Privacy

This notice covers tuwastudio.com, run by Tuwa Studio. Questions about your data go to shariq@tuwastudio.com.

It has three parts: this website and the contact form, organisations we write to, and Tuwa Studio Publisher, the internal tools we use to post our own videos to our own YouTube channel, Facebook Page and Instagram account.

What we collect

If you only read the site: nothing that identifies you. The site sets no cookies, and runs no analytics or advertising trackers. Our host, Cloudflare, processes the technical data every website needs to deliver a page, such as your IP address, to serve the page and protect the site from attacks.

If you watch a video on a case-study page: after three seconds of playback, the page adds one to that video’s view count, a single running total stored by Cloudflare and shown beside the video. It records nothing about who watched, and stores nothing on your device.

If you use the contact form or email us: the details you choose to send, such as your name, email address, company and the description of your project.

Why, and on what basis

We use what you send only to reply to your enquiry and, if you go ahead, to quote for and deliver the work. The legal basis is taking steps at your request before entering into a contract, and our legitimate interest in answering the people who contact us. We never sell your details or add you to a mailing list.

Who processes it

• Cloudflare hosts the site and runs Turnstile, the spam check on the contact form.
• Resend delivers the contact form’s message to our inbox.
• GoDaddy hosts our email.

Some of these providers process data outside your country, under their own data protection terms.

How long we keep it

Enquiries that don’t become projects are deleted within twelve months. For clients, we keep what the law requires for business and tax records, and no more.

Organisations we write to

We write to schools, charities and other organisations whose work fits our services, offering a short sample made for them, free. For each organisation we write to, we keep:

• its name and the work email address we wrote to, which we found in a public place such as its own website, a public directory or its public advertising;
• the emails we sent, with their dates, and whether a reply came back or a message bounced.

The legal basis is our legitimate interest in offering our services to organisations they suit. We send at most three emails: a first email and up to two follow-ups, the last of which says it is the last. Any reply stops the follow-ups automatically. To be left out entirely, reply “stop”, or email shariq@tuwastudio.com.

The emails are sent from our own mailbox, hosted by GoDaddy. Follow-ups are sent on a schedule by our private portal, hosted by Cloudflare, which keeps the list of organisations and what was sent to each. We keep that record while it is useful to our outreach, and delete an organisation’s details within 7 days of being asked.

Your rights

You can ask to see the data we hold about you, correct it, or have it deleted, by emailing shariq@tuwastudio.com. We reply within a month. If you are in the EU or the UK, you can also complain to your local data protection authority.

Tuwa Studio Publisher

Tuwa Studio Publisher is the name of the studio’s own publishing tools: a private portal at admin.tuwastudio.com, and scripts that run on the studio’s own computer. They post Tuwa Studio’s own finished videos to Tuwa Studio’s own YouTube channel, Facebook Page and Instagram account, and read those accounts’ own statistics. Only the studio’s own Google account can sign in to the portal, through Cloudflare Access, and none of the tools is offered to anyone outside the studio. This part of the notice covers the Google user data they handle; Facebook and Instagram follow below. Using the tools means agreeing to this notice.

It uses YouTube API Services

Tuwa Studio Publisher uses YouTube API Services. By using it, you agree to be bound by the YouTube Terms of Service. How Google handles data is described in the Google Privacy Policy.

What it accesses

With the access the channel’s owner grants when connecting the channel through Google, the portal:

• uploads videos to the Tuwa Studio channel, with their titles, descriptions, tags, subtitle files and thumbnails, and adds them to the channel’s playlists;
• reads the channel’s own list of videos and their details;
• reads the channel’s own YouTube Analytics reports: views, watch time and audience retention. These are totals and percentages for our own videos and do not identify any viewer.

It does not access any other YouTube channel or account, and it collects no data about viewers or any other YouTube user.

What it stores, and where

• A long-lived key from Google, encrypted (AES-256) before it is stored on Cloudflare, the service that hosts the portal. It is never shown in a web page, written to a log or shared.
• Two more keys from Google on the studio’s own computer: a read-only one for the channel’s statistics, and one that schedules our Shorts. They are kept in a folder outside any code, and are never shown in a web page, written to a log, emailed or shared.
• The channel’s ID and name, to show which channel is connected.
• A record of each upload: the video’s YouTube ID and title, and the privacy we asked for and the privacy YouTube gave it.
• The aggregate statistics described above, for our own videos, when the portal reads them.
• A record of actions taken in the portal, such as connecting the channel or uploading a video (with the video’s ID and title), with the time and the studio account that took them. It never contains the key.

Signing in to the portal sets Cloudflare Access’s sign-in cookie in the studio’s own browser. The portal sets no other cookies, runs no analytics or advertising trackers, and does not let any third party serve content or advertising through it.

How it is used and shared

We use this data only to publish our own videos and to plan future ones. We don’t sell it, share it with other companies, or use it for advertising. Cloudflare stores the encrypted key and the portal’s records as our host. We sometimes use an AI assistant, Claude by Anthropic, working on the studio’s computer, to run the scripts that schedule our videos and to help read the channel’s aggregate statistics; when we do, Anthropic processes that data on our behalf.

How long it is kept

• The key, for as long as the channel stays connected. It is deleted when the channel is disconnected, the first time the portal tries to use it after access has been revoked at Google, or when the portal is retired.
• The keys on the studio’s computer, until Google expires them or access is revoked; we then delete them.
• Each upload record, for 30 days after the upload. It then deletes itself.
• Anything else it reads from the channel, such as statistics, is refreshed or deleted within 30 days.
• The record of actions, as the studio’s lasting record of what it published.

Revoking access and deleting data

In the portal, Disconnect YouTube revokes the key at Google straight away and deletes it. The channel’s owner can also revoke access at any time on the Google security settings page. After that the portal can no longer reach the channel: it deletes the stored key the first time it tries to use it, and upload records delete themselves within 30 days.

You can also ask us to delete that data by emailing shariq@tuwastudio.com. We delete it within 7 days. Deleting our copy does not affect anything stored by YouTube.

Limited Use

Tuwa Studio Publisher’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook and Instagram

Tuwa Studio Publisher is also a Meta app, used only by the studio. Through Meta’s official APIs it posts Tuwa Studio’s own videos as Reels to Tuwa Studio’s own Facebook Page and Instagram account. It asks Meta for these permissions, for those two accounts only: pages_show_list, pages_read_engagement and pages_manage_posts (to find the Page and post to it), and instagram_basic and instagram_content_publish (to find the Instagram account and post to it).

• What it stores: a key from Meta for the Page, on the studio’s own computer, in a folder outside any code, never shown in a web page, written to a log, emailed or shared; the ID and link of each Reel it posts; and a log of what it posted and when.
• What it does not collect: anything about our followers or any other person. It reads only the Page’s and the Instagram account’s own names, IDs and posting limits.
• How it is used and shared: only to publish our own videos. We don’t sell it, share it with other companies, or use it for advertising. The AI assistant described above may run these scripts for us.
• How long it is kept: the key until access is removed (below); the post records as the studio’s lasting record of what it published.

Removing access and deleting data

The Page’s admin can remove the app at any time: on Facebook, go to Settings and privacy → Settings → Business integrations, select Tuwa Studio Publisher and remove it. Its key stops working at once, and we delete the stored key. To have us delete everything we hold about the Page or the Instagram account, email shariq@tuwastudio.com. We delete it within 7 days. Deleting our copy does not affect posts already published on Facebook or Instagram.

Questions or complaints

Questions or complaints about how Tuwa Studio Publisher handles data go to shariq@tuwastudio.com.