Datenschutzerklärung

This policy explains how TONTRIA handles personal data on tontria.com and in every TONTRIA product: TONTRIA Clips, TONTRIA AI and the TONTRIA suite (for Labels, for Management, for Publishers, for Artists, for Producers, Studio and Analytics), including their websites and apps.

1. Who is responsible

MUSICA & ENTRETENIMIENTO SRL (“TONTRIA”, “we”) is responsible for the personal data processed through the TONTRIA products. Contact: tontria.ai@gmail.com.

2. What we collect

• Account: name, email, password (stored only as a secure hash) or your Google sign-in, and the profile details you choose to give us (for example phone, country or what you do in music).
• Your content: the videos, audio, images, links, texts and files you upload or create, and in the suite the information of your workspace — artists, releases, contracts, royalty statements, tasks, campaigns and notes.
• Email you connect (suite): if you connect a mailbox to a workspace, we use it only for the features you turn on, such as sending the emails you approve.
• Connected social accounts: what each platform gives us when you connect it — see section 4.
• Payments: plan, purchases and payment status. Card details go directly to Creem; we never see or store them.
• Technical data: IP address, browser and device, and logs needed to run the Services, prevent abuse and keep them secure.

3. How we use it

To provide the products you use (process your content, create your exports, run your workspace, answer you with AI, publish what you ask us to publish), run your account, plan and payments, send service emails, give support, prevent fraud and abuse, and meet legal obligations. Depending on the case, the legal basis is the contract with you, your consent (which you can withdraw at any time, for example by disconnecting an account), our legitimate interest in keeping the Services secure, or a legal obligation.

AI features use the content of your workspace only to answer your requests, within your permissions. We do not sell personal data, we do not use it for advertising, and we do not use your content or data from connected platforms to train AI models.

4. Connected accounts: YouTube, TikTok, Instagram, Facebook and others

Connecting a social account is optional. You start it yourself, the platform shows you what TONTRIA is asking for, and you can disconnect it at any time. We use what we receive only to show you which account is connected and to publish the videos you choose, with the text and settings you choose, right away or at the time you schedule. We never post anything you did not send or schedule, and we do not read your messages, followers, comments or other posts.

• YouTube (Google): your channel’s ID, name and picture, and the list of videos you uploaded (title, thumbnail, duration and visibility) so you can make clips from them; we upload the videos you choose with the title, description, visibility and “made for kids” setting you pick. Permissions requested: youtube.upload and youtube.readonly. See section 5.
• TikTok: your TikTok ID, display name, username and profile picture; when you open the publish window, the options TikTok allows for your account (who can see the video, whether comments, duets and stitches are allowed, maximum video length). We send TikTok the video, the caption and the settings you choose (including commercial content disclosure), or send it to your TikTok drafts if you choose that. Permissions requested: user.info.basic, video.publish and video.upload.
• Instagram: your professional account’s ID, username, name, profile picture and account type. We publish the Reels you choose with the caption you write. Permissions requested: instagram_business_basic and instagram_business_content_publish.
• Facebook: the list of Pages you manage (name, picture and the Page’s access permission) so you can choose where to publish, and your app-scoped Facebook ID, used only to process deletion requests. We publish the Reels or videos you choose on the Pages you connected. Permissions requested: pages_show_list, pages_read_engagement and pages_manage_posts.
• LinkedIn and X (when available): your name, username and profile picture, and permission to publish the posts you choose.

For each post we keep, in your workspace, what you wrote, the date, its status and the link the platform returns. Access permissions (tokens) are stored encrypted on our servers, never reach anyone’s browser and are deleted when you disconnect. To publish, a platform may download the video from a temporary private link that expires within one hour.

Platforms’ own policies apply to what you publish there: TikTok Privacy Policy, Meta Privacy Policy, Google Privacy Policy.

5. Google and YouTube data

• TONTRIA uses YouTube API Services. By using the YouTube features you agree to the YouTube Terms of Service, and Google’s handling of data is described in the Google Privacy Policy.
• With “Sign in with Google” we receive your name, email address and profile picture, only to create your account and let you sign in.
• TONTRIA’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you see in the app, we don’t transfer it except as needed to provide those features, to comply with the law or as part of a merger or acquisition, we don’t use it for advertising, and people at TONTRIA don’t read it unless you ask us to (for example for support), it is needed for security, or the law requires it.
• Data we store from the YouTube API (channel details and video lists) is refreshed while you use it and deleted after 30 days at the latest otherwise. Thumbnails are cached for the same period.
• You can revoke TONTRIA’s access at any time from the app (disconnect the channel) or from your Google security settings at security.google.com/settings/security/permissions. When you disconnect, we revoke the permission and delete the channel’s data right away; if you revoke it from Google, we delete it the next time we try to use it and in any case within 30 days.

6. Service providers

• Hetzner (Germany): servers where the apps run and where TONTRIA Clips keeps your files.
• Cloudflare: network, security, file storage (R2) for processing in TONTRIA Clips and for the encrypted backups of all products, and cookieless visit statistics on our websites.
• Supabase: database, sign-in and stored files of the TONTRIA suite (for Labels, for Management, for Publishing, for Artists, Law and the other suite products), on Amazon Web Services servers in São Paulo, Brazil.
• Modal: GPU processing for TONTRIA Clips (transcription, reframing and rendering).
• Anthropic: AI models that answer your requests and analyze transcripts and texts.
• Resend: sending emails. Creem: payments, as Merchant of Record.
• Google, TikTok, Meta, LinkedIn and X: only when you sign in with them or connect an account, to do what you asked.

Providers only use data to provide their service to us, under agreements that protect it. Some process data outside your country, including in the United States; in those cases we rely on the safeguards the law provides, such as standard contractual clauses.

7. How long we keep data

Your projects, files and workspace data stay while your account exists, until you delete them. Temporary copies made for processing or publishing are deleted automatically. Connected-account permissions and profile details are deleted as soon as you disconnect the account, or when the platform tells us you removed TONTRIA or asked to delete your data. When you delete your account we delete your data from our servers right away and from encrypted backups within 30 days. We keep, without your account, the records of credits and payments that tax and accounting law requires, and minimal anti-abuse records.

8. Your rights and choices

You can access and correct your data in the app, download your files, disconnect any social account, and delete your account and everything in it. You can also ask us for a copy of your data, object to or restrict some processing, withdraw consent, or complain to your data protection authority. Step-by-step instructions: data deletion. Write to tontria.ai@gmail.com; we answer within 30 days.

9. Cookies

We only use essential cookies: the ones that keep you signed in and short-lived ones that protect sign-in and account connections (for example when you connect YouTube or TikTok). We also save small preferences in your browser, such as your language or light/dark theme. We do not use advertising or tracking cookies, and no third party places cookies through our sites.

10. Security

Connections are encrypted, passwords are stored as a secure hash, access permissions from connected platforms are encrypted, and access to your data is limited to your account and workspace. Backups are encrypted before they leave our servers and are kept for up to 30 days: TONTRIA Clips every 6 hours, the TONTRIA suite once a day. In the suite, two-step verification is required for workspace administrators and for anyone who sees royalties or payments, and owners and admins can see who opened or changed royalties, payments and contracts.

11. Children

The Services are not for children under 13.

12. Changes

If we make important changes to this policy, we will tell you in the app or by email before they apply. See also the terms of service.