Privacy Policy

1. Who we are

ChannelForge is provided by StoresWiki LLC (“we”, “us”). We are the controller of the personal information described in this policy. For anything privacy-related, contact support@storeswiki.com.

2. What we collect

Account data

Your name, email address, a hash of your password (never the password itself), your two-factor settings, the workspaces you belong to and your role in each, and your preferences, such as whether you want product updates.

Workspace content

What you and your team create or upload: briefs, research results, niches, channel drafts, brand suites, scripts, episodes, captions, thumbnails, schedules and settings.

Connected-platform tokens and data

When you connect YouTube, Facebook, Instagram, Threads, TikTok, LinkedIn or X, we receive OAuth access and refresh tokens, which we store encrypted with AES-256-GCM. We also store the account and channel identifiers, names and images the platform returns, records of the posts we publish for you, and their performance metrics.

We use each connection only to publish the videos you approve to the channels, Pages, profiles and accounts you select, with the captions, playlists and settings you choose — on TikTok, with the privacy, interaction and disclosure choices you make on each post — and to read back their names, identifiers and the performance of the posts we published, to report it to you. We do not sell this data or use it for advertising.

You can disconnect a platform in the app at any time, or revoke our access on the platform itself: Google at myaccount.google.com/permissions; TikTok in Settings → Security → Apps; Facebook, Instagram and Threads in Settings → Apps and Websites; LinkedIn in Settings → Data privacy → Permitted services; X in Settings → Security and account access → Apps and sessions.

By connecting YouTube you agree to the YouTube Terms of Service; Google’s handling of your data is described in the Google Privacy Policy. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Usage and billing records

Your plan and subscription, credit grants and the credits each job used, invoices and payment status. Card and PayPal details are collected by Stripe and PayPal; we receive a payment reference and limited details such as the payment method type, never a full card number.

Logs

IP addresses, browser user agents, timestamps and requests; security events such as sign-ins, failed sign-ins and rate-limit triggers; and an audit log of security- and billing-relevant actions in your workspace.

Messages

What you send us through the contact form or by email, including your name, email address and company.

Cookies

Strictly necessary cookies only — see the Cookie Policy.

3. How we use it

• To provide the Service — research, drafting, building kits and brands, generating and reviewing episodes, and publishing to the platforms you connect (performance of our contract with you).
• To bill you — plans, credits, invoices and payments (contract; legal obligations for tax and accounting records).
• To keep the Service secure — authentication, rate limiting, fraud and abuse prevention, and audit logging (our legitimate interest in protecting you, us and the platforms).
• To support you — answering messages and support requests (contract or legitimate interests).
• To communicate — service emails such as verification, security alerts and billing notices (contract), and product updates only if you opt in (consent, which you can withdraw at any time).
• To improve the Service — aggregate usage and quality measures, and lessons learned from your channels’ past episodes, which are used to improve their future episodes (legitimate interests).
• To comply with the law — and to respond to lawful requests.

4. AI processing

To research, write, plan and review your content, we send briefs, prompts and workspace content to AI models — Anthropic’s Claude models, which we access through AWS Bedrock. Scenes are rendered on GPU machines in Google Cloud. Generation jobs run in isolated environments that do not hold our cloud or model credentials; see the Security page.

5. Who we share it with

• Sub-processors that run parts of the Service for us, under contracts that require them to protect it (listed below).
• The platforms you connect, when you or your schedule publish to them.
• Members of your workspace, according to their roles.
• Authorities, where the law requires it.
• A successor in a merger, acquisition or sale of assets, under this policy’s protections.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Sub-processors

Locations and details are on the sub-processors page.

6. Where your data is processed

The Service is hosted in the European Union, in AWS eu-central-1 (Frankfurt). Some sub-processors — for example GPU compute, payment providers and Cloudflare’s network — may process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep it

• Account data — for as long as your account exists.
• Workspace content — until you delete it or the workspace is closed; it is then deleted within 30 days, unless the law requires us to keep it.
• Backups — database backups support point-in-time recovery for 7 days, so deleted data leaves them within 7 days.
• Connected-platform tokens — until you disconnect the platform or the workspace is closed.
• Billing records — as long as tax and accounting law requires.
• Logs and security events — up to 12 months.
• Free niche finder — what you type and the ideas it returned, with your IP address for its rate limits: the address is erased after 2 days and the rest after 30 days.
• Messages to us — up to 24 months after our last exchange.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to restrict or object to how we use it, and to withdraw consent. If you are in the EEA or the UK, these are your rights under the GDPR, and you may also complain to your data protection authority. If you are a California resident, you have the right to know, delete and correct personal information, to opt out of its sale or sharing (we do neither), and not to be treated differently for using these rights.

To make a request, email support@storeswiki.com, ideally from the address on your account. We may need to verify your identity. We respond within one month (GDPR) or 45 days (CCPA), and tell you if we need longer where the law allows it. An authorized agent may make a request on your behalf with proof of authorization.

9. Security

We protect your data with encryption in transit and at rest, sealed secrets, isolated generation jobs, role-based access and audit logging. Details are on the Security page.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We will post any changes here with a new effective date, and tell workspace owners by email or in the app before material changes take effect.

12. Contact

Privacy questions and requests: support@storeswiki.com.