Privacy Policy

This Privacy Policy explains how Audia Automation (the "Application", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use our desktop application and visit our website at audiaautomation.com.

1. Who We Are

Audia Automation is provided by Audia Ltd, a company registered in England and Wales (company number 17516874). For any questions about this Privacy Policy or your personal data, contact us at audiaautomation@outlook.com.

For the purposes of UK GDPR and EU GDPR, the data controller is Audia Ltd.

2. What Information We Collect

We collect only the information necessary to operate the Application and provide our service.

Account Information

When you create an Audia Automation account, we collect your email address, an encrypted password hash (we never see or store your plaintext password), your subscription tier, and your usage counter (the number of beats and short-form posts you have used in the current month).

Payment Information

When you purchase a subscription, payment processing is handled entirely by Stripe, Inc. We do not see, collect, or store your full card number or CVV. We retain only a Stripe customer ID and limited subscription metadata returned by Stripe (such as subscription status and renewal date).

Technical Information

Our authentication provider (Supabase) automatically logs your IP address and browser/device information at the moment of sign-in for security and abuse prevention.

Usage and Diagnostic Information

To understand how the Application is used and to find and fix faults, we collect usage and diagnostic information through PostHog, an analytics provider. This covers which screens you open, which features you use, actions such as starting a batch or connecting a platform, and the technical details of failures: the error message, the stage of processing it happened at, and the version of Audia and operating system in use.

This information is linked to your account, including your email address, so that when you contact support we can see what actually happened on your machine. It also includes a recording of your activity in the Application (the screens you visit and the controls you use), in which anything you type is hidden, and email addresses and file paths appearing on screen are removed before the recording leaves your computer. We do not collect the contents of your beats, your file names, your titles or descriptions, or anything from your connected platform accounts.

We rely on our legitimate interest in maintaining and improving the Application for this processing. You may object to it at any time by emailing us (see "Your Rights" below), and we will delete the usage information we hold about you.

Information from Google (YouTube)

When you connect your YouTube account, the Application receives an OAuth authorisation token that allows it to upload videos to your YouTube channel on your behalf. This token is stored locally in your computer's operating-system credential store (Keychain on macOS, Credential Manager on Windows), protected by your operating system. This token is never transmitted to our servers or any third party. It remains on your machine until you uninstall the Application or revoke access via your Google Account.

Information from BeatStars

When you connect your BeatStars account, the Application stores your authenticated browser session locally on your computer. No BeatStars credentials are transmitted to our servers.

Information from SoundCloud

When you connect your SoundCloud account, the Application authenticates through SoundCloud's official OAuth flow and receives an authorisation token that allows it to upload tracks to your SoundCloud profile on your behalf. This token is stored locally in your computer's operating-system credential store (Keychain on macOS, Credential Manager on Windows). This token is never transmitted to our servers or any third party. We do not see or store your SoundCloud password. The token remains on your machine until you uninstall the Application or revoke the Application's access from your SoundCloud account settings (Settings → Connections).

Information from Airbit

When you connect your Airbit account, the Application stores your authenticated browser session locally on your computer, in the same way as BeatStars. No Airbit credentials are transmitted to our servers.

Information from TikTok

When you connect your TikTok account (available on the Pro and Industry plans), the Application signs in through TikTok's official Login Kit. It receives your TikTok account's identifier, display name and profile picture, together with sign-in tokens that let it post the videos you choose to your account. The tokens are encrypted and held on Audia's servers, so that posts you schedule can go out at the time you choose, even when your computer is off. Section 3A below sets out exactly what is accessed, how it is used, and how to remove it.

Information from Instagram

When you connect an Instagram professional account (Business or Creator, available on the Pro and Industry plans), the Application signs in through Instagram's official Business Login. It receives your Instagram account's ID, username and account type, together with a sign-in token that lets it publish the Reels you choose to your account. The token is encrypted and stored on your own computer. When you schedule an Instagram post, an encrypted copy is also held on Audia's servers until that account has no scheduled posts left. Section 3B below sets out exactly what is accessed, how it is used, and how to remove it.

3. Google User Data: Detailed Disclosure

Audia Automation uses YouTube API Services. By connecting your YouTube channel through the Application, you agree to be bound by the YouTube Terms of Service. Google's handling of your information is governed by the Google Privacy Policy.

This section provides a detailed account of how the Application accesses, uses, stores, and shares data obtained through Google APIs and YouTube API Services, as required by the Google API Services User Data Policy and the YouTube API Services Developer Policies.

Scopes Requested

The Application requests the following Google OAuth scope:

• https://www.googleapis.com/auth/youtube.upload: Permission to upload videos to your YouTube channel.

This is the only Google scope we request. We do not request access to your existing videos, comments, subscribers, analytics, playlists, or any other YouTube data.

How We Use This Data

The youtube.upload scope is used exclusively to upload music beat videos that you have explicitly chosen to upload through the Application's interface. We use this data solely to authenticate your YouTube channel, upload videos you have prepared within the Application, and set the title, description, tags, and privacy status of those videos as you specified.

Where This Data Is Stored

Your YouTube OAuth refresh token is stored locally in your computer's operating-system credential store (Keychain on macOS, Credential Manager on Windows). It is never transmitted to or stored on any server we operate. No employee, contractor, or third party of Audia Automation can access your YouTube credentials.

How Long We Retain It

We do not retain any Google user data on our servers. The local token on your computer remains until you uninstall the Application, revoke access at myaccount.google.com/permissions, or manually remove the Application's entry from your operating system's credential store.

What We Do NOT Do With Google User Data

• We do not transfer or sell your data to third parties (advertising platforms, data brokers, information resellers, or anyone else).
• We do not use your data for personalised advertising or retargeting.
• We do not use your data to determine credit-worthiness or for lending purposes.
• We do not use your data to train artificial intelligence or machine learning models.
• We do not read, modify, or delete any existing content on your YouTube channel.

Limited Use Disclosure

Revoking Access

You can revoke the Application's access to your YouTube account at any time from Google's security settings page at security.google.com/settings/security/permissions (also reachable at myaccount.google.com/permissions) by removing Audia Automation. You can also disconnect YouTube from inside the Application, which revokes the token with Google immediately and clears it from your computer. Doing either disables upload functionality but does not affect your YouTube account or any videos already published.

Deleting Your Data

If you revoke access, delete your account, or ask us to delete your data, we delete all data obtained through YouTube API Services within 7 days. You can request deletion at any time by emailing audiaautomation@outlook.com.

Deleting data held by Audia Automation does not delete anything stored by YouTube. To remove videos, metadata, or other content from YouTube itself, use YouTube Studio or the YouTube app.

Third-Party Content and Advertising

The Application does not display advertising, and does not allow any third party to serve content or advertisements within it.

3A. TikTok User Data: Detailed Disclosure

Audia Automation uses TikTok for Developers products: Login Kit, to connect your TikTok account, and the Content Posting API, to publish videos to it. By connecting your TikTok account through the Application, you agree to TikTok's Terms of Service. TikTok's handling of your information is governed by the TikTok Privacy Policy. Audia Automation is an independent product and is not affiliated with, endorsed by, or sponsored by TikTok.

Permissions Requested

The Application requests the following TikTok permissions (scopes):

• user.info.basic: your TikTok account's open ID (an identifier for your account), display name, and profile picture. Used only to show you, in Settings and on the posting screen, which TikTok account the Application will post to.
• video.publish: permission to publish videos directly to your TikTok account. Used only to post the short-form videos you prepare in the Application, at the moment you press Post.

These are the only TikTok permissions we request. TikTok's Content Posting API also includes a video.upload permission, which sends videos to a user's TikTok drafts; the Application does not request or use it, and posts only through Direct Post as described above. We do not request access to your existing videos, followers, likes, comments, messages, analytics, or any other TikTok data.

What the Application Reads and Sends

Each time you open the posting screen, the Application asks TikTok for your account's current posting options: your nickname and profile picture, the "Who can view" choices your account allows, whether comments, Duets and Stitches are turned on for your account, and the longest video you may post. These are used to build the posting form on your screen and are not stored.

When you press Post, the Application uploads your video directly from your computer to TikTok, together with the caption, "Who can view" setting, interaction settings, and any commercial content disclosure you chose. Nothing is posted until you press Post, and the Application adds no watermark, logo, or promotional text to your video or caption. After posting, it checks the post's status with TikTok so it can tell you when the video is live.

If you schedule a TikTok post instead, you make the same choices on the same screen and confirm them by pressing Schedule. The Application uploads the video to Audia's private storage. At the time you chose, our servers ask TikTok for your account's current posting options again, check that your choices are still allowed, and only then ask TikTok to publish the video, which TikTok fetches through a link that expires. If your choices are no longer allowed, your account can't post at that moment, or TikTok's daily posting limit has been reached, the post is not published and the Application tells you why.

Where This Data Is Stored

Your TikTok sign-in tokens are stored on Audia's servers, in our database hosted by Supabase, encrypted with AES-256-GCM using a key that is kept separately from the database, and linked to your Audia account and the Audia profile you connected. Your account's open ID and display name are stored with them. Your profile picture is displayed but not saved. The Application on your computer keeps no TikTok tokens: when you post, it asks our server for a short-lived access token and holds it in memory only.

TikTok requires an app's secret key to issue and renew sign-in tokens, and that key must never be shipped inside an app, so these requests are made by server functions we operate on Supabase, which hold our key. They renew your login automatically, so scheduled posts keep working. Their logs record which action ran, your Audia account ID, and whether TikTok accepted the request, and never the tokens themselves.

Videos you post straight away go directly from your computer to TikTok and never pass through our servers. Videos you schedule are held in Audia's private storage until they are posted, as described in "Scheduled Posts" below. A record of each post you make from your computer (the start of the caption, the link to the post, the "Who can view" setting, the video's length, and TikTok's reference number for the post) is kept in Upload History on your computer, where you can clear it at any time. Our usage analytics (section 2) record that a TikTok post was started, completed, or failed, but never your TikTok account details, captions, or videos, and your TikTok name and picture are left out of activity recordings.

How We Use This Data

TikTok user data is used solely to show you which TikTok account is connected, to build the posting form from your account's current options, to publish the videos you choose with the settings you choose (straight away, or at the time you scheduled), and to keep your login renewed so that scheduled posts can go out.

How Long We Retain It

We keep your TikTok login on our servers until you disconnect TikTok in the Application, delete the Audia profile it belongs to, delete your Audia account, or the login expires. If you remove the Application's access from your TikTok account instead, the stored login stops working, and we delete it the next time it is used. Scheduled posts and their videos are kept only as long as described in "Scheduled Posts" below.

What We Do NOT Do With TikTok User Data

• We do not sell, rent, or transfer it to third parties. It is exchanged only between your computer, our servers, and TikTok, as described above.
• We do not use it for advertising, profiling, or retargeting.
• We do not use it to train artificial intelligence or machine learning models.
• We do not read, modify, or delete any existing content on your TikTok account.
• We do not post anything you have not reviewed and chosen to post, and we post only when you press Post or at the time you scheduled.

Disconnecting and Deleting Your Data

You can disconnect TikTok at any time in the Application (Settings → Connected accounts → TikTok → Disconnect). This asks TikTok to revoke the Application's access and immediately deletes your stored login from our servers. Any of your TikTok posts that are still scheduled will then not be published. Deleting an Audia profile does the same for any TikTok account connected to it. You can also remove the Application from the apps connected to your account in TikTok's own settings. For any question about TikTok data, email audiaautomation@outlook.com.

Disconnecting does not delete videos you have already posted. To remove them, use TikTok.

3B. Instagram User Data: Detailed Disclosure

Audia Automation uses the Instagram API with Instagram Login, provided by Meta, to connect your Instagram professional account and publish Reels to it. By connecting your Instagram account, you agree to Instagram's Terms of Use. Meta's handling of your information is governed by the Meta Privacy Policy. Audia Automation is an independent product and is not affiliated with, endorsed by, or sponsored by Meta or Instagram.

Permissions Requested

The Application requests the following Instagram permissions:

• instagram_business_basic: your Instagram account's ID, username, account type, and profile picture. Used only to show you, in Settings and on the posting screen, which Instagram account the Application will post to, and to check that it is a professional account.
• instagram_business_content_publish: permission to publish content to your account. Used only to publish the Reels you prepare in the Application, with the caption you write, when you press Post or at the time you schedule. The Application also reads how many more posts Instagram will accept from apps for your account that day, so it can tell you before uploading if the limit has been reached.

These are the only Instagram permissions we request. We do not request access to your existing posts, comments, messages, followers, insights, or any other Instagram data.

What the Application Reads and Sends

When you open Settings or the posting screen, the Application asks Instagram for your account's username, account type, and profile picture, to show you which account is connected. These are not stored on our servers.

When you press Post, the Application uploads your video to Audia's private storage, because Instagram only accepts a video from a web link. Instagram fetches it through a link that expires, and the Application publishes it as a Reel with your caption, shared to your profile grid. The video is deleted from our storage as soon as the post finishes, and automatically within a day if anything goes wrong. Nothing is posted until you press Post or Schedule, and the Application adds no watermark, logo, or promotional text to your video or caption.

If you schedule an Instagram post, the video waits in Audia's private storage and our servers publish it at the time you chose, as described in "Scheduled Posts" below.

Where This Data Is Stored

Your Instagram sign-in token is stored on your computer, encrypted with your operating system's secure storage (Keychain on macOS, Data Protection API on Windows), separately for each Audia profile. Exchanging Instagram's sign-in code for a token requires our app secret, which must never be shipped inside an app, so that one step goes through a server function we operate on Supabase. It stores nothing and never logs the token.

When you schedule an Instagram post, the Application sends a copy of the token to Audia's servers, where it is stored in our database hosted by Supabase, encrypted with AES-256-GCM using a key kept separately from the database, together with your Instagram account ID. Our servers renew it so your scheduled posts keep working, and delete it as soon as that account has no scheduled posts left.

A record of each Reel you post (the start of the caption, the link to the post, the video's length, and Instagram's reference number for it) is kept in Upload History on your computer, where you can clear it at any time. Our usage analytics (section 2) record that an Instagram post was started, completed, or failed, but never your Instagram account details, captions, or videos, and your Instagram name and picture are left out of activity recordings.

How We Use This Data

Instagram user data is used solely to show you which Instagram account is connected, and to publish the Reels you choose with the caption you write, straight away or at the time you scheduled.

How Long We Retain It

The token on your computer is kept until you disconnect Instagram in the Application, delete the Audia profile it belongs to, or it expires after 60 days without use. The copy on our servers is kept only while that account has scheduled posts waiting. It is deleted when they have gone out, when you disconnect Instagram, or when you remove the Application from your Instagram account.

What We Do NOT Do With Instagram User Data

• We do not sell, rent, or transfer it to third parties. It is exchanged only between your computer, our servers, and Instagram, as described above.
• We do not use it for advertising, profiling, or retargeting.
• We do not use it to train artificial intelligence or machine learning models.
• We do not read, modify, or delete any existing content on your Instagram account.
• We do not post anything you have not reviewed and chosen to post, and we post only when you press Post or at the time you scheduled.

Disconnecting and Deleting Your Data

You can disconnect Instagram at any time in the Application (Settings → Connected accounts → Instagram → Disconnect). This deletes the token from your computer and any copy on our servers, and any of your Instagram posts that are still scheduled will then not be published. Deleting an Audia profile does the same for the Instagram account connected to it.

Instagram does not let an app end its own access, so to remove the Application from your account itself, go to Instagram → Settings → Website permissions → Apps and websites. When you do, Meta tells our servers, and we delete any Instagram data we hold for that account and stop its scheduled posts. You can also ask us to delete your data at any time: see our data deletion instructions.

Disconnecting does not delete Reels you have already posted. To remove them, use Instagram.

3C. Scheduled Posts

On the Pro and Industry plans you can schedule a short-form post up to two months ahead, and our servers publish it at that time, even when your computer is off.

YouTube Shorts are scheduled with YouTube's own scheduling: the Application uploads the Short straight away as private, and YouTube makes it public at the time you chose. Nothing about it is held on our servers.

Instagram and TikTok posts are held by Audia until their time:

• The video is uploaded from your computer to Audia's private storage (Cloudflare R2). It is not public and cannot be listed or browsed. At the time you chose, Instagram or TikTok fetches it through a link that expires after a few hours. The video is deleted as soon as the post has been published or has failed, and the storage deletes anything left over automatically after 70 days.
• The post's details are stored in our database (Supabase): the time you chose, the platforms, your caption, the settings you chose for each platform, the beat's name, the account it goes to, and the post's progress and result. They are deleted once the Application has shown you the result, or 30 days after the post's time if you never open the Application again.
• The sign-in to Instagram or TikTok is held as described in sections 3A and 3B.
• Your monthly allowance: we keep a record that the post used one of your monthly uploads, so that the same post is never counted twice and a refund (see our Terms of Service) is given only once. These records are deleted after about three months.

Once a post is scheduled it cannot be changed or cancelled. If you disconnect an account, its scheduled posts are not published. If a post fails, the Application tells you the next time you open it.

4. How We Use Your Information

We use your information to authenticate you when you sign in, provide the Application's features, enforce subscription tier limits (using the beats-per-month counter), process payments and manage subscriptions, send essential service emails (account changes, billing notifications, security alerts), and comply with our legal obligations.

We do not send marketing emails without your separate, explicit consent.

5. Who We Share Your Information With

We share your information only with the following processors, each strictly necessary to operate the service:

• Supabase Inc.: Authentication and database hosting. Stores your email, password hash, subscription tier, and usage counter. Also stores your TikTok login, encrypted (section 3A), the encrypted copy of an Instagram login while that account has posts scheduled (section 3B), and the details of scheduled posts (section 3C), and runs the server functions that renew those logins and publish posts you schedule. Privacy policy: supabase.com/privacy
• Stripe, Inc.: Payment processing. Handles your card data; we never see it. Privacy policy: stripe.com/privacy
• Cloudflare, Inc.: Website hosting and content delivery for audiaautomation.com. Also stores, in private storage (Cloudflare R2), the videos of Instagram posts until they are published and of posts you schedule until their time (section 3C). Privacy policy: cloudflare.com/privacypolicy
• PostHog, Inc.: Product analytics and error reporting. Stores the usage and diagnostic information described in section 2, together with your email address and subscription tier. Data is held in PostHog's European region (Frankfurt, Germany). Privacy policy: posthog.com/privacy

Sub-processors and data processing terms

The four companies listed above are our only sub-processors. Each is engaged under its own data processing agreement (DPA) and processes personal data solely on our documented instructions. Supabase and Stripe may process data outside the UK and EEA, and both operate under Standard Contractual Clauses for those transfers. PostHog stores our data in the European Union. We do not add a sub-processor without updating this page first. If you need a copy of our DPA, or want to be notified in advance of sub-processor changes, email audiaautomation@outlook.com.

We do not sell your data. We do not share your data for advertising. We do not transfer your data outside the processors listed above.

6. Data Retention

We retain your account information for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law (for example, payment records, which we retain for 7 years for UK tax purposes via Stripe).

7. Your Rights Under UK and EU GDPR

You have the right to access the personal data we hold about you, correct inaccurate personal data, delete your personal data ("right to be forgotten"), export your personal data in a portable format, restrict how we process your data, object to processing in certain cases, withdraw consent at any time, and lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email us at audiaautomation@outlook.com. We respond within 30 days.

8. Security

We protect your information using HTTPS for all communications with our servers, encrypted password storage (handled by Supabase using industry-standard hashing), Row-Level Security on our database (ensuring users can only access their own data), local storage of YouTube, BeatStars, SoundCloud, and Airbit credentials and sessions so they never reach our servers, encryption of TikTok sign-in tokens, and of Instagram sign-in tokens held for scheduled posts, on our servers with AES-256-GCM, using a key kept separately from the database, and private storage for videos waiting to be posted, which platforms can fetch only through links that expire.

Reporting a security issue. If you believe you have found a security vulnerability in the Application, our website, or our servers, please email audiaautomation@outlook.com with "Security" in the subject line. We will acknowledge your report, investigate it, and fix confirmed issues promptly.

No system is perfectly secure. If we become aware of a data breach affecting your information, we will notify you and the UK ICO within 72 hours as required by law.

9. Children's Privacy

The Application is not intended for use by anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Cookies (Website Only)

The audiaautomation.com website uses a small number of essential cookies for site functionality. Our website analytics are cookie-free: visits are counted without storing anything on your device, which is why this site shows you no cookie banner. We do not use advertising cookies and we do not track you across other websites.

The Application does not use cookies. It does store an identifier on your own computer so that repeat use is recognised as the same person rather than counted afresh each time.

11. International Users

Audia Automation is operated from the United Kingdom. By using the Application, you consent to your data being processed in the UK. Our processors (Supabase, Stripe, Cloudflare, PostHog) may store data in other jurisdictions; all are GDPR-compliant or operate under standard contractual clauses.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced via email and in the Application. The "Last Updated" date at the top of this document reflects the most recent revision.

13. Contact

For any questions about this Privacy Policy or to exercise your rights:

Email: audiaautomation@outlook.com
Website: audiaautomation.com