Privacy Policy

This Privacy Policy explains how NOWScale LLC (“NOWScale”, “we”, “us”) handles personal data in connection with the NOWScale platform, our websites and the related services we provide (together, the “Service”). It is written to be read alongside our Terms of Service and our Cookie Policy.

1. Scope and our role

NOWScale is a publishing and analytics tool for content creators. Our users are individual creators and the businesses they run, who connect the social media accounts they own, upload video and images, schedule and publish that content, moderate the comments on it, and review how it performed across platforms. Because of how the Service works, we handle personal data in two distinct capacities, and different parts of this policy apply to each.

1.1 Where we act as a controller

We are a controller (meaning we decide why and how personal data is processed) for the data that relates to our own relationship with you: account registration and login details, plan and subscription records, support correspondence, marketing preferences, security and audit logs, and the usage and device data generated when you use the Service. This policy is the primary notice for that processing.

1.2 Where we act as a processor

We are a processor (meaning we act on documented instructions from someone else) for the personal data contained in a customer’s content and in the data pulled from that customer’s connected accounts. That includes information about the customer’s audience and community: the people who comment on their videos, people appearing in uploaded media, and individuals reflected in the audience and engagement figures the platforms report. In those cases the customer is the controller. They determine what is collected, why, and for how long; we process it to deliver the Service to them.

If you are a member of a customer’s audience, or an employee of a customer, and you want your data accessed, corrected or deleted, please contact that organisation first. We will assist our customer in responding, as required by our data processing terms, but we generally cannot act on such a request without their instruction. If you cannot identify or reach the relevant organisation, contact us at support@nowscale.com and we will try to help.

1.3 Who this policy does not cover

This policy does not cover the social media platforms, analytics providers, advertising networks, commerce systems or payment services you choose to connect. Those services are independent controllers of the data they hold, and their own privacy notices govern their handling of it. Connecting an account authorises us to exchange data with that service on your behalf; it does not place that service under our control.

2. Personal data we collect

2.1 Account and identity data

Name, work email address, job title or role, organisation name, profile photo where you supply one, language and time zone preferences, and the authentication method associated with your login. Sign-in is passwordless. We send a one-time code to your email address, or you authenticate through a third-party identity provider. We do not ask for, collect or store a password. Where we need to confirm an account is genuine we may ask for a mobile number and verify it by sending a code to it by SMS through Twilio Verify. A verified number is used for fraud prevention and account recovery. It is never a login factor. It is used for marketing text messages only if you separately opt in to them in your newsletter preferences, and you can opt out at any time by replying STOP or changing those preferences.

2.2 Plan and billing data

Your plan, subscription and entitlement records, the token usage counted against them, billing contact details, billing address, tax identifiers, and invoice and transaction history. Payment card numbers and full financial instrument details are collected and processed directly by Stripe and are not stored on NOWScale systems.

2.3 Your content and uploaded media

Video, images, thumbnails, captions, titles, descriptions, tags and any other material you upload or author in the Service, together with the platform variants we produce from it. This content may contain personal data: faces, voices, names and other identifying details of the people who appear in it. You are responsible for having a lawful basis and any necessary releases for that material.

2.4 Data from connected platform accounts

When you connect an account on a supported platform (YouTube, TikTok, Instagram, Facebook, or any of the networks described in sections 16.2 and 17 once you connect them), we receive, subject to the scopes you grant and each platform’s own rules:

• account and profile information, such as handle, display name, avatar, account type and connected page or channel identifiers;
• audience and follower metrics, typically in aggregate or demographic form as supplied by the platform;
• post and content performance data, such as views, reach, watch time, retention curves, likes, saves, shares and comment counts;
• the text of comments and replies on your own posts, together with the commenter’s public display name and account identifier, where you use the comment moderation features;
• on networks that offer them, mentions of your account and reviews of your business locations, with the author’s public display name, profile picture and account identifier;
• publishing and scheduling metadata, including post status, errors and platform-side identifiers.

We also hold the access and refresh tokens needed to maintain each connection. Tokens are held in encrypted form and are used only to perform actions you have asked for. Data received from YouTube is additionally governed by section 15, data from Instagram, Facebook and Threads by section 16, and data from the other networks by section 17.

If you connect an ad account on Meta, Google Ads or TikTok, we read the ad accounts you can reach, their campaigns, ad sets or ad groups and ads, and daily figures such as spend, impressions, clicks and conversions. These are aggregate figures that do not identify the people who saw an ad. When you ask us to, we also pause, reactivate, edit or create campaigns and ads in that account, and we store the creative files you upload for them. Section 18 describes this in full.

2.5 Usage, device and log data

Pages and features used, actions taken, timestamps, referring pages, IP address, approximate location derived from IP address, browser and operating system, errors recorded in our server logs, and request metadata such as the rate-limit counters we use to protect the Service from abuse. Optional analytics and advertising measurement follow the cookie choices described in section 12.

2.6 Cookies and similar technologies

Identifiers and preferences kept in cookies and browser storage (local storage, session storage and IndexedDB). Optional analytics, session recording and advertising tools follow your cookie choices. See section 12 and our Cookie Policy.

2.7 Support and other communications

Messages you send us through support channels, email, forms or chat, including attachments, diagnostic information you choose to share, and our records of the response. Where calls or sessions are recorded, we will tell you at the time and seek consent where required.

2.8 Bug reports

If you report a bug from inside the Service, we receive the description you write, the product area you pick, the address of the page you were on, your language and time zone, your browser and screen size, the version of the Service you were running, your plan, how many channels you have connected, and a short trail of what happened just before: the pages you moved between and any requests or errors that failed. That trail is held only in your browser and is sent to us solely because you chose to submit a report.

If you leave the screenshot option switched on, the report also includes a picture of the page you were looking at, exactly as it appeared to you. That picture will contain whatever was on screen at the time, which may include your name, your email address, the names of your connected channels, and your own performance or billing figures. You can switch the option off before sending, and the modal shows you the image first. Bug reports and their screenshots are readable only by staff members granted that specific permission, and they are deleted ninety (90) days after you send them, whether or not the underlying issue has been resolved by then. If we need to keep talking to you about a report we will open a support ticket, which is retained under section 8 like any other support correspondence.

2.9 Sensitive data

We do not ask for special category data under GDPR Art. 9 (such as data revealing health, race or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or genetic and biometric data processed for identification). Your content may incidentally contain such material because of what you choose to upload; you should not use the Service to process special category data unless you have satisfied yourself that you have a valid condition for doing so under applicable law.

3. Where the data comes from

• Directly from you: registration, configuration, uploads, support contact and marketing sign-ups.
• From connected platforms and ad accounts: via their APIs, under the authorisation you granted when you connected the account.
• Automatically: through your use of the Service, our servers, and cookies and similar technologies.
• From service providers: such as our fraud and abuse prevention tooling and our infrastructure providers, in each case limited to what is needed to run the Service.
• From public or commercial sources: limited business contact information used for sales and marketing outreach, where permitted by law.

4. How we use personal data and our legal bases

Where the GDPR or UK GDPR applies and we act as a controller, we rely on the legal bases set out below. Where we act as a processor, our customer is responsible for identifying the legal basis for the processing they instruct.

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms and concluded that the processing is proportionate. You may ask for a summary of that assessment, and you may object to the processing, using the contact details in section 14.

5. Artificial intelligence and machine learning

The Service includes AI-assisted features. All of them are delivered by OpenAI, our AI subprocessor (see section 6.1). As of the date of this policy they are:

• Keyword, title and post suggestions: proposing phrases, titles and improvements for a post or video you are preparing.
• Metadata and chapter suggestions: when you request optimization for an owned YouTube video, using its title, description, tags and available caption track to draft titles, descriptions, tags and timestamped chapters for your review. Nothing is sent to YouTube until you explicitly save the staged changes.
• Image Studio: generating and editing thumbnails and other images from your prompts and the images you provide.
• Captions: transcribing the audio of a video you choose and translating captions into other languages.
• Channel topic categorisation: reading the titles of your videos and a sample of their comments to label the topic your channel covers. The titles and comment text are used to produce the label and are discarded immediately afterwards; only the resulting label is stored.
• Research: finding and ranking public videos and titles relevant to your topic.
• AI Replies: classifying viewer comments and drafting replies to them, using the instructions, examples and corrections you give it. By default each draft waits for you to review it. If you choose Send automatically for a channel, replies are posted to that platform without your review, except drafts below the channel’s minimum confidence, which wait for you. Replies due during your quiet hours, or after your plan’s or the channel’s daily limit is reached, are sent when those hours end or the limit resets. Rules you set can also hide, reject or ban automatically, including on the result of an AI check.
• Translation: translating support messages, help centre articles, product updates and our newsletters between languages.
• The support assistant: answering questions from our published help centre articles, including for visitors who are not signed in, and handing over to a person when it cannot. Conversations of visitors without an account are deleted after thirty (30) days.

Recommendations of the best time to publish are calculated statistically from your own past performance. They do not involve a language model and no data leaves our systems to produce them.

• Your content is not used to train general-purpose or foundation models, whether ours or a third party’s. Content submitted to an AI-assisted feature is processed to produce the requested output for you and is not added to a general training corpus.
• Model improvement. Where we work on improving models or features, we use aggregated or de-identified data that is not reasonably capable of identifying an individual or attributing content to a specific customer, or we rely on data a customer has explicitly opted in to share. Data received from connected platforms and ad accounts is never used to train or improve AI models.
• Networks excluded from AI. Data from LinkedIn, Reddit and Telegram, and data from ad accounts, is never sent to OpenAI. Sections 16 to 18 say, network by network, which data an AI feature may use.
• OpenAI. To produce a result, we send OpenAI the content the feature needs: prompts, titles, descriptions, captions, video audio, images, comments or messages. OpenAI processes it in the United States as our subprocessor, and we send requests with OpenAI’s stored-response option turned off.
• Human review. We do not routinely read customer content. Limited access may occur to investigate a fault the customer has reported, to respond to a suspected violation of our Acceptable Use Policy, or where the law requires it, and is subject to access controls and logging.
• No solely automated decisions with legal effect. Most AI outputs in the Service are suggestions and analyses for a person to review. Where you choose automatic sending or automatic moderation in AI Replies, replies and actions follow the rules you set without a person reviewing each one; they concern comments on your own content. We do not use AI outputs to make decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of GDPR Art. 22.
• Accuracy. AI outputs may be incomplete or wrong. Recommendations, predicted performance and generated captions should be reviewed before they are relied on or published.

6. Sharing and disclosure

We share personal data only in the circumstances described below.

6.1 Subprocessors and service providers

The recipients below receive personal data so that we can run the Service. The sign-in providers and platforms you choose to connect act under their own terms (see section 1.3). Our own optional measurement tools (section 12) are separate from the social accounts you connect.

6.2 Connected platforms, at your direction

When you schedule, publish or sync, we transmit the relevant content and metadata to the platforms you have connected. This is done on your instruction, and each receiving platform then handles that data as an independent controller under its own terms. The same applies to a connected ad account: we change or create something in it only when you ask us to in the Service (section 18).

6.3 Our own staff

Authorised NOWScale personnel can access account records, support correspondence and audit logs where their role requires it: to answer a support request, investigate a fault, or act on a suspected violation of our Acceptable Use Policy. Access is governed by role-based permissions, is limited to the least data needed, and is logged. We do not routinely read your content; see section 5.

6.4 Professional advisers

Lawyers, auditors, accountants, insurers and similar advisers, where they need the data to advise us and are bound by duties of confidentiality.

6.5 Legal and regulatory requests

We may disclose personal data where we believe in good faith that disclosure is required by applicable law, regulation, legal process or enforceable governmental request, or is necessary to protect the rights, property or safety of NOWScale, our users or the public. We assess such requests, seek to narrow those that are overbroad, and (unless legally prohibited or the request concerns an emergency) will notify the affected customer so they can seek protective relief.

6.6 Corporate transactions

If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be disclosed to counterparties and their advisers under confidentiality obligations, and may transfer as part of the transaction. We will provide notice before personal data becomes subject to a materially different privacy policy.

6.7 Advertising choices

We do not sell personal information for money. Advertising cookies from Google, Meta and Microsoft that measure our own ads may constitute sharing for cross-context behavioral advertising under applicable state privacy laws. You can opt out at any time through Cookie preferences in the site footer, and we treat Global Privacy Control as that opt-out.

We do not upload customer lists to advertising platforms. Our ads are aimed at adults; this does not change the minimum account age specified in our Terms.

7. International transfers

NOWScale operates internationally, and personal data may be processed in countries other than the one in which it was collected, including the United States. Those countries may not offer the same level of data protection as your home jurisdiction.

Our servers and main database run in the United States, in the US East region. Pages and files are delivered through our hosting provider’s global network, and the vendors in section 6.1 process data in the locations shown there.

Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on an appropriate safeguard recognised under applicable law. The mechanism we rely on is the European Commission’s Standard Contractual Clauses (Decision 2021/914), together with the UK International Data Transfer Addendum issued under s.119A of the Data Protection Act 2018 for UK transfers, and the Swiss adaptations where relevant.

Alongside the contractual mechanism we apply supplementary measures such as encryption in transit and at rest, access restrictions and a policy of challenging overbroad government access requests. You may request a copy of the relevant safeguards, with commercially sensitive terms redacted, by writing to support@nowscale.com.

8. Retention

We keep personal data only as long as we need it. Rather than publish fixed periods we cannot honour consistently, we set retention by applying the following criteria:

• how long the data is needed to provide the Service and maintain the account;
• whether the customer has configured a shorter or longer period, or deleted the item themselves;
• statutory retention requirements, particularly for tax, accounting and corporate records;
• limitation periods for legal claims, and whether a claim, dispute or investigation is live or reasonably anticipated;
• the need to keep security, audit and abuse-prevention records long enough for them to be useful;
• the sensitivity of the data and the risk of harm from unauthorised access.

On termination or expiry of a customer’s subscription, we will delete or return customer content and associated personal data within ninety (90) days of the effective termination date, subject to any period the customer has agreed for export, and subject to backup rotation. Data held in encrypted backups persists until those backups expire on their ordinary cycle, during which it is isolated from active processing and is deleted when the backup expires.

Bug reports have a fixed ninety (90) day life, measured from the moment you send one, and that period does not extend because the issue is still open. The report, its diagnostics and any screenshot are deleted automatically at the end of it. See section 2.8.

Private YouTube caption transcripts cached for metadata and chapter suggestions are deleted after thirty (30) days without access. The same deletion removes the derived saved chapter generations. A new request may download the available caption track again.

Connected networks and ad accounts have their own periods, set out in sections 15 to 18. These include removing deleted X posts within twenty-four (24) hours, re-checking Reddit content at least every forty-four (44) hours and deleting what cannot be re-checked within forty-eight (48) hours, storing only analytics from Pinterest, caching Twitch data for no more than 24 hours, and refreshing or deleting Google Business Profile content within thirty (30) days. Where a network’s rules require a shorter period than the criteria above, the shorter period applies.

We may retain aggregated or de-identified data that can no longer be associated with an identifiable person for as long as it remains useful.

9. Security

We commit to maintaining technical and organisational measures appropriate to the risk of the processing. These include:

• encryption of personal data in transit over public networks;
• encryption of personal data at rest in our production systems;
• encrypted storage of secrets, including platform access and refresh tokens and API keys;
• role-based access control, least-privilege provisioning, and prompt revocation when access is no longer required;
• multi-factor authentication for administrative and production access;
• logging and monitoring of access to production systems and personal data;
• network segregation, hardened configuration and managed vulnerability patching;
• a documented incident response process covering detection, containment, assessment, notification and post-incident review;
• confidentiality obligations and security awareness training for personnel with access to personal data;
• security requirements imposed on subprocessors through written terms.

These are commitments about how we operate. We make no claim in this policy to hold any particular security certification or attestation.

No system is perfectly secure. You are responsible for keeping access to your email account secure (because sign-in codes are sent there, it is effectively the key to your NOWScale account) and for enabling the account protections we make available. If you believe your account has been compromised, or you have found a vulnerability, contact support@nowscale.com promptly.

10. Your rights

The rights available to you depend on where you live and on whether we act as controller or processor for the data in question. Where we act as a processor, we will refer your request to the relevant customer and assist them in responding.

10.1 EEA, UK and Switzerland

Subject to the conditions in applicable law, you have the right to:

• access the personal data we hold about you and obtain information about how it is processed;
• rectification of inaccurate data and completion of incomplete data;
• erasure of your data in the circumstances set out in Art. 17;
• restriction of processing while a dispute about accuracy or lawfulness is resolved;
• data portability: receiving data you provided in a structured, commonly used, machine-readable format, and having it transmitted to another controller where technically feasible;
• object to processing based on legitimate interests, and to object at any time and without justification to processing for direct marketing;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

10.2 United States state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you may have the right to:

• know what personal information we collect, the categories of sources, the purposes, the categories of third parties we disclose it to, and to obtain a copy;
• delete personal information we have collected from you, subject to statutory exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information and of targeted advertising (see section 6.7 for our position on this);
• limit the use and disclosure of sensitive personal information to what is necessary to provide the Service;
• opt out of profiling in furtherance of decisions producing legal or similarly significant effects;
• non-discrimination: we will not deny service, charge a different price or provide a lesser quality of service because you exercised a privacy right;
• appeal a decision to refuse a request. To appeal, reply to our decision or write to support@nowscale.com with “Privacy Appeal” in the subject line. We will respond within the period your state’s law allows and, if we deny the appeal, tell you how to contact your state attorney general.

You may use an authorised agent, and we may ask for proof of their authority and verify your identity directly. We do not sell or share personal information for money; section 6.7 explains how advertising cookies may constitute sharing and how to opt out. When your browser sends an opt-out preference signal such as Global Privacy Control, we treat it as an opt-out of sharing and do not set our sign-up attribution cookie. See our Cookie Policy.

10.3 How to exercise your rights and what to expect

Write to support@nowscale.com, or use the in-product privacy controls where available. We will verify your identity, usually by confirming control of the email address on the account, and by asking for further information where the request is sensitive or high risk. We do not collect additional data solely to verify a request beyond what is necessary.

We aim to respond substantively within one month for requests under the GDPR or UK GDPR, extendable by a further two months where a request is complex or numerous, in which case we will tell you within the first month and explain why. Under Brazil’s LGPD (art. 19), a complete response to a request to confirm or access your data is due within 15 days of the request; send these requests to support@nowscale.com. For requests under US state laws we aim to respond within 45 days, extendable once by a further 45 days with notice. Requests are free of charge unless manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, and will explain our reasoning.

11. Children

The Service is a business tool and is not directed to children. You must be at least 16 years old to hold a NOWScale account, and older if the age of digital consent in your country is higher. We do not knowingly collect personal data from children below that age. If you believe a child has provided personal data to us, contact support@nowscale.com and we will delete it promptly.

Customers are responsible for the content they upload, including content featuring minors, and for obtaining any consent required from a parent or guardian.

12. Cookies and similar technologies

We use cookies and browser storage to keep you signed in, protect sign-in and payments, and remember choices you made. Our Cookie Policy lists each cookie and storage item, how long it lasts, and how to clear it.

Optional cookies are managed by a CookieYes consent banner, loaded with our other measurement tags through Google Tag Manager on our public pages, sign-in pages, Help Center and the product. You choose separately whether to allow analytics, performance (session recording) and advertisement cookies. In the European Economic Area, the United Kingdom, Switzerland and Brazil they stay off until you accept them; elsewhere they are on by default and you can turn them off at any time through Cookie preferences in the site footer. Email and SMS preferences remain independent.

With your choice in place: Google Analytics measures how the site and product are used, including sign-ups, checkout starts and purchases with their value. Google Ads, the Meta Pixel and Microsoft Advertising measure which of our ads led to a sign-up, lead or purchase. For those conversions we may send your email address in hashed form (enhanced conversions and advanced matching) so the platform can match the conversion to its own user; hashing does not make this information anonymous. Private posts, prompts, comments, messages and connected channel data are never sent to these services. Google, Meta and Microsoft act as independent controllers for their advertising data under their own terms.

Microsoft Clarity records how pages are used (clicks, scrolling and page layout) when you allow performance cookies. Text in the product is masked before it leaves your browser, and our staff administration area is never recorded. Microsoft acts as an independent controller; its terms describe uses including advertising profiles and research using nonpersonal data. Ordinary recordings are kept for 30 days; saved recordings and heatmap data may remain for nine months. Masking is not retroactive, and Clarity does not provide individual-user deletion. See the Clarity terms.

Our own sign-up attribution (how you first found us) is kept for 90 days. Google Analytics event data is kept for 14 months. Withdrawing consent stops future collection; it does not reverse processing that already happened or erase legally required financial records.

13. Changes to this policy

We may update this policy as the Service, our practices or the law change. The date at the top of this page shows when the current version took effect. If a change is material (for example a new purpose of processing, a new category of recipient, or a change that reduces your rights), we will give advance notice by email to the address on the account, by an in-product notice, or both, before it takes effect. Continuing to use the Service after a change takes effect means the updated policy applies; where the law requires consent for a change, we will ask for it.

We keep prior versions and will provide one on request to support@nowscale.com.

14. Contact us

For any privacy question, request or complaint, or to exercise a right under section 10:

• Privacy team: support@nowscale.com
• Data protection contact: support@nowscale.com. This mailbox is monitored by the team responsible for data protection.
• Security reports: support@nowscale.com
• Legal notices: support@nowscale.com
• Postal address: NOWScale LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States

NOWScale LLC is formed in Wyoming. This policy is governed by Wyoming, without limiting any mandatory rights you have under the data protection law of your own country.

15. YouTube API Services

NOWScale uses the YouTube API Services. This section is the disclosure required of every application that does so, and it applies in addition to the rest of this policy. It is written to stand on its own, so you can read it without reading the whole document.

By connecting a YouTube channel to NOWScale you agree to be bound by the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

15.1 What YouTube data we access

We access a YouTube channel only after its owner connects it through Google’s OAuth consent screen, and only within the permissions granted there. We never access a channel our user does not own, and we never ask anyone to give us another person’s credentials. Subject to those permissions we access:

• Channel information: channel ID, title, description, thumbnail, declared country, and subscriber, view and video counts.
• Video information: titles, descriptions, tags, category, privacy status, scheduled and actual publish times, thumbnails, duration and processing status for the videos on the connected channel.
• Video statistics: view, like and comment counts.
• Comments: the text of comments and replies on the connected channel’s videos, the commenter’s public display name and channel ID, timestamps and moderation status.
• Caption tracks and playlists: the metadata and content of caption tracks and playlists belonging to the connected channel.
• Analytics reports: aggregated performance and audience reports for the connected channel from the YouTube Analytics API.
• Authorisation tokens: the OAuth access and refresh tokens that keep the connection working. These are stored encrypted and are used only to carry out actions the channel owner has asked for.

15.2 How we use and share it

We use YouTube data solely to provide the features the channel owner asked for: publishing and scheduling videos to their channel, listing and editing their existing videos, managing their thumbnails, captions and playlists, moderating the comments on their own videos, and showing them their own performance analytics. YouTube data is shown only to the user who connected the channel and to the members of the workspace the channel is connected to, according to the access they are given there.

When a Workspace member asks us to, or under the AI Replies rules and delivery settings chosen for the channel, we post replies to comments as the channel, set a comment’s moderation status to held for review or rejected, and ban a commenter from the channel. Automatic replies and moderation run only on channels where AI Replies is switched on, under the rules set for that channel.

We do not sell YouTube data, we do not share it with other customers or with advertisers, and we do not use it to train general-purpose or foundation models. We transmit content to YouTube on the user’s instruction when they publish, and we disclose data otherwise only in the limited circumstances set out in section 6, principally to the infrastructure subprocessors that run the Service, and where the law requires it. When you use an AI-assisted feature on a YouTube video or comment, the YouTube data that feature needs (such as titles, descriptions, tags, captions and comment text) is sent to OpenAI, our AI subprocessor, to produce the result. YouTube data is always identified as coming from YouTube and is never blended with another platform’s data into a single undifferentiated figure.

15.3 How long we keep it

• Comment text and commenter names are refreshed from the YouTube API or cleared within thirty (30) days. Video titles, descriptions and channel names are refreshed while the channel stays connected. Section 15.4 explains what happens when access is revoked.
• Statistics and metrics derived from them are kept for up to thirty-six (36) months so that historical performance charts remain available. Older points are aggregated and then deleted.
• Authorisation tokens are kept until you disconnect the channel, at which point they are deleted and we ask Google to revoke them. If you revoke access at Google instead, the stored tokens stop working; they are replaced if you reconnect and deleted if you disconnect.

15.4 Deleting your data and revoking our access

You can disconnect a YouTube channel from NOWScale at any time from the Connections screen in the product. Disconnecting stops all further access immediately and deletes the stored YouTube data associated with that channel, including its tokens, cached video and channel information, and collected statistics.

In addition to that normal deletion procedure, you can revoke NOWScale’s access to your data at any time through the Google security settings page at https://security.google.com/settings/security/permissions, also reachable at https://myaccount.google.com/permissions. Revoking there withdraws our authorisation directly at Google. The next time we try to use the connection, Google rejects it and we then:

• stop all further access to the channel and show it as needing to be reconnected;
• remove the channel’s video packaging previews and related analysis at that moment;
• clear comment text and commenter details once they have gone thirty (30) days without a refresh, and delete cached caption files thirty (30) days after they were created.

Other stored data for that channel, such as its video list and collected statistics, is kept until you reconnect the channel, disconnect it, or ask us to delete it. To remove it straight away, disconnect the channel in NOWScale or write to us.

You may also ask us to delete YouTube data we hold about you by writing to support@nowscale.com. Questions or complaints about our privacy practices, including those concerning YouTube data, can be raised through any of the channels in section 14.

16. Instagram, Facebook and Threads (Meta)

When you connect an Instagram professional account or a Facebook Page, we receive data from Meta’s APIs within the permissions you grant: the categories described in section 2.4, such as the account or Page profile, your posts and their metrics, and comments on your posts. We use it only to provide the features you use, under section 6.

16.1 Deleting your Instagram and Facebook data

• Disconnect the account from the Channels page in NOWScale. This removes its stored access tokens and cached data.
• Or remove NOWScale in your Meta account under Settings > Apps and Websites. Meta then sends us a deletion request, we delete the connection, its tokens and its cached analytics, and you receive a confirmation code. You can check the status of the request on our data deletion page, which keeps each receipt for ninety (90) days.

You can also write to support@nowscale.com.

16.2 Threads

You connect a Threads profile through Meta’s Threads authorisation screen, which asks for the permissions threads_basic, threads_content_publish, threads_read_replies, threads_manage_replies, threads_manage_insights and threads_delete. The rules in section 17.1 on who sees the data, what we never do with it, who else receives it, security and disconnecting apply to Threads data too.

• What we read: your profile (Threads user ID, username, name, profile picture and verification status) and follower count; your own posts and their views, likes, replies, reposts, quotes and shares; your profile insights, including profile views, clicks on the links in your posts and, where Threads provides them for profiles with at least 100 followers, follower demographics by country, city, age and gender, which are aggregate figures that do not identify anyone; and the replies to your posts, with each author’s username (public profiles only), profile picture and verification status. We do not read your mentions, other people’s profiles or Threads search.
• What we send: the posts you publish or schedule, your replies, your choices to hide or unhide replies, and deletion of replies and posts you made, when you ask for it.
• Use and display: publishing, analytics and the Comments inbox, shown in Channels, Content, Calendar, Analytics, Comments and search to the members of the Workspace the profile is connected to. If you use AI Replies on Threads replies, the reply text is sent to OpenAI as described in section 5.
• Retention: Threads data is kept while the profile stays connected and is refreshed as we sync it. When you delete a post on Threads, Threads tells us and we mark it as removed.
• Deletion: disconnecting the profile in NOWScale deletes its tokens and the Threads data we hold for it. You can also remove NOWScale in Threads under Settings > Account > Website permissions. We then stop using the connection and show it as needing to be reconnected. When Meta sends us a data deletion request for your Threads account, we delete the connection, its tokens and its Threads data, and give you a confirmation code you can check on our data deletion page.

17. Other networks you connect

This section describes the further networks NOWScale can connect to. It applies to a network from the moment you connect an account on it, in addition to the rest of this policy. If you never connect a network, we receive no data from it. Not every network listed here is available in every Workspace; the Service shows which ones you can connect.

17.1 Rules that apply to every network

• Your authorisation. We connect an account only after you authorise it on the network’s own screen (for Telegram and Discord, after you add our bot to your channel or choose a channel for our webhook), and we read and do only what that authorisation allows. We never ask for your password on another network.
• Who sees it. Data from a connected account is shown only to the members of the Workspace it is connected to, according to the access they are given there. It is never shown to other customers.
• What we never do. We do not sell data from connected networks, use it for advertising (ours or anyone else’s), share it with other customers or combine it across customers, use it for cross-customer benchmarks, use it to build profiles of individuals or to monitor people, or pass it to data brokers. We do not use it to train or improve artificial intelligence models, whether ours or a third party’s.
• Who else receives it. Only the subprocessors in section 6.1 that host and run the Service, OpenAI where a subsection below says an AI feature may use it, and anyone the law requires us to disclose it to.
• A person decides what is sent. Posts are published only as you write or approve them, at the time you choose, and replies on these networks are always sent by a person, never automatically.
• Security. Access tokens, refresh tokens, webhook secrets and other credentials are stored encrypted and used only for the actions you ask for.
• Retention. Unless a subsection below sets a shorter period, data from a connected account is kept while the account stays connected and is refreshed as we sync it. Where a network’s own rules require a shorter period, we apply that period.
• Disconnecting. You can disconnect an account in the Service at any time. That stops further access straight away and deletes its credentials and the data we hold from that network, including cached posts, statistics, comments and search entries, unless a subsection below says otherwise. Posts and media you created in NOWScale remain part of your own content. Deleting your Workspace or your NOWScale account does the same for every account connected to it. You can also ask us to delete the data by writing to support@nowscale.com.

17.2 X

• What we read: with the scopes tweet.read, users.read and offline.access: your profile (ID, username, name, profile picture, verification and subscription type, and whether the account is protected) and its follower, following, post and list counts; your own posts and their public metrics (impressions, likes, replies, reposts, quotes and bookmarks) and, for your posts from the last 30 days, the private metrics X provides (link clicks, profile clicks, engagements and video views); and replies to your posts and posts that mention you, with each author’s name, handle and profile picture. We do not request access to your direct messages, likes, follows, bookmarks or email address.
• What we send: with tweet.write, media.write and tweet.moderate.write: the posts, threads and media you publish or schedule, your replies, your choices to hide replies, and deletion of posts you made. We never like, follow, repost or send direct messages for you.
• Use and display: publishing, analytics and the Comments inbox. If you use AI-assisted drafting on a reply, the text you are answering is sent to OpenAI to produce the draft.
• Retention: when we learn that a post has been deleted or made protected on X, or that its account has been suspended, we delete it and its metrics, replies and search entries from NOWScale within twenty-four (24) hours. We do the same within 24 hours of a written request from X or from the X user concerned. Replies and mentions written by other people are deleted seven (7) days after we receive them.
• Deletion: disconnecting deletes the X data we hold for the account and revokes our tokens at X. You can also revoke our access in X under Settings > Security and account access > Apps and sessions > Connected apps.

17.3 Pinterest

• What we read: with the scopes user_accounts:read, boards:read and pins:read: your account (ID, username, account type, business name, profile image, website and about text) and its follower, following, monthly view, Pin and board counts; your boards, so that you can choose where to publish; and analytics for your account and Pins, such as impressions, saves, reactions, comment counts, Pin clicks, outbound clicks, profile visits, follows and video metrics. We do not request access to secret boards or secret Pins.
• What we send: with boards:write and pins:write: the Pins you create (images, carousels and videos, with their board, title, description, link, alt text and any AI disclosure), and deletion of Pins you made.
• Use and display: publishing and analytics, shown in Channels, Compose, Content, Calendar, Analytics and search.
• Retention: we store only the analytics of the Pinterest accounts that granted us access. Apart from the details needed to keep the connection working (account ID, username, name and profile image) and our record of the Pins you published through NOWScale and the boards you chose, all other Pinterest data, including your boards and detailed metrics, is read from Pinterest each time it is shown and is not stored.
• Deletion: disconnecting deletes our tokens, the stored analytics and our record of your Pins. Pinterest does not let us revoke our own access, so to remove it at Pinterest too, remove NOWScale from the apps connected to your Pinterest account.

17.4 LinkedIn (profiles and Pages)

You can connect your personal LinkedIn profile and any LinkedIn Page on which you are an administrator. Both use one LinkedIn authorisation with the scopes r_basicprofile, w_member_social, r_member_postAnalytics, r_member_profileAnalytics, w_organization_social, r_organization_social, w_organization_social_feed, r_organization_social_feed and rw_organization_admin.

• What we read: for your profile, your member ID, name, headline, public profile name and photo, your follower count, and statistics for posts you published through NOWScale(impressions, members reached, reactions, comments and reshares). For a Page, the Pages you administer and your role on them, the Page’s name and logo, its follower totals and gains and its page views, the Page’s posts with their impressions, clicks, reactions, comments, shares and video views, and the comments and replies on the Page’s posts, with each commenter’s LinkedIn identifier and, where LinkedIn provides them, name and photo. We do not read your connections, the comments on your personal posts, or the Page’s list of followers.
• What we send: the posts you publish or schedule to your profile or Page, edits and deletion of those posts, and the replies you write as the Page.
• Use and display: publishing, analytics and, for Pages, the Comments inbox. LinkedIn data is shown only to the people who manage that profile or Page in your Workspace. Analytics are aggregate counts and do not identify the members who engaged. LinkedIn data is never sent to our AI subprocessor, is not included in global search or exports, and is never combined with data from other sources or used for sales, recruiting or advertising.
• Retention: we follow LinkedIn’s storage limits. Commenters’ names and photos are removed after twenty-four (24) hours, and comment text written by other members after forty-eight (48) hours, after which the comment remains only as a link to LinkedIn. The text of Page posts imported from LinkedIn is removed after six (6) months; posts written in NOWScale stay part of your content. Page names and logos are refreshed at least weekly, and Page statistics are deleted after one (1) year. Your own profile details are refreshed only when you connect, reconnect or open your channels.
• Deletion: when you disconnect a LinkedIn profile or Page, we delete its LinkedIn data within ten (10) days and remove our notification subscriptions for it. LinkedIn offers no way for us to revoke our own access, so to remove it at LinkedIn too, open Settings & Privacy in LinkedIn and remove NOWScale from the services you have permitted.

17.5 Snapchat

• What we read: with the snapchat-profile-api scope, for your Snapchat Public Profile: its ID, organisation ID, display name, username, logo, description, category, website, profile type and subscriber count; daily profile statistics (subscribers gained and lost, profile views, Story, Spotlight and Saved Story views, and view time); statistics for each Story, Spotlight and Saved Story (views, viewers, shares, screenshots, favourites, completions, reply counts, swipe-ups and average view time); and the list of your Spotlights, Saved Stories and current Stories, including ones you posted outside NOWScale. We do not read messages, replies, comments or other people’s profiles.
• What we send: the Stories, Spotlights and Saved Stories you publish or schedule, which we upload in encrypted form, and deletion of Spotlights and Saved Stories you made.
• Use and display: publishing and analytics, shown in Channels, Compose, Content, Analytics and search. We act only on profiles you control, and we do not use Snapchat data for creator discovery, messaging, advertising or scraping.
• Retention: daily statistics are kept while the profile stays connected, so that your history remains available after Snapchat’s own 90-day reporting window. We keep our record of a Story after it expires on Snapchat.
• Deletion: disconnecting the profile, or deleting your NOWScale account, deletes our tokens and the Snapchat data we hold for it. Snapchat does not let us revoke our own access, so to remove it at Snapchat too, remove NOWScale from the apps connected to your Snapchat account.

17.6 Reddit

• What we read: with the scopes identity, read, history, mysubreddits, flair and privatemessages: your username, ID, avatar and karma, and whether your account is marked as over 18; the communities you belong to and, for the community you post to, its rules, post requirements and flair; your own posts with their score, upvote ratio, comment and crosspost counts and removal status; and replies to your posts and comments and mentions of your username, with each author’s username. We use privatemessages only to receive reply and mention notifications from your inbox. We never send private messages or chats, and we discard any private message we receive without storing it.
• What we send: with submit and edit: the post you publish or schedule to the community you choose, with its flair, your replies, edits of your text posts, deletion of your posts and replies, and marking inbox items as read. We never vote, follow, cross-post or comment automatically.
• Use and display: publishing, analytics and the Comments inbox, visible only inside your Workspace. Reddit data is not shared with any third party, other than the subprocessors that host the Service for us and where the law requires it, and it is never sent to our AI subprocessor. We do not show advertising alongside Reddit content.
• Retention: we check every stored Reddit item with Reddit at least every forty-four (44) hours. If it has been deleted or removed on Reddit, we delete it from NOWScale straight away, and anything we cannot check again within forty-eight (48) hours is deleted too. When an author deletes their Reddit account, we remove their username, profile link, avatar and flair. Community rules are cached for no more than 24 hours. Your own drafts in NOWScale stay yours.
• Deletion: disconnecting revokes our access at Reddit and deletes the Reddit data we hold for the account. You can also revoke our access at https://www.reddit.com/prefs/apps or ask us to delete your Reddit data by writing to support@nowscale.com.

17.7 Bluesky

Bluesky is a decentralised network built on the AT Protocol. Your account lives with a hosting provider, which may be Bluesky Social or a server you choose, and that provider shows the authorisation screen you use to connect NOWScale. We ask only for the permissions needed to create and delete posts, upload images and video, set reply and quote controls, and read the notifications, posts and profiles described below, and you can decline individual permissions.

• What we read: your decentralised identifier (DID), handle, display name, avatar and follower count, and the address of your hosting provider; from Bluesky’s public services, your post count and your own posts with their likes, replies, reposts, quotes and bookmarks; and replies to your posts, with each author’s handle, name and avatar.
• What we send: the posts you publish or schedule, with their images, video, link previews, content labels and alt text; your replies; your choices to hide replies; and deletion of posts and replies you made. To build a link preview, we fetch the web page at the address you include.
• Use and display: publishing, analytics and the Comments inbox. If you use AI-assisted drafting on a reply, the text you are answering is sent to OpenAI to produce the draft.
• Retention: Bluesky data is kept while the account stays connected. Each connection has its own cryptographic key, which is stored encrypted with its tokens.
• Deletion: disconnecting deletes our tokens, the key and the Bluesky data we hold, and asks your hosting provider to revoke our session. If you revoke our access with your hosting provider instead, we stop using the connection.

17.8 Mastodon

Mastodon is a decentralised network of independent servers. You connect the account you hold on the server you choose, and that server’s operator handles your account under its own rules and privacy policy.

• What we read: with the scopes profile, read:statuses and read:notifications: your account ID, username, display name, avatar, default post visibility and language, and your follower, following and post counts; your own posts with their replies, boosts, favourites and quotes; and notifications of replies to your posts, with the conversation they belong to, which can include replies from people on other servers. We ignore direct mentions. We also read your server’s public details and posting limits.
• What we send: with write:statuses and write:media: the posts you publish or schedule, with their media, alt text, visibility, content warnings and language; your replies; and deletion of posts and replies you made. Posts sent through NOWScale publicly show that they were posted via NOWScale. To connect, we register NOWScale as an application on your server once; that registration holds no personal data and is shared by everyone on that server who connects.
• Use and display: publishing, analytics and the Comments inbox. If you use AI-assisted drafting on a reply, the text you are answering is sent to OpenAI to produce the draft.
• Retention: Mastodon data is kept while the account stays connected. Replies that are no longer available on your server are hidden.
• Deletion: disconnecting deletes our token and the Mastodon data we hold, and asks your server to revoke our access. You can also revoke it yourself on your server’s Authorized apps page in your account settings.

17.9 Telegram

Telegram connects through a NOWScale bot rather than an authorisation screen. You start the bot in a private chat to link your Telegram account to the connection request, then add the bot to your channel as an administrator allowed to post, edit and delete messages.

• What we read: the channel’s ID, title, public username if it has one, photo and subscriber count, the bot’s rights in the channel, and confirmation that you administer the channel. While you connect, we receive your Telegram user ID and the messages you send to the bot; we use them only to confirm that you added the bot, and keep the user ID only for the ten (10) minutes the connection request lasts. If you message the bot later, we use the message only to answer it. The bot does not read the posts in your channel or any other chat.
• What we send: the messages, photos and videos you publish or schedule, edits to them, pins, and deletion of posts you made (Telegram allows this only within 48 hours of posting). The bot sends you only messages about connecting and answers to your questions, never marketing.
• Use and display: publishing, the channel card in Channels and subscriber counts on Home. We keep a copy of the channel photo in our own storage, because Telegram’s file addresses contain the bot’s secret token. Data received from Telegram is never sent to our AI subprocessor or used in any dataset.
• Retention: the channel details and daily subscriber counts are kept while the channel stays connected.
• Deletion: disconnecting deletes the channel’s data, and the bot leaves the channel unless the channel is still connected elsewhere in NOWScale. If you remove the bot or its rights in Telegram, we stop posting and show the channel as needing to be reconnected; disconnect it to delete its data.

17.10 Discord

Discord connects through Discord’s authorisation screen with the webhook.incoming scope, which creates a webhook for the one channel you choose, and the guilds scope.

• What we read: the webhook’s ID and secret token, and the IDs of the server and channel it posts to, with the server’s name and icon. The guilds scope shows us the servers you are in; we keep only the one you chose and discard the rest. We do not keep Discord’s access or refresh tokens. We have no bot in your server and never read its messages or members.
• What we send: the messages and files you publish or schedule to that channel, and deletion of those messages.
• Use and display: publishing, shown in Channels with a link to the channel.
• Retention: kept while the channel stays connected.
• Deletion: disconnecting deletes the webhook in Discord and the data we hold for it. You can also delete the webhook yourself in Discord, in the channel’s settings under Integrations > Webhooks, which stops all further posting.

17.11 Twitch

• What we read: with the channel:read:subscriptions scope and Twitch’s public data: your Twitch user ID, login, display name, profile image, broadcaster type and account creation date; your follower total, and your subscriber total and subscriber points if you are an Affiliate or Partner; your past broadcasts, highlights, uploads and clips, including clips viewers made of your streams, with their titles, thumbnails, durations and view counts; and, while you are live, your stream’s title, category, start time and viewer count, sampled every five minutes. Twitch also tells us when your stream starts and ends and when you revoke our access. If you choose to import clips, we ask separately for the channel:manage:clips scope to create clips from your videos. We do not read your chat or your lists of followers or subscribers.
• What we send: nothing is posted to Twitch. If you import clips, we create the clips you ask for and copy them into your uploads so that you can publish them elsewhere; they are then your content under section 2.3.
• Use and display: analytics and your content list. Previews play only in Twitch’s own embedded player, with Twitch named as the source. We do not use Twitch data for advertising, audience segments or marketing.
• Retention: Twitch data is cached for no more than twenty-four (24) hours. We refresh it, delete titles, descriptions and thumbnails that have not been refreshed within 24 hours, and remove what Twitch reports as deleted, so charts show current values only. If Twitch authorises us in writing to keep a longer history, we will update this section before we do so.
• Deletion: disconnecting revokes our token, cancels our Twitch notifications and deletes the Twitch data we hold. If you revoke our access in Twitch under Settings > Connections, Twitch notifies us and we delete the same data in every Workspace where the channel is connected. If you withdraw a permission, we delete the data it gave us.

17.12 Google Business Profile

• What we read: with the https://www.googleapis.com/auth/business.manage scope: the Business Profile accounts and locations you manage, with each location’s name, address, website, Maps links and verification state; the posts on each location, including ones made outside NOWScale; reviews of the location, with the star rating, text and dates, the reviewer’s public name and photo (or that they posted anonymously) and your replies; and performance data that Google provides in aggregate: Search and Maps impressions, calls, direction requests, website clicks, messages, bookings and menu clicks, and the monthly search keywords that led people to your profile.
• What we send: the posts (updates, events and offers) you publish or schedule, edits and deletion of those posts, and the review replies you write or delete. We never create, verify or edit locations, change your business information, or reply to reviews automatically.
• Use and display: publishing, reviews in the inbox, and analytics. If you ask for an AI draft of a review reply, the review is sent to OpenAI to produce it, and you decide whether to send it. We never combine Business Profile data across businesses.
• Retention: Business Profile content we store is refreshed from Google or deleted within thirty (30) days. Reviews not refreshed from Google within 30 days are deleted, and older reviews are loaded from Google when you view them. Performance data and the list of posts are read from Google when shown and cached for no more than 24 hours. Review text and reviewer names are not added to search.
• Deletion: disconnecting deletes the location’s data and revokes our Google access, unless the same Google login is still connected to another location in NOWScale. You can also revoke our access at https://myaccount.google.com/permissions, and the owner of a Business Profile can remove a manager’s access under People and access in Business Profile. Section 19 sets out how we handle all Google user data.

18. Ad accounts (Meta, Google and TikTok)

You can connect an advertising account to see how your paid campaigns perform and to manage them from NOWScale. This section applies to Meta ad accounts, Google Ads accounts and TikTok ad accounts from the moment you connect one, in addition to the rest of this policy. An ad account is connected separately from your social accounts.

18.1 What we access

You connect an ad account through the network’s own authorisation screen, and we use only what that authorisation allows:

• Meta: through Facebook Login for Business, with the ads_read and ads_management permissions and, where creating ads requires them, business_management and pages_manage_ads, so that an ad can run under a Facebook Page you manage.
• Google Ads: through Google’s consent screen, with the https://www.googleapis.com/auth/adwords scope. It is the only scope the Google Ads API offers and it gives full access to the account; we use it only for the reports and actions described in this section.
• TikTok: through TikTok API for Business advertiser authorisation, with its Ad Account Management, Reporting, Campaign Management and Creative Management permissions.

With that access we read:

• the ad accounts you can reach, so that you can choose which ones to connect, and for each one its ID, name, currency, time zone and status (for Google Ads, also the manager account used to reach a client account);
• the campaigns, ad sets or ad groups, and ads of each connected account: their names, status, objective or type, budgets, schedules, landing pages, targeting and creatives;
• daily performance figures such as spend, impressions, link clicks and conversions, from which we calculate click-through rate, cost per click, cost per thousand impressions and cost per conversion;
• for Meta, the Facebook Pages your ads can run under;
• the network’s identifier and name for the person who authorised the connection, and the access and refresh tokens that keep it working, which are stored encrypted.

These reports are aggregate figures about campaigns and ads. They do not identify the people who saw or clicked an ad. Audiences in NOWScale are targeting settings, such as locations, age ranges, languages and interests. We do not upload customer lists or other personal data to build audiences, and we do not read or store the ad account’s payment details.

18.2 Changes we make, only when you ask

From NOWScale you can:

• pause and reactivate campaigns, ad sets or ad groups, and individual ads;
• change daily and lifetime budgets;
• create campaigns, with their name, objective, landing page, budget, schedule, audience and creative.

We change or create something in an ad account only when you, or another member of your Workspace with access to it, press the button for that action in NOWScale. We never act on our own. There are no automated rules, and our AI features never create, change or pause ads.

Spend and charges. The network bills ad spend and any other charges to the advertiser’s own payment method, under the network’s terms. A budget you set or raise in NOWScale commits that spend on the network. NOWScale never handles ad payments and cannot see the ad account’s payment details.

Ad review. Ads you create or change go through the network’s own review, and the network decides whether they run.

18.3 How we use it and who sees it

We use ad account data only to show you the performance of your own campaigns on the Ads page of Analytics and to carry out the actions you ask for under section 18.2. Each ad account is assigned to one Project, and its data is shown only to members of your Workspace who have access to that Project, according to the access they are given there. Reports are shown one network and one ad account at a time: we never combine Meta, Google and TikTok figures with each other, with your organic social data, or with another advertiser’s data.

An agency can connect the ad accounts its clients have given it access to. The agency is then responsible for having its client’s permission to view and manage them, and we process the data on the agency’s instructions as described in section 1.2.

We do not sell ad account data, use it for advertising (ours or anyone else’s), share it with other customers or other advertisers, use it to build profiles of individuals, or use it to train or improve any artificial intelligence model. Ad account data is not sent to our AI subprocessor. We disclose it only as section 6 allows: to the infrastructure subprocessors that run the Service, to the network itself when you ask us to make a change, and where the law requires it.

18.4 How long we keep it

• Daily performance figures are kept for up to thirty-six (36) months so that you can compare periods. Older figures are deleted automatically every month.
• Account, campaign, ad set, ad group and ad details are kept while the ad account is connected and are refreshed with every sync.
• Creative files. Images and videos you upload for an ad are stored in our file storage (section 6.1) and sent to the network when you create the ad. We keep them while the ad account stays connected, so that you can reuse them, and delete them when you delete them, disconnect the network, or your Workspace is deleted. The network keeps its own copy of a creative it has received, under its own terms.
• Drafts. Campaigns you have started but not yet sent are saved in your Workspace until you send or delete them, and are deleted when you disconnect the network or your Workspace is deleted.
• Tokens are kept until you disconnect, or until the network tells us the authorisation has been removed.

18.5 Disconnecting and revoking access

• Disconnect a network from Manage ad accounts on the Ads page at any time. This takes effect immediately: we delete its tokens, ad accounts, campaign and ad details, collected figures, drafts and stored creative files, and ask the network to revoke our access where it supports that. When your Workspace is deleted, including when you delete your NOWScale account and with it your Workspace, the same happens for every connected ad account.
• Disconnecting does not stop your ads. Campaigns already running on the network keep running and spending until you pause or end them, in NOWScale before you disconnect or in the network’s own tools.
• Meta: you can also remove NOWScale in your Facebook settings. Meta then sends us a deletion request and we delete the ad account data together with any other data linked to that Facebook login, as described in section 16.1.
• Google Ads: you can also revoke our access at https://myaccount.google.com/permissions.
• TikTok: you can also remove our authorisation in your TikTok for Business account.

If you revoke our access at Google or TikTok, we stop syncing as soon as the network refuses our next request and show the connection as needing to be reconnected. The figures already collected stay available to your Workspace until you reconnect, disconnect the network in NOWScale, or ask us to delete them at support@nowscale.com.

19. Google API Services User Data Policy

NOWScale’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This applies to all data we receive from Google APIs: Sign in with Google, the YouTube scopes described in section 15, the Google Business Profile scope https://www.googleapis.com/auth/business.manage described in section 17.12, and the Google Ads scope https://www.googleapis.com/auth/adwords described in section 18. For that data:

• we use it only to provide and improve the user-facing features you use it for, as described in this policy;
• we transfer it to others only as needed to provide or improve those features (to the subprocessors in section 6.1, and to OpenAI only where you use an AI feature on that data), to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent;
• we do not use or transfer it to serve advertisements, including retargeting and personalised or interest-based advertising;
• we do not sell it, and we do not transfer it to advertising platforms, data brokers or other information resellers;
• we do not use it to determine creditworthiness or for lending;
• we do not use it to develop, improve or train artificial intelligence or machine learning models;
• our staff do not read it unless you have agreed to that for specific data (for example when you ask support to look into a problem), it is needed for security purposes such as investigating abuse, it is needed to comply with applicable law, or it has been aggregated and anonymised for our internal operations.