Privacy policy

What we collect, and why

From creators:

• Your name and email from Google, to sign you in.
• Read-only access to your YouTube channel and, if you connect it, your Instagram professional account, with the account’s name, to check your post once it is published.
• The drafts you upload, and what is said, written on screen and shown in them, to check each draft against its checklist.
• The brief you paste, to turn it into a checklist.
• Your PayPal email, to pay you.

From brands:

• The email you choose to give, to send you the two notices after a post is live.
• The PayPal references for your holds.

From both sides: the deal’s terms, checklist, notes and decisions, and the PayPal reference for every hold, capture and payout, so both of you can see what happened to the money.

What we never do

• See or store your Google, Instagram or PayPal password.
• Post, edit or delete anything on your YouTube or Instagram. Our access is read-only.
• Sell your data or show you ads.
• Let an AI move money. AI gives findings with evidence; our own code checks the evidence and decides.

How we protect it

• Everything between your browser, Sponing and the services it uses travels over HTTPS.
• Your Google and Instagram access is encrypted with AES-256, using a key kept apart from the database. It is never sent to your browser or written to logs.
• The database and stored files are encrypted at rest.
• Drafts are kept in private storage. Only the two sides of their deal can open them, through links that expire after 15 minutes.
• Your sign-in is kept in a cookie that scripts on the page can’t read.
• Server logs hold ids only: never tokens, passwords, video links or what was said in a video.
• Only the two people who run Sponing at Allynt Labs can reach its systems, and they sign in with multi-factor authentication.
• We don’t use your data, or anything from Google or Instagram, to train AI models.

Google and YouTube

Sponing’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sponing uses YouTube API Services to read your channel and the video you give it. By connecting YouTube you agree to YouTube’s Terms of Service, and Google’s Privacy Policy applies to what Google holds.

You can remove Sponing’s access at any time in your Google account’s settings.

Who else handles it

• PayPal: holds, capture and payouts (the sandbox only; no real money moves).
• Amazon Web Services: hosting, the database, file storage and encryption, and Amazon Bedrock, which reads briefs and checks drafts.
• Google: signing in, and reading your YouTube channel.
• Meta: reading your Instagram account.
• Resend: the brand’s two emails.
• Vercel: hosting this website, and counting visits to its pages without cookies.

How long we keep it

• Drafts, and the speech, on-screen text and frames read from them: 30 days after the post ends (paid, its hold returned, or closed).
• A live Reel’s video, fetched to check it: only until it’s matched to your draft, a few minutes.
• The brief, checklist, notes, check results and their evidence, and the brand’s email: while your account exists.
• Access to YouTube and Instagram: until you disconnect, access ends, or you delete your account.
• Payment records (amounts, dates and PayPal references): for as long as Sponing runs, with no name or email once your account is deleted.
• Your account, after you delete it: deleted at once; its files within 24 hours.
• Sessions: 14 days after last use.
• Server logs: 30 days; they hold ids only.

Your choices

• Stop Sponing reading YouTube or Instagram by removing Sponing in your Google account’s or Instagram’s own settings.
• Delete your account in Settings, or email hi@sponing.com and it’s done within 30 days. Deleting your data says what is deleted and what is kept.
• Ask what we hold about you, by email.

Cookies

One cookie keeps a signed-in creator signed in, and one keeps a brand in the deal it opened from its link. Scripts on the page can’t read them. We use no tracking or advertising cookies.