Privacy and Google user data

The data controller is Bartłomiej Kolawa, operating Automation Center for the owned brands Tarovia, NeuroZabawy and SkinRate. Privacy contact: kontakt@tarovia.pl.

Automation Center is a private, locally operated content production, publishing and analytics tool. It is not a public social media service and does not offer public account registration.

• Connected channel identifier, handle, display name and granted OAuth scopes.
• Encrypted access and refresh tokens required to perform operator-authorized API calls.
• Identifiers and links for videos published or manually registered by the operator.
• Video performance such as views, likes, comments, shares, watch time, average view duration, average percentage viewed and subscriber change.

The application does not request Google passwords, private messages, contacts, viewer identities or precise viewer-level information.

Google user data is used only to verify the selected channel, upload content chosen or scheduled by the operator, display private performance reports and compare the operator's own creative formats.

Google user data is not sold, used for targeted advertising, used to determine creditworthiness, or transferred to data brokers. Human access is limited to the operator when necessary to operate, secure or support the application.

• Encryption in transit: OAuth authorization, token exchange and every Google or YouTube API request use HTTPS/TLS.
• Encryption at rest: access and refresh tokens are encrypted with AES-256-GCM. A fresh random nonce and authentication tag are used for every encrypted value.
• Key separation: the 256-bit encryption key is held separately in server-side environment configuration. It is not stored in the application database, source code or browser storage.
• Restricted access: token exchange, refresh and YouTube API calls run only on the server. Raw tokens are never displayed after connection and are not included in client-side bundles.
• Private operational environment: the operational panel, API and database run in the operator-controlled local installation. This public information website cannot access OAuth tokens, private channel data or analytics.
• Integrity and deletion: authenticated encryption detects altered ciphertext. Disconnect and permanent deletion controls remove stored credentials and stop further API access.

Metric collection ends 30 days after publication. Public video statistics and independently generated creative metrics may be retained for private historical comparison for no longer than allowed by YouTube API Services policies. Other API data is kept only while required to provide the connected feature and is refreshed or removed in accordance with applicable platform rules.

API data is not shared between unrelated users or brands. Necessary processing may occur through the platform provider itself and infrastructure used to operate the private installation. The public policy website is hosted by Vercel and does not receive OAuth tokens or private channel analytics.

The operator can disconnect an account to remove its stored token and stop further API calls. The permanent deletion control removes the account profile, OAuth credentials, platform post identifiers, permalinks and stored metric snapshots.

Google access can also be revoked through Google Account permissions. Full instructions are available at Data deletion. Requests may be sent to kontakt@tarovia.pl.

Use of information received from YouTube API Services is subject to the YouTube Terms of Service. Google's own privacy practices are described in the Google Privacy Policy.