Legal
Privacy Policy
Last updated: 24 October 2026
This policy explains what data GoToRev Studio (studio.gotorev.com) collects, why, how long we keep it, who processes it for us, and how you can delete it. It applies to the Studio and to every account you connect to it.
- Who we are
- What the Studio does
- Data we collect
- Connected accounts and permissions
- How we use your data
- Google user data and YouTube API Services
- AI assistance
- Service providers
- Storage and security
- How long we keep data
- Disconnect and delete your data
- Cookies
- Your rights
- Changes
Who we are
GoToRev Studio is operated by Anthony Dalin, sole proprietor (entrepreneur individuel, micro-entreprise), trading as GoToRev Agency, SIREN 852 990 332, 2 rue Marie Louise, 13008 Marseille, France. We decide why and how your account data is processed (data controller).
Privacy contact: anthony@gotorev.com. We have not appointed a data protection officer: this is not required by Article 37 GDPR.
What the Studio does
GoToRev Studio helps creators and experts plan, write, edit, package and publish their content. You connect your own social accounts and Google Drive with each platform's official sign-in. The Studio then publishes the content you approve and shows how it performs. Access is by invitation only.
Data we collect
- Account: your name and email address, the public key of your passkey (we never see your device's private key), and your sign-in sessions (date, IP address, browser).
- Workspace content: the ideas, scripts, videos, images, captions, schedules and notes you create or upload.
- Connected accounts: the access and refresh tokens and the account details each platform shares with your consent, described in the next section.
- Activity log: what the Studio did for you (for example a video published, a sync failed), to show you the history and fix problems.
We do not collect payment card data in the Studio, and we do not read the followers, messages or content of accounts that are not yours.
Connected accounts and permissions
You choose which accounts to connect. Each platform shows you its own consent screen. We only request the permissions below, and only use them for the purpose written next to them. For Instagram, the name of the permission depends on how you sign in: with Facebook (first name) or with Instagram (second name).
| Service | Permission | What we access | Why |
|---|---|---|---|
| Google account | openid, email, profile | Your Google account ID, email address, name and picture | Show which Google account is connected |
| YouTube | youtube.upload | Uploading videos, titles, descriptions, thumbnails and privacy settings | Publish the videos you approve to your channel |
| YouTube | youtube.readonly | Your channel name, ID and picture; your videos and their public counts (views, likes, comments) | Show the channel that will receive a video, the publishing status and your results |
| YouTube Analytics | yt-analytics.readonly | Reports on your own videos (views, watch time, average view duration) | Show how each video performs 1, 7 and 30 days after publishing |
| Google Drive | drive.file | Only the files you pick in the Studio or that the Studio creates in your Drive | Read the videos you drop for editing and save the finished exports to your Drive |
| Instagram (professional account) | instagram_basic / instagram_business_basic | Your account ID, username, name, picture and list of posts | Show the connected account and your posts |
| instagram_content_publish / instagram_business_content_publish | Publishing Reels, photos and carousels | Publish the posts you approve | |
| instagram_manage_insights / instagram_business_manage_insights | Reach, views, likes, comments and saves of your posts | Show your results | |
| instagram_manage_comments, instagram_manage_messages / instagram_business_manage_comments, instagram_business_manage_messages | Comments on your posts and messages sent to your account | Only if you turn on keyword replies: answer a comment or a message with the resource you promised | |
| Facebook Page | pages_show_list, pages_read_engagement, pages_manage_posts, read_insights | The Pages you manage, publishing to the Page you choose, and the Page's post statistics | Publish the posts you approve to your Page, edit or remove them when you ask, and show your results |
| Threads | threads_basic, threads_content_publish, threads_manage_insights | Your Threads profile, publishing, and post statistics | Publish the posts you approve and show your results |
| TikTok | user.info.basic | Your open ID, display name and avatar | Show which TikTok account will receive a video |
| TikTok | video.publish, video.upload | Posting a video to your account, or sending it as a draft to your TikTok inbox | Publish the videos you approve, with the settings you choose on the posting screen |
| TikTok | video.list | Your public videos and their counts | Show your results |
| openid, profile, email, w_member_social | Your name, picture, email and posting on your profile | Show the connected profile and publish the posts you approve |
How we use your data
- To provide the features you see: prepare your content, publish what you approve, and show your results.
- Nothing is published without your approval, or without an automatic rule you turned on yourself in your workspace.
- To secure the service and fix errors.
- To answer you when you write to us.
We never sell your data, never use it for advertising, and never share it with data brokers. People at GoToRev only look at your data when you ask us to, when it is needed for security or to fix a problem you reported, or when the law requires it.
Google user data and YouTube API Services
GoToRev Studio uses YouTube API Services. By using the YouTube features of the Studio, you agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.
GoToRev Studio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- We only use Google user data (YouTube, YouTube Analytics, Google Drive and your Google account details) to provide and improve the user-facing features described above.
- We do not use Google user data, including Google Drive files, to develop, improve or train generalized artificial intelligence or machine learning models.
- We do not transfer Google user data to others, except to provide the features you use (for example the AI assistance below), for security, to comply with the law, or as part of a merger or acquisition with your prior consent.
- We do not use Google user data for advertising, and no person reads it unless you agree, for security, to comply with the law, or once aggregated and anonymized for internal operations.
You can disconnect Google or YouTube at any time in the Studio settings: we revoke the access token at once and delete the data obtained from that service within 7 days. You can also remove the Studio's access from your Google security settings; we then delete the data obtained from Google within 30 days.
AI assistance
When you ask the Studio to suggest a title, a script, captions or a summary, we send the text needed for that task (for example your idea or the transcript of your video) to the AI provider listed below. We do not send your tokens or account credentials. We use providers whose API terms do not allow them to train their models on our requests, and we ask OpenRouter to route only to providers that do not collect data. If you connect your own AI provider with your own key, your contract with that provider applies.
Transcription of your videos uses OpenAI's Whisper API (listed below). In a client workspace, it runs only with your own OpenAI key.
Service providers
These companies process data for us, under contract, only to run the Studio:
| Provider | Role | Location and safeguards |
|---|---|---|
| Vercel Inc. | Hosting of the Studio (region: Frankfurt, Germany) | United States. EU-U.S. Data Privacy Framework |
| Neon (Databricks) | Database | Germany (Frankfurt, AWS eu-central-1) |
| Hetzner Online GmbH | Our processing server: audio extraction and cleanup, video rendering, uploads to the platforms | Germany (Falkenstein data centre). No transfer outside the EU |
| OpenAI | Transcription of your videos (Whisper), with your workspace's own OpenAI key when you connect one | United States. Standard Contractual Clauses in OpenAI's DPA; API data not used for training |
| Auphonic GmbH | Audio cleanup (podcasts and voice tracks), with your workspace's own Auphonic key when you connect one | Austria (EU) |
| Anthropic PBC | AI writing assistance (scripts, titles, captions) | United States. Standard Contractual Clauses in Anthropic's DPA; API data not used for training |
| OpenRouter Inc. | Access to other AI models, only when you choose one in the Studio | United States. Standard Contractual Clauses in OpenRouter's DPA; requests not stored, routed only to providers that do not collect data |
| Resend | Sign-in and invitation emails | Emails sent from Ireland; account data in the United States. EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
When you connect a platform, that platform (Google, Meta, TikTok, LinkedIn) also processes your data under its own terms and privacy policy.
Storage and security
Access and refresh tokens are encrypted before they are stored. Connections use HTTPS. Only Anthony Dalin has administrative access to the production systems. Sign-in uses passkeys or single-use email links; we never store a password.
How long we keep data
- Account and workspace content: as long as your workspace is open, then deleted within 30 days of its closure or of your request.
- Tokens: as long as the account stays connected. We check every 30 days that each authorization is still valid and delete the data of accounts that are no longer authorized.
- Statistics from the platforms: kept to show your results while the account stays connected; data from YouTube API Services other than statistics is refreshed or deleted within 30 days.
- Disconnecting a platform: token revoked at once, data obtained from that platform deleted within 7 days.
- Activity log: 12 months, then deleted automatically. Technical logs at our host: 1 day at most.
- Database backups: up to 7 days.
Deleting your data in the Studio does not delete content you already published: it stays on your accounts under each platform's terms, and you can remove it there.
Disconnect and delete your data
You can disconnect any account in the Studio settings, or remove the Studio from the platform's own settings (Google security settings, Facebook and Instagram “Apps and websites”, TikTok “Manage app permissions”, LinkedIn “Permitted services”).
To delete all your data, write to anthony@gotorev.com or follow the steps on our data deletion page. We confirm the deletion by email.
Your rights
Under the GDPR you can ask to access, correct, delete or export your data, and object to or restrict its processing. Write to anthony@gotorev.com; we answer within one month. You can also complain to the French data protection authority, the CNIL.
The legal bases are the performance of our contract with you (providing the Studio) and our legitimate interest in securing the service.
Changes
If we change this policy, we update the date above and tell you in the Studio before the change applies to you. We will ask for your consent again before using your data for a new purpose.