Skip to content

Privacy policy

Updated on

Kaz Studio is a studio based in Mexico that builds custom software (websites, mobile apps, systems and integrations) and produces and publishes content for its clients on YouTube, TikTok, Instagram, Facebook and Pinterest. This policy explains what data we handle, on this site and while providing the service, and what you can do about it.

Who is responsible

Kaz Studio is responsible for the data described here. For anything about privacy, write to [email protected].

This site

kaz.studio uses no cookies. To know how many people visit it we use Cloudflare Web Analytics, which counts visits in aggregate, without cookies and without identifying you.

If you write to us with the contact form, we receive what you enter: your name, email, company, website if you give one, what you are interested in and your message. To filter out spam, the form uses Cloudflare Turnstile, which checks that a person is sending it without storing tracking cookies.

With that data, or with an email you send us, we only reply to you and, if we end up working together, provide the service. We do not send you advertising or hand it to anyone.

Our clients’ data

To publish and measure a client’s content, the client gives us access to their accounts through each platform’s authorization system (OAuth). With that access we handle:

  • the access permissions (tokens) the platform gives us;
  • the public and management data of their accounts and content: channel or page name, videos, posts, titles, descriptions, thumbnails, playlists and comments;
  • the statistics the platform offers the account: views, watch time, retention, traffic sources, aggregate demographics and reach;
  • if the client asks for it, the conversions that come from our tagged links (UTM), as recorded by the client’s own system.

We use them only for what the client asks of us: uploading and scheduling their content, keeping their texts and thumbnails up to date, replying or moderating when asked, and preparing results reports. We do not sell data, do not use it for advertising, do not hand it to third parties for their own purposes and do not use it to train artificial intelligence models.

Each client’s data is kept separately and never mixed with another’s. Access permissions are stored on the studio’s own machines, outside any code repository and with restricted access.

YouTube and Google APIs

We use the YouTube API Services. By authorizing us, the client also agrees to the YouTube Terms of Service, and Google handles their data under the Google Privacy Policy.

Kaz Studio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Access can be withdrawn at any time from the Google Account connections page.

TikTok, Facebook and Instagram

With TikTok’s and Meta’s (Facebook and Instagram) official APIs, and only on the accounts their owner authorizes:

  • on TikTok, we read the profile’s basic data and its videos’ statistics, and upload its videos as drafts: the owner reviews and publishes them from the TikTok app;
  • on Facebook and Instagram, we read the Page’s and the professional account’s data and statistics, and publish or schedule the videos and posts the client approves.

We follow the TikTok Developer Terms of Service and the Meta Platform Terms. All AI-made content is published with the label each network asks for.

Access is withdrawn on TikTok from Settings → Security and permissions → Apps, and on Meta from “Business integrations” in Facebook’s settings or from Instagram’s Accounts Center.

Who we share it with

Only with the providers we need to provide the service, which handle it on our behalf: Cloudflare (site hosting, email and image storage) and Google (email, backup storage and production tools). And, of course, with the platform where content is published, which receives what the client decides to publish.

We would also hand it over if a competent authority lawfully requires it.

How long we keep it

Access permissions, for as long as the service lasts or until the client withdraws them. Statistics and reports, for as long as the service lasts and up to 90 days after, unless the law requires us to keep them longer. Form messages and emails, for a year at most if we do not end up working together, or for as long as our relationship with whoever wrote to us lasts.

How to ask us to delete your data

Write to [email protected] from the address linked to the account, naming the account or the platform. We delete the access permissions and the stored data within 30 days and confirm by email when it is done.

You can also withdraw access directly on each platform: in your Google Account security settings, in Facebook and Instagram’s “Apps and websites”, in TikTok’s “Security and permissions” and in “Apps” in Pinterest’s settings. Once withdrawn we can no longer reach the account, and what we already had is deleted within the period above.

Your rights

Under Mexican personal data protection law you can ask to access, rectify or cancel your data or object to its handling (ARCO rights), and withdraw your consent. Write to [email protected]; we reply within 20 business days at most.

Changes

If what we do with data changes, we change this page and its date. If the change affects what a client authorized, we tell them first.