Privacy Policy

This Privacy Policy explains how MediaBand ("MediaBand", "we", "us") collects, uses, stores, shares and deletes information when you use the MediaBand AI Platform platform at studio.mediaband.ai (the "Service").

The Service is operated by Petr Fadeev, an individual developer (the "Operator"). Contact for any privacy question or request: studio@mediaband.ai.

1. What MediaBand does

MediaBand is a content production platform for creators and the teams that help them. Users plan content, write scripts, upload and review video files, approve them, publish them to their own social media accounts and see how the published content performs. Users may connect their own accounts on YouTube, Instagram, Facebook, TikTok, VKontakte and Telegram. Connecting an account is always optional and done by the account owner.

2. Information we collect

2.1. Information you give us

• Account data: name, email address, role in a project, profile picture (optional).
• Content you create or upload: scripts, notes, comments, tasks, video and image files, captions, titles, descriptions, publishing schedules.
• Messages you send to the MediaBand AI assistant inside the platform.

2.2. Information from connected platforms

Only after you authorize the connection, and only for the accounts you connect.

Apart from the Instagram bot described in section 2.3, we do not access your private messages, friends or contacts lists, payment data on these platforms, or data about accounts you did not connect.

2.3. Instagram: comments and direct messages (Instagram bot)

This applies only if the owner of a professional Instagram account turns on a bot rule in MediaBand and grants the permissions instagram_business_basic, instagram_business_manage_messages and instagram_business_manage_comments. The bot works like this: a person writes a code word under a post of the account (or in a direct message to it); MediaBand sends them, in a direct message, the material the account owner attached to that code word (for example a PDF or a link), optionally after checking that the person follows the account, and may post a short public reply under the comment. The bot never writes first: it answers only an action of the person. We do not read the account's other conversations.

• What we store. The text of a comment or message is not stored: we keep only whether a rule fired and which code word matched. The person is recorded by a one-way hash (an HMAC with a secret key of the server), not by ID, name or username. The account owner sees counters (wrote, received, went to the link) and the log of outcomes, not a list of names.
• What is encrypted and for how long. To reply in a direct message and to send one follow-up message, we keep the person's Instagram-scoped ID encrypted (Fernet, a key kept only on the server) and only while Instagram's 24-hour messaging window after their last message is open. The ID is erased automatically when the window closes (the check runs every five minutes). A person who only commented is answered with a private reply by comment ID, and their ID is not stored at all.
• Opt-out. A person can write "stop" in the direct message — no more follow-up messages are sent to them.
• Not shared. This data is not sold, not used for advertising or to train AI models, and not passed to anyone except Instagram (Meta) itself, to which we send the reply. The service providers listed in section 5 do not receive it.
• Deletion. When the account owner disconnects Instagram (section 7), the whole log of bot events for the account, its subscriber database and the records of what those subscribers received are deleted within 7 days. In addition, on your request a platform administrator finds the record about you by your Instagram ID and erases it entirely: the subscriber record, the deliveries and the bot events; the platform log keeps only the fact of the erasure, without your ID. How to request deletion is in the Data Deletion Instructions.

2.4. Technical data

• Log data (IP address, browser type, time of request) kept for security for up to 30 days.
• Strictly necessary cookies for signing in. We do not use advertising or third-party tracking cookies.

3. How we use information

We use information only to provide the Service you asked for:

• to publish content to your accounts when you (or a team member you invited) confirm a publication;
• to show you and your team analytics of your own content;
• to draft captions, descriptions and replies to comments with an AI assistant — a person reviews every draft before it is published, unless the account owner explicitly enables automatic short replies;
• to send you notifications about your projects;
• to keep the Service secure and fix errors.

We do not sell or rent your data, use it for advertising, build advertising profiles, or use data received from YouTube, Instagram, Facebook, TikTok or VKontakte to train general-purpose AI models.

4. Google and YouTube data

MediaBand uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service: https://www.youtube.com/t/terms.

Google's handling of your data is described in the Google Privacy Policy: https://policies.google.com/privacy (also available at http://www.google.com/policies/privacy).

MediaBand's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can revoke MediaBand's access to your Google account at any time on the Google security settings page: https://security.google.com/settings/security/permissions, or with the "Disconnect" button in MediaBand.

5. Who can see your data

• You and your project team. Data of a connected account is visible only to members of the project that the account belongs to, according to their role (for example, financial data only to roles the owner allowed).
• Service providers that process data on our behalf and only for the purposes above:
  • Hetzner Online GmbH — server hosting (data center in Finland, EU);
  • Anthropic PBC — AI processing for drafts and summaries (the Claude API; Anthropic does not use API data to train its models);
  • email delivery provider — sending sign-in codes and notifications by email;
  • Telegram — delivering notifications you turned on.
• Legal requirements. We disclose information if required by applicable law, after checking that the request is lawful.

We do not share data with anyone else.

6. Storage and security

• Data is stored on servers in Finland (EU).
• Access tokens of connected platforms are stored encrypted and are never shown to other users.
• All connections use HTTPS. Server access is limited to the Operator and protected by SSH keys.

7. How long we keep data

• Account data and your content — while your account is active.
• Data from a connected platform — while the account stays connected. We refresh or delete data we store from YouTube at least every 30 days, and check at least every 30 days that your authorization is still valid.
• Viewer comments received from platforms — refreshed or anonymized within 30 days; our own replies may be kept as history.
• When you disconnect an account in MediaBand, we revoke the access token immediately and delete all data received from that platform for that account (viewer comments, statistics and analytics, reports, the account's name and address, IDs of publications on the platform) within 7 days; for the first 3 days it is kept, in case you disconnected by mistake and reconnect. Your own materials — cards, scripts, files, captions — are not platform data: they stay until you delete them or your MediaBand account. We apply the 7-day period to every platform: it follows Google's requirements for the YouTube API and fits within the requirements of Instagram, Facebook, TikTok, VKontakte and Telegram to delete data without delay. If you revoke access on the platform's side (for example, in Google security settings), we find out at the next access check and delete the data within 7 days after that, and within 30 days of the revocation at the latest.
• Log data — up to 30 days.

8. Your choices and rights

You can at any time:

• disconnect any connected account in MediaBand ("Settings → Channel connections → Disconnect");
• revoke access on the platform's side (Google, Instagram/Facebook, TikTok, VKontakte settings);
• request a copy of your data, its correction or deletion — write to studio@mediaband.ai;
• delete your MediaBand account — see Data Deletion.

We answer requests within 30 days and complete deletion within 7 days of confirming the request. Deleting data in MediaBand does not delete content already published on YouTube, Instagram, Facebook, TikTok or VKontakte — you can delete it there.

9. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes

If we change this Policy, we will publish the new version on this page and update the date above. If the changes are significant, we will notify users in the platform or by email.

11. Contact

Petr Fadeev (individual developer), operator of MediaBand. Contact: studio@mediaband.ai. Website: studio.mediaband.ai.