Privacy Policy

• Contact details you give us when you enquire, book a call, email us or are invited to the Supermix Studio: your name, email address and company.
• Billing details such as billing contacts, addresses and tax identifiers. Card details are entered directly with our payment provider and we do not store full card numbers.
• Content you ask us to produce, including recordings, footage, transcripts and artwork, which may include personal information about hosts and guests.
• Technical data such as your IP address and browser type, used to keep our website and the Supermix Studio secure and working.
• Information from services you connect, such as a YouTube channel, an Instagram professional account, a TikTok account or an X account. Sections 3 to 6 describe this in detail.

We use personal information to provide the services you ask for, including producing content for you and letting you publish it to the accounts you connect in the Supermix Studio; to communicate with you about that work; to manage accounts and invoices; and to keep our systems secure. You and your team choose what is published. Supermix team members may also connect an account for you, or publish to an account connected to your workspace, but only with your authorisation. We do not sell personal information, and we do not use it for third-party advertising.

Supermix uses YouTube API Services to publish videos to YouTube channels our customers connect and to show those channels’ analytics in the Supermix Studio. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

What we ask for

When you or another member of your workspace connects a channel, we request four permissions from Google:

• Upload videos (youtube.upload). Lets us upload videos, set their titles, descriptions, thumbnails and privacy status, and schedule them, on the channel you connect.
• View your channel (youtube.readonly). Used only to look up the identity of the channel you connected (its ID, name, handle and avatar) so you can confirm the right channel is linked, and to check the status of videos we uploaded (scheduled, live or removed). We do not read your other videos, comments, subscribers, watch history or analytics.
• Manage your YouTube account (youtube). Used only to change the scheduled publish time of a video we uploaded when you move its release date. YouTube offers no narrower permission for editing a video, so this is the permission Google requires for that one action. We do not edit videos we did not upload, and we never delete videos, comments or playlists.
• View YouTube Analytics reports (yt-analytics.readonly). Used to read the channel’s aggregate performance reports — views, watch time, average view duration, subscribers gained and lost, likes, comments and shares by day; the same figures for the channel’s most-watched videos and for individual videos you open; where views came from (YouTube search, suggested videos, external links and so on), the countries they came from, whether viewers were subscribed, whether they watched videos or Shorts, YouTube’s aggregate age-range and gender shares of viewers, and each video’s audience-retention curve — so the Analytics page in the Supermix Studio can show how the channel and its videos are performing. All of it is aggregate: we do not read revenue or monetisation data, and nothing about any individual viewer.

What we store

We store the channel ID, name, handle and avatar, the permissions Google actually granted, the OAuth access and refresh tokens Google issues, who connected the channel and when, and the connection’s health. Tokens are encrypted at rest. They are decrypted only inside our backend, when we use the connection to publish, check on videos we uploaded, read the channel’s analytics, refresh the connection or revoke it. They are never shown to Supermix team members and never sent to a browser.

For analytics, we store daily aggregate figures for the channel (up to a year of history), the breakdowns above for the last 28, 90 and 365 days, the per-video figures for the videos it published in the last year and for videos someone in your workspace has opened, together with those videos’ titles, thumbnails and lengths, refreshed once a day and on request. These are the numbers the Analytics page shows. They are held in Tinybird, a managed analytics database hosted in the United States, in a store that only our backend can write to and that the Supermix Studio reads with a short-lived key scoped to your workspace, so one workspace’s figures are never readable with another workspace’s key. We keep them only while the channel stays connected, as described below.

How we use it

We use this access only to publish the videos you choose, or that Supermix team members publish for you with your authorisation, with the title, description, thumbnail, schedule and privacy status you set; to show your channel’s analytics to the members of your workspace and the Supermix team members who work on it; and to keep the connection working. We do not use Google user data for advertising, we do not sell it, and we do not use it to train machine-learning or AI models.

Who we share it with

Google user data is sent to Google to perform the actions you request and is stored with the infrastructure providers that host our systems (the analytics figures with Tinybird, as above). Members of your workspace in the Supermix Studio, and Supermix team members, can see which channel is connected, what has been published to it and its analytics. We do not otherwise share Google user data with anyone.

Revoking access and deleting data

You can disconnect a channel at any time from Settings → Connections in the Supermix Studio, or ask us to disconnect it for you. We then ask Google to revoke the grant, delete our copy of the tokens and delete the analytics figures we stored for the channel. You can also remove Supermix’s access from your Google Account permissions. Google does not tell us when you do that: the tokens stop working and stay stored, encrypted, until you disconnect the channel in the Supermix Studio or ask us to delete them. The channel’s analytics figures do not wait for that: once a channel’s connection has stopped working for 28 days, a daily job deletes every analytics figure we hold for it, well inside the 30 days YouTube’s policies allow. Reconnecting the channel afterwards fetches fresh figures from YouTube. After a disconnect we keep the channel’s ID, name, handle, avatar link and who connected it, so previously published posts remain readable in your history; ask us and we will delete them.

Google Calendar

Members of the Supermix team may connect their own Google Calendars to the Supermix Studio so colleagues can see their availability. This uses read-only calendar access together with basic profile information (name, email and photo). Tokens are handled the same way as described above, and calendar data is used only to display availability inside the Supermix Studio.

Limited Use

Supermix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Supermix Studio uses the Instagram API with Instagram Login, provided by Meta, to publish Reels to Instagram professional accounts (Business or Creator) that our customers connect, and to show those accounts’ analytics in the Supermix Studio. Personal Instagram accounts cannot be connected. Using Instagram is subject to the Instagram Terms of Use, and Meta’s handling of your data is described in the Meta Privacy Policy.

What we ask for

When you connect an account, we request three permissions from Instagram:

• View your profile (instagram_business_basic). Lets us read the account’s Instagram user ID, username, name, account type and profile picture, so the Supermix Studio can show which account is connected. We check the account type when you connect, to confirm it is a professional account, and store whether it is a Business or Creator account so the Supermix Studio can show it.
• Publish content (instagram_business_content_publish). Lets us publish a Reel to the account when you press Publish, check the account’s publishing limit, follow the Reel while Instagram processes it, and get its link once it is live.
• View insights (instagram_business_manage_insights). Used to read the account’s aggregate figures for the Analytics page, only for workspaces that have analytics turned on: how many followers and followed accounts it has and how many posts it has published; its views, reach, likes, comments, shares, saves, reposts, interactions and accounts engaged by day; for each post and Reel published in the last year, its link, thumbnail link, publish date, type (Reel, post or carousel), caption (of which we keep only the first line, as its title) and its lifetime views, reach, likes, comments, shares, saves and reposts, plus a Reel’s average and total watch time and the share of views that skipped it in the first three seconds; and the counts of followers by age range, gender, country and city that Instagram provides. All of it is aggregate: nothing about any individual follower or viewer.

We do not read your comments or messages, or who your followers are, and we never edit or delete posts. Instagram offers no way to schedule a post through its API, so a Reel goes out when Publish is pressed.

What we store

We store the account’s Instagram user ID and the separate ID Meta gives it for the Supermix Studio, its name, username, whether it is a Business or Creator account, a link to its profile picture (not the image itself), the permissions Instagram granted, an access token and its expiry date, who connected the account and when, and the connection’s health. For each Reel published through the Supermix Studio we keep its Instagram media ID, its link, the caption and settings it was published with, and who pressed Publish.

The access token is encrypted at rest, is never sent to a browser and is never shown to Supermix team members. Instagram tokens last about 60 days. While the account stays connected we renew the token automatically once a day, so the connection keeps working even when nothing is being published.

For analytics, we store the figures above once a day and on request: the follower count and each post’s lifetime figures as they stood that day (Instagram gives these only as running totals, so keeping one reading a day is how the Analytics page shows daily change), the account’s figures by day for up to the last year on first connect and every day after, and the follower breakdowns. They are held in Tinybird, as described in section 3, readable only with a short-lived key scoped to your workspace, and kept only while the account stays connected, as described below.

How we use it

We use this access only to publish the Reels you choose, or that Supermix team members publish for you with your authorisation, with the caption you write and your choice of whether the Reel also appears in your feed, and to keep the connection working. Two checks run in the background. Once a day we look up each Reel published through the Supermix Studio to see whether it is still live. And if Instagram’s reply to a publish is lost, we read the account’s 10 most recent posts, including their captions, only to find the Reel we just published; we keep nothing from that read except the matching Reel’s ID and link. Where your workspace has analytics, we also read the figures above once a day to show them on the Analytics page to the members of your workspace and the Supermix team members who work on it.

We do not use Instagram data for advertising, we do not sell it, and we do not use it to train machine-learning or AI models.

Who we share it with

To publish a Reel we send Instagram the caption, your feed choice and a public link to the video file in our storage; Instagram downloads the video from that link itself. Instagram data is stored with the infrastructure providers that host our systems (the analytics figures with Tinybird). Members of your workspace in the Supermix Studio, and Supermix team members, can see which account is connected, what has been published to it and its analytics. We do not otherwise share Instagram data with anyone.

Revoking access and deleting data

You can disconnect the account at any time from Settings → Connections in the Supermix Studio, or ask us to disconnect it for you. We then delete our copy of the access token and the analytics figures we stored for the account, and stop publishing to it. Instagram offers no way for us to revoke the permission ourselves, so to remove Supermix’s access completely, also remove Supermix Publisher in Instagram:

• In the Instagram app: tap your profile picture at the bottom right, then Menu (the three lines at the top right) to open Settings and activity. Under Your app and media, tap Website permissions, then Apps and websites, then Active, and tap Remove next to Supermix Publisher.
• On instagram.com: click More at the bottom left, then Settings. Under Your app and media, click Website permissions, then Apps and websites, then Active, and click Remove next to Supermix Publisher.

When Meta notifies us that you removed Supermix Publisher in Instagram, we delete the access token and the account’s analytics figures straight away. If the token instead stops working, for example because it was not renewed for 60 days, a daily job deletes the account’s analytics figures 28 days later. When Meta sends us a data deletion request for your account, we also delete the account’s IDs, name, username, account type, profile picture link and permissions, and clear the Instagram IDs and links stored on the posts published to it, including in each post’s activity history in the Supermix Studio, which keeps who published the post and when. You get a confirmation code and a link to a page on studio.supermix.io that shows the status of your request. We keep a record of the request itself (its confirmation code, the ID Meta sent us, how many connections it affected and when it was completed) so that page keeps working.

Otherwise, after a disconnect we keep the account’s IDs, name, username, account type, profile picture link and who connected it, so posts published to it stay readable in your history; ask us and we will delete them. Content published to your account stays on Instagram under your control.

The Supermix Studio uses TikTok’s Login Kit, Content Posting API and Display API to publish videos to TikTok accounts our customers connect and to show those accounts’ analytics in the Supermix Studio. Using TikTok is subject to the TikTok Terms of Service, and TikTok’s handling of your data is described in the TikTok Privacy Policy.

What we ask for

When you connect an account, we request these permissions from TikTok (the last two once TikTok has approved them for the Supermix Studio):

• Your basic profile (user.info.basic). Lets us read the ID TikTok gives the account for the Supermix Studio (its open ID), its display name and avatar, so the Supermix Studio can show which account is connected. TikTok also returns a union ID, which we do not store.
• Publish videos (video.publish). Lets us post a video directly to the account when you press Publish, and check its progress until it is live. With this permission we also read the account’s creator settings each time you open the TikTok post form and again just before publishing: its username and nickname, the privacy options it offers, whether comments, Duets and Stitches are turned off, and the longest video it can post. These settings decide what the form lets you choose. We keep only the username, nickname and avatar.
• Your account’s statistics (user.info.stats). Used to read the account’s follower, following, likes and video counts for the Analytics page, only for workspaces that have analytics turned on.
• Your public videos (video.list). Used to read the account’s public videos for the Analytics page, only for workspaces that have analytics turned on: each video’s ID, link, cover image link, title and caption (we keep the title, or the caption’s first line when there is no title), length, publish date, and its view, like, comment and share counts.

We do not read who your followers are, your private videos, comments or messages, and we never edit or delete posts. TikTok offers no way to schedule a post through its API, so a video goes out when Publish is pressed.

What we store

We store the account’s open ID, its nickname or display name, its username, a link to its avatar (not the image itself), the permissions TikTok granted, an access token and a refresh token with their expiry times, who connected the account and when, and the connection’s health. For each video published through the Supermix Studio we keep TikTok’s publish ID, the video’s link (which includes the account’s username), the caption and post settings it was published with, and who pressed Publish.

Both tokens are encrypted at rest, are never sent to a browser and are never shown to Supermix team members. TikTok access tokens last 24 hours and refresh tokens up to a year. While the account stays connected we renew the access token automatically about once a day, so the connection keeps working even when nothing is being published.

For analytics, we store the counts and video details above once a day and on request, as they stood that day (TikTok gives them only as running totals, so keeping one reading a day is how the Analytics page shows daily change). They are held in Tinybird, as described in section 3, readable only with a short-lived key scoped to your workspace, and kept only while the account stays connected, as described below.

How we use it

We use this access only to publish the videos you choose, or that Supermix team members publish for you with your authorisation, with the caption you write and the settings you pick in the post form: who can view the video, whether others can comment on it, Duet it or Stitch it, whether it promotes your own brand or is branded content, and whether it is labelled as AI-generated. We also check each post’s status until TikTok finishes processing it and, if TikTok has not yet returned the video’s public link, look for it once a day for up to seven days. Where your workspace has analytics, we also read the counts and videos above once a day to show them on the Analytics page to the members of your workspace and the Supermix team members who work on it.

We do not use TikTok data for advertising, we do not sell it, we do not use it to build profiles of anyone, and we do not use it to train machine-learning or AI models.

Who we share it with

To publish a video we send TikTok the caption, the settings above and a public link to the video file in our storage; TikTok downloads the video from that link itself. TikTok data is stored with the infrastructure providers that host our systems (the analytics figures with Tinybird). Members of your workspace in the Supermix Studio, and Supermix team members, can see which account is connected, what has been published to it and its analytics. We do not otherwise share TikTok data with anyone.

Revoking access and deleting data

You can disconnect the account at any time from Settings → Connections in the Supermix Studio, or ask us to disconnect it for you. We then ask TikTok to revoke our access, delete our copy of both tokens and the analytics figures we stored for the account, and stop publishing to it. If TikTok cannot be reached, we still delete the tokens, and you can remove Supermix Publisher in TikTok yourself:

• In the TikTok app: tap Profile, then Menu (the three lines at the top), then Settings and privacy. Tap Security & permissions, then Apps and services permissions, choose Supermix Publisher and tap Remove access.

When TikTok notifies us that access was removed in TikTok, or that the TikTok account was deleted, we delete the tokens, the account’s analytics figures and its open ID, name, username, avatar link and permissions, and clear the TikTok links and IDs stored on the posts published to it, including in each post’s activity history in the Supermix Studio, which keeps who published the post and when.

Otherwise, after a disconnect we keep the account’s open ID, name, username, avatar link and who connected it, so posts published to it stay readable in your history; ask us and we will delete them. Content published to your account stays on TikTok under your control.

The Supermix Studio uses the X API to publish video posts to X accounts our customers connect and to show those accounts’ analytics in the Supermix Studio. Protected accounts, whose posts only approved followers can see, cannot be connected, because the Supermix Studio publishes public posts. Using X is subject to the X Terms of Service, and X’s handling of your data is described in the X Privacy Policy.

What we ask for

When you connect an account, we request five permissions from X:

• View accounts (users.read). Used only to read the connected account itself: its X user ID, name, username and profile picture, so the Supermix Studio can show which account is connected, and its follower and following counts for the Analytics page. When you connect, and each time we read its counts, we also read whether the account is protected, which we check but do not keep.
• View posts (tweet.read). X’s permission covers every post the account can see. We read only the account’s own posts: to find a post we just published if X’s reply to the publish was lost, and, only for workspaces that have analytics turned on, to find the account’s video posts and read their figures, as described below.
• Create posts (tweet.write). Lets us publish a post to the account when you press Publish. X’s permission also covers reposting, which we never do.
• Upload media (media.write). Lets us upload the clip you chose to X, so the post can carry it.
• Stay connected (offline.access). Lets the connection keep working without you signing in to X again, until you disconnect the account or remove its access on X.

We do not read your Direct Messages, likes, bookmarks or lists, who your followers are, or anyone else’s posts, and we never edit or delete posts. X offers no way to schedule a post through its API, so a post goes out when Publish is pressed.

What we store

We store the account’s X user ID, its name and username, a link to its profile picture (not the image itself), the permissions X granted, an access token and a refresh token with the access token’s expiry time, who connected the account and when, and the connection’s health. For each post published through the Supermix Studio we keep its X post ID, its link (which includes the account’s username), the text and settings it was published with, and who pressed Publish. While a clip is uploading we also keep the ID X gives the upload, until the post is published or the attempt ends.

Both tokens are encrypted at rest, are never sent to a browser and are never shown to Supermix team members. X access tokens last two hours, and each refresh token works only once: every renewal gives us a new one, which replaces the old. While the account stays connected we renew the access token at least once a day, so the connection keeps working even when nothing is being published.

For analytics, only for workspaces that have analytics turned on, we keep track of the account’s video posts: its recent ones when we first read it (going back up to 90 days) and every video post it publishes after that, whether or not it was published through the Supermix Studio. To find them we read the account’s own posts (not its replies or reposts) published since we last looked. X returns each post’s text with it, which we do not keep, and from posts without a video we keep nothing except the newest one’s ID, which marks where the next look starts. For each video post we store its X post ID (and, if it was edited, the ID of its newest version), its link, publish time, a link to its preview image, the video’s length and its ID on X, and its views, likes, replies, reposts, quotes, bookmarks and video views. We also store its link clicks, profile clicks and engagements (X’s count of every interaction with the post). X shares these three only with the account’s owner, and only while the post is under 30 days old, so we keep the last values X shared for as long as we keep the post’s other figures. We also store the account’s follower and following counts. We never store or show a post’s text.

We read a tracked post’s figures every day for its first week, then 14, 21, 28, 60 and 90 days after it was published, and then once a month until it is a year old. X gives these figures only as running totals, so we keep one reading a day, as it stood that day, and carry a post’s last reading forward on the days it is not read. They are held in Tinybird, as described in section 3, readable only with a short-lived key scoped to your workspace, and kept only while the account stays connected, as described below. Our own database keeps each tracked post’s IDs, link, publish time, preview image link, length, video ID and latest figures, so we know which posts to read and when. When a reading shows a post has been deleted on X, we delete its figures and everything we tracked for it; otherwise we stop tracking a post a year after it was published and delete its figures then.

Turning analytics off for your workspace deletes everything we stored for its X accounts’ analytics, from our database and from Tinybird; turning it back on starts again from each account’s video posts of the last 90 days. While an account is protected (Protect your posts is on), we read and store no figures for it, and its analytics resume once that is turned off.

How we use it

We use this access only to publish the clips you choose, or that Supermix team members publish for you with your authorisation, with the text you write and the settings you pick in the post form: who can reply, and whether the post is labelled as a paid partnership or as made with AI. We upload the clip to X in parts, check on it while X processes the video, and then publish the post. If X’s reply to a publish is lost, we read the account’s posts from around the time of publishing to find the one we just made; we keep nothing from that read except the matching post’s ID and link. Where your workspace has analytics, we also read the account’s counts once a day and its posts on the schedule above, to show them on the Analytics page to the members of your workspace and the Supermix team members who work on it.

We do not use X data for advertising, we do not sell it, we do not use it to build profiles of anyone, and we do not use it to train machine-learning or AI models.

Who we share it with

To publish a post we upload the clip to X from our storage and send X the text and the settings above; X records Supermix Publisher as the app that made the post. X data is stored with the infrastructure providers that host our systems (the analytics figures with Tinybird). Members of your workspace in the Supermix Studio, and Supermix team members, can see which account is connected, what has been published to it and its analytics. We do not otherwise share X data with anyone.

Revoking access and deleting data

You can disconnect the account at any time from Settings → Connections in the Supermix Studio, or ask us to disconnect it for you. We then ask X to revoke our access, delete our copy of both tokens and everything we stored for the account’s analytics, and stop publishing to it. If X cannot be reached, we still delete the tokens, and you can remove Supermix Publisher on X yourself:

• In the X app or on x.com: open Settings and privacy, then Security and account access, then Apps and sessions, then Connected apps. Choose Supermix Publisher and revoke its access. On x.com this page is at x.com/settings/connected_apps.

X does not tell us when access is removed on X: the connection stops working the next time we renew it, and the Supermix Studio shows it as needing to be reconnected. Its tokens stay stored, encrypted, until you disconnect the account in the Supermix Studio or ask us to delete them. The account’s analytics do not wait for that: once the connection has stopped working for 28 days, a daily job deletes everything we stored for them.

After a disconnect we keep the account’s X user ID, name, username, profile picture link and who connected it, so posts published to it stay readable in your history; ask us and we will delete them. Content published to your account stays on X under your control.

We share personal information only as needed to run Supermix: with service providers that host and run our systems on our behalf and under our instructions, such as our hosting, database, file storage and error-monitoring providers; with the platforms you publish to, such as Google (YouTube), Meta (Instagram), TikTok and X, which receive the content and settings of each post; with other members of your workspace in the Supermix Studio; and where the law requires it.

We keep personal information for as long as we are working with you and as long as tax and accounting law requires afterwards. We return or delete your content on request. For connected accounts:

• Tokens are kept, encrypted, while an account is connected, and renewed automatically so the connection keeps working. We delete them when you disconnect the account in the Supermix Studio, and when Instagram or TikTok notifies us that access was removed. A connection that stops working, for example because access was removed in a Google Account or on X, keeps its tokens stored, encrypted, until the account is reconnected or disconnected, or until you ask us to delete them.
• Account details (the account’s IDs, name, handle, profile picture link, an Instagram account’s type, the permissions granted and who connected it) are kept after a disconnect so posts published to the account stay readable in your history. We delete them when you ask us to. When Meta sends us a data deletion request for an Instagram account, or TikTok notifies us that access to a TikTok account was removed, we delete all of them except who connected the account, which stays with your workspace’s records.
• Post history (the platform IDs and links of posts published through the Supermix Studio, and who published them) is kept with your workspace’s records. When Meta sends us a data deletion request for an Instagram account, or TikTok notifies us that access to a TikTok account was removed, we clear the IDs and links of the posts published to it and keep only who published them and when.
• Analytics figures for a YouTube, Instagram, TikTok or X account are kept while the account is connected. We delete them when you disconnect it, when Instagram or TikTok notifies us that access was removed, and 28 days after a connection stops working. An X post’s figures are also deleted once a reading shows the post has been deleted on X, and a year after it was published. An X account’s figures are also deleted when analytics is turned off for your workspace.
• Data deletion requests from Meta are kept as a record, as described in section 4.

We do not delete account details or post history automatically after a set period; ask us and we will delete them.

We protect personal information with encryption in transit, encryption at rest for credentials such as access and refresh tokens, and access controls that limit each customer’s workspace in the Supermix Studio to that customer’s members and Supermix team members. Tokens reach our servers over an encrypted connection when an account is connected and are encrypted before they are stored. They are decrypted only inside our backend, when we use the connection.

You can ask us for a copy of the personal information we hold about you, ask us to correct or delete it, or disconnect a connected account at any time. This includes the details we keep about a YouTube, Instagram, TikTok or X account after it is disconnected: email us the account’s handle and we will delete them. To remove Supermix’s access to an Instagram, TikTok or X account yourself, follow the steps in section 4, section 5 or section 6. These rights are open to everyone, wherever you live. Email ops@supermix.io and we will respond within the timeframes required by applicable law.

We may update this policy from time to time. We will post the new version on this page and update the effective date at the top.

Something Good Inc, which trades as Supermix. You can reach us at ops@supermix.io.