Privacy Policy

This policy explains how ArtistOps handles information at artistopsservices.com. ArtistOps is operated by Ronnie Mota, an individual sole proprietor based in Georgia, USA, doing business as ArtistOps. Questions and requests go to [email protected].

01Our commitments

We do not sell your personal information or run advertising trackers. You retain ownership of your music and footage. We use your uploads to create and deliver your requested content; any optional use described in Part B of the Terms of Service requires your separate permission.

02Information we collect

• Account information: email, display name, a hashed password, account preferences, subscription and billing status, and records of your policy acceptance and optional choices. Agency accounts also include organization and roster information.
• Content you submit: songs, lyrics, artwork, footage, brand settings and the technical information derived to create your output, such as beat maps and lyric timing.
• Scheduler export packs: when you select approved reels for a scheduling handoff, ArtistOps stores a copy of each selected reel and the pack's captions, schedule and export settings. It serves each copied reel at a private media link so your scheduling tool can fetch it. Anyone holding that link can download the reel without signing in; treat it as a secret and share it only with your intended scheduler. The pack also contains a downloadable ZIP.
• Style Kits: uploaded logos and intro stings, layout settings and lower-third text such as performer name, city and handle. Artist kits belong to the artist account; label-owned kits are held by the label and may be applied to its roster.
• Snippet board: post links, platform labels, post times, notes and results you type in, such as views and engagement counts. These entries are supplied by you; the snippet board does not read them from any platform.
• Support and assistant messages: information you send to support or to J'von, our AI assistant, to answer questions and troubleshoot your account.
• Technical information: server logs, IP addresses, browser details, pages requested and errors, used to operate and secure the service.
• Billing identifiers: Stripe customer, payment and subscription identifiers. Stripe processes payment details; we do not receive or store full card numbers.
• Connected-platform data: only the account, publishing and reporting information described in section 04 below, when you authorize a connection.

03How we use information

We use account and content information to generate, edit, store and deliver your content, manage subscriptions, provide support, prevent abuse and keep ArtistOps working. J'von is an AI assistant, and its answers can be mistaken; human support is available by email.

AI processing of your uploaded songs and footage runs on infrastructure we operate. We do not send that content to third-party AI model providers. Connected-platform data is not used for model training or product research.

We may improve reliability using aggregate, de-identified product usage patterns that contain no connected-platform data or Your Content. Optional Part B permissions may authorize specific additional uses of content you submit directly to ArtistOps, but all connected-platform data, including derived and aggregated data, is excluded from every Part B permission and from aggregate product improvement. We do not use platform-derived audiences, engagement or analytics to advertise ArtistOps or anyone else's products.

If you permit a portal demonstration through the relevant Part B permissions, the capture browser receives a read-only impersonation session that expires after 15 minutes. Every request rechecks your permissions; withdrawal stops the session. Connected-platform pages and data are excluded. This capture workflow does not request or store your portal password, and its session token is kept only in the capture browser, not in the database.

04Connected platforms

You authorize access personally through the platform's own login. ArtistOps does not ask for your platform password. An agency or label may connect accounts it controls, or an artist's account only when the artist authorizes it through the artist's own login. YouTube connection and uploading require an active plan and are available on accounts with publishing enabled. TikTok connection and private video tests are available on eligible artist accounts. Public TikTok publishing remains unavailable during app review. Instagram and Facebook publishing remain in development, with no promised release dates.

Every post requires human review of its exact content, title, description and publishing settings. For platforms other than TikTok, an artist or label can explicitly enable auto-posting on each connected channel; it only schedules content already reviewed with those exact settings. The Social accounts control belongs to that channel, not the entire artist account. TikTok always requires per-post review and a manually chosen privacy level; TikTok has no auto-posting. You can turn off channel auto-posting or disconnect at any time.

Google and YouTube

ArtistOps uses YouTube API Services. When you connect a channel, we read its channel ID, title, handle and avatar; video lists and statistics; playlists and playlist items; and YouTube Analytics, including audience retention, traffic sources and subscriber changes. Connected-platform data is used only to identify your connected account, publish content you approve, and report on your own channel and posts.

With your publishing authorization, we write video uploads, thumbnails and playlist items to your selected channel. The content and publishing settings you authorize are sent to YouTube. Connecting a channel by itself does not authorize a post.

Access and refresh tokens are Fernet-encrypted at rest and retained only while the connection remains authorized. Non-statistics YouTube API data is refreshed or deleted within 30 days. YouTube statistics and analytics are kept only while your connection stays authorized; we re-verify authorization at least every 30 days and delete them within 7 days of disconnect or revocation. Temporary refresh failures are retried and do not by themselves establish revocation; the 30-day authorization backstop deletes data if authorization cannot be verified. All Google/YouTube platform data, including tokens, cached records, statistics, analytics and derived data, is deleted within 7 calendar days of disconnect, revocation at the platform, a definitive, non-retryable refresh-token grant failure, account deletion, a deletion request, or the subscription ending.

Disconnect in ArtistOps under Account > Social accounts, or revoke ArtistOps' access in Google's security settings or Google Account permissions. You can also email a deletion request. Google's handling of information is described in the Google Privacy Policy.

ArtistOps' use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Instagram and Facebook (when available)

We receive the Instagram professional account ID, username, account type and profile picture; Instagram media and account insights; Facebook Page IDs and names and Page engagement metrics; user and Page access tokens; and the IDs, permalinks and status of posts ArtistOps publishes for you. User and Page tokens are encrypted at rest.

Connected-platform data is used only to identify your connected account, publish content you approve, and report on your own channel and posts. Channel auto-posting only schedules content already reviewed with its exact title, description and settings. Tokens are deleted on disconnect. All Meta platform data is deleted within 7 calendar days of disconnect, revocation at the platform, a definitive, non-retryable refresh-token grant failure, account deletion, a deletion request, or the subscription ending. See data deletion instructions, including removal through Instagram Apps and websites or Facebook Business integrations. Meta processes information under its Privacy Policy.

The planned Facebook Login integration requests these scopes: instagram_basic, instagram_content_publish, instagram_manage_insights, pages_show_list, pages_read_engagement and pages_manage_posts. These identify your professional account and Pages, publish content you approve, and read your own insights. Meta publishing is currently unavailable.

Non-statistics Meta API data is refreshed or deleted within 30 days. Insights and engagement metrics are kept only while the connection stays authorized; authorization is re-verified at least every 30 days. They have the same purpose and all the seven-day deletion triggers described above.

TikTok

We receive your TikTok open_id and display name; creator_info settings such as available privacy choices and posting limits; encrypted access and refresh tokens; and each publish_id and publishing status. We store your basic profile name, username when available, and profile avatar URL with your connection. We request your current creator nickname, avatar and posting settings for review. Creator settings and temporary creator avatar URLs are not retained.

Connected-platform data is used only to identify your connected account, publish content you approve, and report on your own channel and posts. Every TikTok post requires separate review. The review displays your creator nickname and avatar, a privacy dropdown with no default choice, comment/duet/stitch interaction toggles off by default and disabled when creator_info disallows them, a commercial-content toggle off by default, Music Usage Confirmation, and a notice that processing may take time before the post is visible. You must manually choose the privacy level and confirm the required settings and disclosures before publishing. TikTok never auto-posts. Tokens are deleted on disconnect. All TikTok platform data is deleted within 7 calendar days of disconnect, revocation at the platform, a definitive, non-retryable refresh-token grant failure, account deletion, a deletion request, or the subscription ending.

Disconnect in ArtistOps or remove ArtistOps in TikTok's Manage app permissions. You can also email us. See our data deletion instructions and TikTok's Privacy Policy.

Staff access and disclosure limits

Staff do not view connected-platform data except with your consent for a specific support issue, recorded in our support or audit record, when necessary for security, or where the law requires. Support consent is limited to resolving that issue; it is not a marketing or research permission.

We transmit content and settings to the platform you instruct us to publish to. Providers operating our infrastructure process information only to supply that service under these limits. We do not give platform data to third parties for their own use. A legally required disclosure is limited to what the law requires. The no-sale, no-advertising, no-training and no-combination commitments apply to platform data even if it has been de-identified or aggregated.

05Other service providers and business transfers

• Stripe processes card details, payments, subscriptions and refunds under the Stripe Privacy Policy.
• Gmail (Google) processes email addresses and message contents for transactional email and human support. Google Drive processes artist names, email addresses and song titles for configured folder setup and listing. Reel delivery to Drive is currently disabled; older files already delivered there remain under your control. See the Google Privacy Policy.
• Google Fonts and Google's static asset servers receive browser requests, including IP addresses, to serve fonts and official YouTube branding. jsDelivr receives standard browser requests to deliver interface styles, icons and scripts.
• YouTube embedded players, including privacy-enhanced youtube-nocookie.com embeds, receive browser/device information when loaded and may use device storage, cookies or similar technologies under Google's Privacy Policy. A player can load when you open its page; a click is not always required. Google also hosts the optional booking calendar.
• Open-Meteo receives place searches and coordinates for geocoding and shoot-day weather. Zippopotam.us receives country and postal-code queries. OpenStreetMap/Nominatim receives place searches for geocoding, Overpass API receives coordinates and nearby-place queries for nearby-spot search, and OpenStreetMap tile servers receive browser requests for the map area you view.
• Wikimedia (Wikipedia/Wikidata) and Openverse receive location searches for addresses and reference photos. KartaView and, when configured, Mapillary receive coordinates for street-view imagery. Loading these images makes requests to their image hosts. We do not send your ArtistOps account details to these location and weather providers.
• Google web-search suggestions, Bing, DuckDuckGo, Brave and Amazon receive the search phrases used by optional SEO research. Pexels receives search phrases when its optional stock-asset tools are configured. We send search terms rather than your uploaded music or footage to these services.
• Apple iTunes Search receives genre terms to suggest comparable artists. The admin song-analysis tool sends artist names and song titles to Last.fm (when configured), TheAudioDB and MusicBrainz for music metadata and genre tags. These lookups do not send your audio or footage.
• Cloudflare delivers and protects the site. Its Web Analytics measures page views, referrers, countries and browsers without advertising cookies or cross-site profiles. If a signup verification widget is displayed, Cloudflare also processes browser and network information to check for abuse. See the Cloudflare Privacy Policy.
• Zoom hosts human strategy calls, webinars and the artist community when you choose to participate; it processes the meeting information you provide under its own privacy policy.

ArtistOps does not install Meta, TikTok or Google advertising trackers. External sites and embedded content have their own privacy practices and may use device storage. The request and storage disclosures above apply when those resources load.

A business transfer may include ordinary account records only within the Terms and this policy. Terms section 15 does not authorize transfer of connected-platform data. Any permitted transfer of Google API data as part of a merger, acquisition or asset sale requires your explicit prior consent. If you do not consent, that Google data will not transfer and will be deleted when the connection ends. Any proposed Meta or TikTok data transfer must meet their applicable rules and these commitments.

06Cookies and browser storage

A session cookie keeps you signed in and supports request security. Browser storage remembers preferences and interface state, such as the video you chose to keep watching. Cloudflare Web Analytics does not set analytics cookies. We do not use advertising cookies or cross-site tracking profiles. Embedded YouTube players, including privacy-enhanced players, may use device storage or cookies when their page loads. Other third-party pages may use their own storage under their policies.

07Storage, retention and backups

We store information on infrastructure we operate and use encryption for connected-platform tokens. Access is restricted to operating, securing and supporting the service. No storage or transmission method can guarantee absolute security.

J'von questions, answers, page context, feedback and response-quality information are stored to provide support and improve the answers and help guides. The operator and authorized admins can review individual questions and answers for that purpose. Daily cleanup deletes these records once they are older than 365 days; they are also included in account deletion. This does not authorize model training or use of connected-platform data for product improvement.

Application-secret configuration files (.env), such as billing, email and application credentials, are backed up separately with owner-only file permissions (0600 for new copies). These app secrets are separate from your connected-platform tokens and data, which are excluded from database backups. Existing secret-file copies are retained unless the operator explicitly removes them after keeping a secure copy elsewhere.

Scheduler handoff copies have separate expiry: private media links normally expire after 30 days or the configured lifetime; if necessary, expiry extends until two days after the last scheduled post. The pack shows the actual expiry, and you can revoke its links or delete the pack sooner. Expiry, revocation or deletion stops downloads through those links. ZIP downloads expire 24 hours after the pack is ready, and cleanup removes the ZIP and expired copied media. This does not delete your original retained reels or copies already fetched by your scheduler.

Style Kit retention: artist-owned and label-owned kits remain with their respective owners until deleted. Files referenced by a kit, saved reel, active render or unexpired upload are retained. When a kit is updated or deleted, asset cleanup records unused files; later kit activity removes those files once their 7-day grace period has elapsed. Cleanup does not remove files still referenced elsewhere. Label-owned kits remain held by the label when a roster artist leaves.

Snippet board retention: your manually entered post links and results remain until you delete the entries or request account deletion. They are ordinary user-submitted records, separate from connected-platform API statistics and their shorter deletion deadlines.

After your subscription ends, your account drops to a free account with Essentials-level limits indefinitely. This free account includes 6 generation credits per week, 3 GB of source storage, and access to your retained library, editing and downloads at Essentials-level limits. YouTube publishing requires an active plan and publishing enabled on your account. Content you upload directly and generated content are kept until you delete them or request account deletion by email. Cancelling does not lock the account or start a timed content-deletion or credit-forfeiture schedule. Purchased credits remain available in your retained account; weekly credits follow the current plan's allowance and one-week rollover.

Deleting a song moves its per-song directory to Trash. You can restore it for 60 days or permanently delete that directory sooner. Daily cleanup removes expired trashed per-song directories, including footage, photos, manifests and any song files stored inside them, and clears the song's content-directory and storage counters. It does not delete the Song database record, original uploads stored elsewhere, or separately stored rendered reels. Directory links are removed without deleting their external targets. Unsafe or unavailable directories are skipped for operator attention.

Email [email protected] to request account deletion. We complete account deletion requests within 30 days, with the shorter platform-data deadline below. Records needed for billing, security or legal obligations may be retained for their necessary purpose. Routine backups keep the newest 14 verified tool-created daily database dumps and eight tool-created weekly snapshots; deleted non-platform content may remain in those restricted backups until rotation. Manually saved, unmarked or unreadable archives are preserved for operator review and do not automatically age out. The operator manages those separately when fulfilling deletion requests. This does not authorize new optional uses.

All platform tokens and data from Google/YouTube, Instagram/Facebook and TikTok are deleted within 7 calendar days of disconnect, revocation at the platform, a definitive, non-retryable refresh-token grant failure, account deletion, a deletion request, or the subscription ending. A cancellation request leaves your connection and paid access available until the billing period ends; subscription end starts the deletion deadline. Platform tokens and data are excluded from routine backups. Older backups containing platform data are purged of that data within 7 days; backup rotations do not extend the deadline. Restore procedures exclude platform data and require users to reconnect.

08Your choices and requests

• Review and download generated content while your account has access, and cancel your subscription from Account.
• Choose publishing settings, turn off auto-posting per channel, or disconnect a platform. You can also revoke access at the platform itself.
• Change each Part B optional permission in Account settings. None of those permissions includes connected-platform data.
• Ask for access, correction, export or deletion by emailing [email protected]. We delete connected-platform data within 7 calendar days of disconnect, revocation or request. Account deletion requests are completed within 30 days. We respond to other requests within 30 days or any shorter deadline required by applicable law.
• If laws where you live give you additional privacy rights, including applicable access, deletion, objection or opt-out rights, use the same email. We may verify the request through your account email, and we do not charge for or penalize the exercise of applicable privacy rights.

See data deletion instructions for each platform. Disconnecting does not remove posts already on a platform or files you downloaded; you control those copies in their destination.

09Changes and contact

We update this page and its effective date when the policy changes. Material changes are shown at sign-in, where we require agreement to the current Terms of Service and Privacy Policy. A policy update does not expand your optional permissions or override the connected-platform commitments.

Contact Ronnie Mota, doing business as ArtistOps, at [email protected] with privacy questions, complaints or deletion requests.