Data Controller
VoiceCraft is operated by RevCraft Oy (Business ID 3633703-5), Neidonkalliontie 25, 02400 Kirkkonummi, Finland. For any questions about this policy or your personal data, contact us at petteri@revcraft.io.

1. Who This Policy Covers
   This policy covers personal data of the professionals who use VoiceCraft as clients and of our own team members. VoiceCraft is an invite-only business service; we do not offer accounts to consumers.
   
   

2. What We Collect
   Account information: your name, email address, company, and role.
   Voice and content material: your onboarding and interview answers (including recordings and transcripts where interviews are recorded), your voice profile, brand materials you provide, and video files you supply for publishing.
   Content data: draft and approved posts, your reviews, ratings, and comments, and publishing schedules.
   Connected account data: when you connect a social media account (LinkedIn, YouTube, TikTok, Instagram, or X), we receive that platform’s account identifier, your public profile name or handle, and OAuth access tokens that allow us to publish on your behalf. We request only the minimum permissions needed for publishing — we do not access your feeds, messages, followers, or connections on any platform.
   Usage data: login activity and basic technical logs needed to operate and secure the service.
   
   

3. How We Use LinkedIn Data
   When you connect your LinkedIn account, we receive your LinkedIn account identifier and an access token. We use this access solely to identify your account, and to publish content that you have reviewed and approved to your LinkedIn profile, at the time you schedule. You can disconnect LinkedIn at any time in the VoiceCraft portal.
   
   

4. How We Use YouTube / Google Data
   VoiceCraft uses YouTube API Services to provide the video publishing feature. When you connect your YouTube account, we request only the permission to upload videos to your channel. We use this access solely to upload videos that you have reviewed and approved. We do not read your channel data, subscriber lists, analytics, or any other YouTube information.
   By using the YouTube features of VoiceCraft, you also agree to the YouTube Terms of Service. The Google Privacy Policy (http://www.google.com/policies/privacy) describes how Google handles your data.
   Your Google OAuth tokens are stored encrypted and are deleted when you disconnect your account, and in any case within 7 days of disconnection. You can disconnect YouTube at any time in the VoiceCraft portal. You can also revoke access at any time in your Google Account settings (myaccount.google.com/permissions).
   
   

5. How We Use TikTok Data
   When you connect your TikTok account through TikTok’s login flow, we receive your TikTok account identifier, your public display name, and OAuth tokens. We use TikTok’s Content Posting API solely to publish videos that you have reviewed and approved to your own TikTok account. Before each post, we query TikTok for your account’s current posting options (such as available privacy levels and video length limits) so that the post respects your account settings; we do not access your TikTok content, followers, or messages.
   You can disconnect TikTok at any time in the VoiceCraft portal, or revoke VoiceCraft’s access in the TikTok app under Settings and privacy → Security & permissions → Apps and websites. Your TikTok tokens are stored encrypted and are deleted when you disconnect.
   
   

6. How We Use Instagram (Meta) Data
   VoiceCraft uses the Instagram API provided by Meta to publish to Instagram professional accounts. When you connect your Instagram account, we receive your professional account identifier, your username, and OAuth tokens. We use data obtained from Meta’s APIs solely to identify your connected account and to publish Reels that you have reviewed and approved to your own Instagram account. When a video is published, Meta retrieves the video file from our secure storage using a time-limited link. We do not access your Instagram media, followers, comments, or messages.
   You can disconnect Instagram at any time in the VoiceCraft portal, or remove VoiceCraft’s access in your Instagram settings (Accounts Center → Apps and websites). If you remove access on Instagram’s side, Meta automatically notifies us and we delete the data we hold from Meta’s APIs for your account; you can also request deletion directly at petteri@revcraft.io. Your Instagram tokens are stored encrypted and are deleted when you disconnect.
   
   

7. How We Use X Data
   When you connect your X account, we receive your X account identifier, your handle, and OAuth tokens. We use this access solely to identify your connected account and to publish text posts that you have reviewed and approved (and, where you have chosen it, a follow-up reply containing a link) to your own X account. We do not read your timeline, messages, or followers.
   You can disconnect X at any time in the VoiceCraft portal, or revoke access in your X settings (Settings → Security and account access → Apps and sessions). Your X tokens are stored encrypted and are deleted when you disconnect.
   
   

8. AI-Generated Content
   Draft content is generated using Anthropic’s Claude API, based on your interview responses, voice profile, and the materials you provide. Under our commercial terms with Anthropic, data submitted through the API is not used to train Anthropic’s models. No content is published by automated decision alone: every draft is reviewed by our team and requires your approval before it is published anywhere.
   
   

9. Legal Basis (GDPR)
   We process personal data on the following legal bases:
   Performance of our contract with you — operating the service, producing your content, and managing your account.
   Your consent — connecting a social media account (LinkedIn, YouTube, TikTok, Instagram, or X) and publishing approved content on your behalf. You can withdraw consent at any time by disconnecting the account.
   Legitimate interests — securing the service and preventing misuse.
   
   

10. Sub-Processors and Recipients
    We use the following service providers to operate VoiceCraft:
    Supabase — database, authentication, and file storage
    Vercel — application hosting
    Inngest — background job processing (e.g. video publishing tasks)
    Anthropic — AI content generation (Claude API)
    Resend — transactional email
    When you connect a social media account, content and the data needed to publish it are transmitted to the relevant platform (LinkedIn, Google/YouTube, TikTok, Meta/Instagram, or X) on your instruction. These platforms process your data under their own privacy policies.
    
    

11. International Transfers
    Your data is primarily stored in Ireland (EU). Some of our providers operate from the United States; for those transfers we rely on the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses.
    
    

12. Security
    All data is encrypted in transit and at rest. OAuth tokens for connected accounts are additionally encrypted at the application level (AES-256). Access to data follows role-based restrictions: our team members can access only what they need to operate the service, and each client’s portal users can access only their own company’s data.
    
    

13. Retention
    We retain your data for as long as your subscription is active. Connected-account OAuth tokens are deleted when you disconnect the account (for Google/YouTube data, in any case within 7 days of disconnection). After your account is closed, we delete or anonymise your personal data within 90 days, unless a longer period is required by law (for example, accounting records).
    
    

14. Your Rights
    Under the GDPR, you have the right to access, correct, export, or delete your data, and to restrict or object to processing. To exercise these rights, contact petteri@revcraft.io — we will respond within the regulatory timeframes. Where processing is based on consent, you can withdraw it at any time (for connected accounts, by disconnecting them in the portal or in the platform’s own settings, as described in sections 4–8). You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
    
    

15. Cookies
    We use essential cookies for authentication and session management only. We do not use advertising or tracking cookies.
    
    

16. Changes
    We may update this policy from time to time. When we make material changes, we will post the updated policy on this page with a new “Last Updated” date and, where appropriate, notify you. Questions are always welcome at petteri@revcraft.io.