger entries) are retained indefinitely as required for accurate billing history.
8. International Data Transfers
Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers, including standard contractual clauses approved by relevant authorities.
9. Children's Privacy
Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected such information, we will promptly delete it.
10. Cookies and Tracking Technologies
We use cookies for:
- Essential cookies: required for Service functionality
- Analytics cookies: to understand usage patterns (only with your consent where required by law)
- Preference cookies: to remember your settings
We do not use third-party advertising cookies. You can control cookies through your browser settings, but disabling them may affect Service functionality.
11. California Privacy Rights (CCPA)
California residents have additional rights including:
- Right to know what personal information is collected
- Right to delete personal information
- Right to opt-out of sale of personal information (we do not sell personal data)
- Right to non-discrimination for exercising privacy rights
12. European Privacy Rights (GDPR)
EU and UK residents have additional rights including:
- Right to access and receive a copy of your data
- Right to rectification of inaccurate data
- Right to erasure (“right to be forgotten”)
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to lodge a complaint with supervisory authorities
13. AI and Machine Learning
We use AI to generate content and provide recommendations. Your content and usage patterns may be used to improve our AI orchestration, but we ensure:
- Personal information is anonymized before any model training
- Your private content is never shared with other users
- You retain ownership of AI-generated content
14. Changes to This Privacy Policy
We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service. Your continued use after changes constitutes acceptance of the updated policy.
If we materially change the scope of how we use or disclose data from a connected social platform, including LinkedIn profile data, we will notify affected users and, where required, ask for renewed consent before applying the change.
15. Contact Us
For privacy-related questions or to exercise your rights, contact us at:
OctoSpark Privacy Team
Privacy: [email protected]
Support: [email protected]
Data Protection Officer:
[email protected]
16. Legal Basis for Processing (GDPR)
We process your personal data based on:
- Contract: to provide our Service to you
- Consent: for marketing communications and optional features
- Legitimate interests: for improving our Service and preventing fraud
- Legal obligations: to comply with applicable laws
When you connect a social platform such as LinkedIn, we process the platform data described in Section 2.2, and transfer your content to that platform, on the basis of our contract with you and your consent given when connecting the account.