Privacy Policy

Information We Collect

We collect only the information needed to evaluate channels, operate client work, and administer accounts:

• Channel-audit form information: name, email address, channel name and URL, respondent type, audience and scale answers, monetization maturity answers, rights and catalogue answers, market percentages, and the free-text opportunity responses you submit.
• Administrative and future creator account information: email address, account role, active status, invitation history, and account activity records.
• Authentication and authorization data: credentials managed by our authentication provider, session tokens, password-reset and invitation tokens, and the role and client membership records used to authorize each request.
• Client, channel, report, document and task information: client and channel records, audit reports, generated documents, recommendations, tasks and internal review notes created in the course of our work.
• YouTube and Google integration data: where a client authorizes it, channel metadata and channel-level performance metrics retrieved from YouTube and Google APIs, together with synchronization status records.
• Operational and security logs: request, error, delivery and administrative-action records used to keep the service reliable and secure.

How Information Is Used

We use information to review audit requests and respond to them, to deliver and improve client services, to produce reports and documents, to authenticate and authorize users, to send service-related email such as invitations, password setup and audit notifications, to protect the service against abuse, and to meet legal obligations.

We do not sell personal information, and we do not use audit-request information for advertising.

YouTube and Google Integration

Where a client connects a Google account, CTS requests only the access required to read channel metadata and analytics for the channels that client authorizes. OAuth credentials are encrypted at rest in our systems, are used only by trusted server-side code, and are never exposed to browser clients. A client may withdraw an authorization at any time by contacting us, after which the stored credential is revoked and deleted.

Google integrations are enabled per client. Where an integration has not been connected, no YouTube or Google data is collected for that client.

Service Providers

We rely on a limited set of processors, each used only for the purpose described:

• Supabase — database hosting, authentication and file storage.
• Lovable — application hosting and delivery of the website and application.
• Google — where a client authorizes it, YouTube and Google Workspace APIs used to read channel data and generate client documents.
• Transactional email provider — delivery of invitations, password setup and audit-request notifications from our own sending domain.

Access Restrictions

Access is enforced by role on the server for every read and write. Internal CTS staff accounts may access operational records needed for client work. Each creator account is restricted to the client information it is explicitly assigned to, and cannot access another client’s dashboard, channels, reports, documents, tasks or metrics. Internal notes and organization-level credentials are never available to creator accounts.

Data Retention and Deletion

Audit requests are retained while they remain commercially relevant and for a reasonable period afterwards for record-keeping. Client records, reports and documents are retained for the duration of the engagement and a reasonable period afterwards. Account, invitation and security records are retained as needed for security and accountability. Integration credentials are deleted when an authorization is revoked. You may request deletion of your information by writing to info@creatorstruststudios.com; we will honor the request except where we must retain records to comply with law or to resolve disputes.

Security

We use encrypted transport, encrypted storage of integration credentials, server-side authorization on every request, least-privilege database access, restricted administrative credentials that are never sent to a browser, and audit logging of administrative actions. No system can be guaranteed to be perfectly secure, but we work to protect information proportionately to its sensitivity.

Your Privacy Rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise a right, contact info@creatorstruststudios.com. We may need to verify your identity before acting on a request, and we will respond within the time required by applicable law.

International Data Processing

CTS operates from the United States, and our service providers may process information in the United States and other countries. If you submit information from outside the United States, you understand that it will be processed in the United States under this Policy.

Children

The service is intended for professional use by adults. We do not knowingly collect information from children under 13.

Changes and Contact

We may update this Policy; the effective date above will change when we do, and material changes will be reflected on this page. Privacy inquiries and requests should be sent to info@creatorstruststudios.com. No mailing address is currently published; email is the correct channel for all privacy and legal contact.