Creator Suite Privacy Policy

1. Who is responsible for your information

Creator Suite is a pre-launch Windows software project operated by Scott Patten as an individual under the intended StudioThirtyTwo brand. StudioThirtyTwo is not incorporated and is not a separate legal person. Scott Patten is responsible for personal information he decides to process and the purposes for which he processes it.

For privacy enquiries, contact privacy@creatorsuite.stream. This mailbox is routed through Cloudflare Email Routing to a monitored Gmail inbox.

Scott Patten currently has no fixed geographic residential or business establishment. No postal address is represented as an establishment. UK data-protection transparency requires the controller’s identity and contact details, but other laws may require a geographic establishment address for an online service or consumer contract. Email contact does not satisfy such a separate requirement. Creator Suite is currently pre-launch. Any future public beta, download, account or OAuth service, or paid consumer sale will require a review of the geographic-address and consumer disclosure requirements. Email contact does not replace a geographic address if one is required by law.

2. What this policy covers

This policy covers the Creator Suite informational website and the pre-launch Windows application. At the time this policy is published, the website does not offer public software downloads, account registration, subscriptions or checkout. The application features described below are conditional and are not currently offered to public users. A feature will be described as available only when it has been released and configured for users.

The website does not use analytics or advertising scripts and does not provide a newsletter or contact form. It uses one localStorage preference to remember whether you have enabled Energy Companions. Cloudflare Pages is the intended website host; its production configuration has not yet been verified. The actual production hosting and security providers may process technical information such as network and browser details to deliver and protect the pages.

The pre-launch application includes local creator tools, account and entitlement functions, optional AI features, support and diagnostic functions, billing code, YouTube and Twitch connections, a Restream connection, a TikTok LIVE page/webcast monitor and manual streaming destinations. These features are not currently offered to the public. TikTok developer API products are not integrated into the public application and are not production-approved.

3. Information that may be processed

The information depends on the page or feature you use.

Website

The website uses the localStorage key creator-suite-companions-enabled-v1 to remember whether Energy Companions are enabled or disabled. The site reads the saved preference when the companions initialise and saves your choice when you change the toggle. Turning companions off hides them and stops their animation, while saving the off choice. The adjacent notice says: “Your on/off preference is saved in this browser.” You can change the choice again with the keyboard-accessible toggle, or select the keyboard-accessible “Clear saved preference” control. Clearing removes the key and restores the default-on appearance. The cinematic introduction is not remembered between visits, and companion movement is not saved between sessions. No cookies, IndexedDB or sessionStorage are used by the inspected local website code. The website does not use analytics or advertising scripts and does not provide a newsletter or contact form.

When you visit the website, its hosting and security providers may process the page requested, time of request, browser/device information and network address to deliver and protect the pages. The production provider configuration and precise logging practices have not yet been verified.

Application, when a feature is made available

• Account and access: email address, account identifier, authentication and session information, display name if supplied, roles, entitlement and subscription status. The pre-release application is designed to use Supabase Auth and related account services. Account registration is not currently offered through the public website.
• Support and diagnostics: information you choose to enter in a support request or diagnostic report, such as a subject, message, report details, application version and category. The application sends these when you choose its in-app support or report action. Reports are not automatically uploaded.
• Projects and media: files you import, project names, edits, timelines, assets, captions, transcripts, audio/video, settings and local caches. In the current pre-release application, project files and media are stored on your device by default. Creator Suite does not currently provide a general-purpose cloud media library.
• Optional AI requests: text and metadata you select for an AI feature, and up to 12 sampled JPEG frames for visual analysis. The pre-release application is designed to send selected inputs through a Creator Suite Supabase function to an OpenAI API endpoint. These requests are not local-only. OpenAI states that API data are not used to train or improve its models unless the customer opts in. Its abuse-monitoring logs may contain prompts and responses and are retained for up to 30 days by default, subject to exceptions. OpenAI explains its API data controls here. This feature is not currently offered to public users.
• Connected-platform data: tokens, client identifiers, account/channel identifiers, permissions, connection status, stream/broadcast information, titles, visibility/status/health, ingest details and stream keys, depending on the platform and feature. YouTube and Twitch connection records are stored locally in the pre-release application using Windows DPAPI CurrentUser protection. Some Restream authorization operations pass through Creator Suite systems.
• Voice and video: the app contains local audio/speech workflows, including transcription, and may process media containing you or others. The current application does not provide a user voice-cloning or voice-training feature. Ordinary audio or video processing does not automatically mean biometric data is used to identify someone.
• Streaming and platform events: if you configure a stream, your selected live program is sent to the destination you choose. A pre-release TikTok LIVE monitor opens a TikTok LIVE page in an embedded WebView and reads event information such as handles, display names, messages and viewer/engagement events for local features. This monitor is not currently offered to public users, and no TikTok approval is claimed.
• Manual streaming destinations: Instagram Live Producer, Facebook Live, Kick and custom RTMP/RTMPS are manually configured destinations, not native OAuth/API connections. If used, the destination receives the selected stream and may receive the stream key.
• Billing: The pre-release application includes Stripe checkout, subscription and entitlement functionality, but subscriptions and checkout are not currently available to the public. If billing is introduced, transaction and subscription information will be processed by Stripe and the applicable billing services.
• Device and app diagnostics: app version, settings, local job/resource diagnostics and error details may be present in application records. Diagnostic, crash and updater information may be processed if those functions are enabled in a future release.

We do not ask for your Google, TikTok, Twitch, Facebook, Instagram, Kick or Restream password. Authenticate directly with the relevant platform. Do not send us passwords, OAuth tokens or stream keys.

4. Where information comes from

Information may come directly from you when you visit the website or, if application features are later made available, when you create an account, enter prompts, import files, connect a service, configure a stream or submit a support request. Privacy enquiries sent to privacy@creatorsuite.stream are received through Cloudflare Email Routing and the monitored Gmail inbox. If you connect a platform, some information is returned by that platform under your authorization.

5. Why information is used and the legal bases

The Energy Companions preference is stored and read solely to adapt the website’s appearance and function to your choice. The site explains beside the controls that the choice is saved in this browser. The keyboard-accessible “Clear saved preference” control is a simple, free way to object to this storage: it removes the saved key and restores the default-on appearance. Turning companions off changes their appearance and stops their animation, but it still saves the off choice; use “Clear saved preference” to remove the stored choice. If you later choose a setting again, the site saves that choice. This limited preference use is intended to fall within the website-appearance exception in Schedule A1 paragraph 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The preference is not used for analytics, advertising or tracking. If its purpose or controls change, we will reassess PECR before making the change. We may rely on our legitimate interests in delivering and protecting the website, after considering the impact on people.

If application features are made available, we will process information for these purposes and on these bases:

We will identify the relevant legitimate interest when relying on it. You can object to processing based on legitimate interests in circumstances provided by law. If we rely on consent for a particular activity, you may withdraw it at any time; withdrawal does not affect earlier lawful processing.

6. Google and YouTube

The pre-release Creator Suite connection uses YouTube API Services and requests one OAuth scope: https://www.googleapis.com/auth/youtube.force-ssl. It does not request Google email or profile scopes. Google describes the scope as permitting broad access that can include seeing, editing and permanently deleting YouTube videos, ratings, comments and captions. The YouTube connection uses channel ID and title transiently to identify the authorized channel and create/manage YouTube Live streams and broadcasts, check status, complete a broadcast and clean up resources created by a failed setup. The pre-release connection does not use API calls to upload or edit prerecorded videos, ratings, comments or captions. The live audio/video you choose is sent from the local encoder directly to YouTube’s ingest endpoint. The requested scope permits more than the API functions described above.

The pre-release app stores YouTube access and refresh tokens locally in a file protected with Windows DPAPI for the current Windows user. It does not persist the YouTube channel ID or title in that saved connection record. Tokens remain while the connection is saved; the app does not set a fixed retention period. When a YouTube channel check or API request reports a credential error, the app sends the saved refresh token and OAuth client ID to Google’s token endpoint to request a new access token. If that succeeds, the app updates the saved access token and its expiry locally while retaining the refresh token. While the app is running, it rechecks authorization when the Platform Connections screen is opened and the last successful check is more than seven days old, and when preparing an output. It does not run background checks while the app is closed. Temporary network or service failures preserve the saved connection. A confirmed HTTP 400 invalid_grant clears it. In-app disconnect removes the local record first and then attempts revocation with Google. If revocation cannot be confirmed, remove Creator Suite in Google Account security settings.

Creator Suite’s use of YouTube API Services is governed by the YouTube API Services Terms of Service and YouTube API Services Developer Policies. Google user-data handling is also governed by the Google API Services User Data Policy, including its Limited Use requirements. See also the Google Privacy Policy.

YouTube’s policies require deletion of Authorized Data as soon as possible and within seven calendar days after an in-app revocation or a user request to delete stored data/account. When a user revokes through Google Account security settings, associated API Data must be deleted as soon as possible and within 30 calendar days, with periodic authorization checks and deletion when authorization cannot be refreshed. Those timelines have different triggers; 30 days is not a general extension of the seven-day duties. The current pre-release integration does not retain a channel metadata/API-data cache. Before public users can connect a Google account, we will have a process to identify and delete Creator Suite-held API Data across applicable systems within YouTube’s deadlines. Disconnecting Creator Suite does not delete videos already held by YouTube. Google/YouTube process API requests and live media sent to them under their own terms and privacy notices. See the Google Privacy Policy.

The feature is not currently available to public users. Google Cloud configuration, scope classification, verification and a real Google-account test have not been completed.

7. Other integrations

• Twitch: The pre-release application includes device-code authorization and streaming functions. Tokens are held locally in the protected connection store, and the app attempts revocation on disconnect. Twitch receives API requests, stream details/key and the live program you choose to send. Exact scopes and production configuration will be described before this feature is made available.
• Restream: The pre-release application uses a Creator Suite gateway for some authorization, refresh and revocation operations, stores returned tokens locally, and reads account/channel/ingest information from Restream. The live program may be relayed to destinations you select. Details of the gateway and its providers will be made available before this feature is released.
• TikTok developer products: Login Kit, Share Kit, Content Posting API and Webhooks have been configured in a development Sandbox. They are not integrated into the public application. Creator Suite does not currently store TikTok developer OAuth credentials, upload videos to TikTok or publish directly through TikTok. No TikTok production approval is claimed. TikTok LIVE access is separate. The embedded LIVE monitor is not currently offered to public users; its authorization and release status have not been confirmed.
• Manual RTMP/RTMPS: when you configure a destination, your selected live audio/video and destination credentials are used to deliver the stream to that endpoint. The destination provider receives the content and may receive the stream key.

Third-party services have their own privacy notices and terms. Their handling of data they receive is governed by their own arrangements with you and applicable law.

8. Service providers and disclosures

Cloudflare Pages is the intended website hosting provider. The production hosting, security, logging, retention, location and transfer configuration has not been verified, so this policy does not claim which technical logs Cloudflare will retain or where production data will be processed. Before deployment, the configured provider services and their relevant data handling will be confirmed and this notice updated if needed. Cloudflare Email Routing and Gmail receive privacy enquiries so that they can be forwarded to and handled by Scott Patten. Read their privacy information and Google Privacy Policy. When application features become available, relevant recipients may include Supabase for account services and application functions, OpenAI for selected AI requests, Google/YouTube, Twitch, Restream and a Creator Suite gateway for platform connections, and Stripe for billing if enabled. The provider selected for a manual stream destination receives the content you send there. These services are not all active for public users. We will update this notice before enabling a feature if its providers or data use differ from what is described here.

9. International processing

Some providers may process information outside the UK. Where a restricted transfer occurs and the law requires a safeguard, we will use an applicable lawful transfer mechanism. You may contact us for information about the safeguards used for a particular service. We do not claim that information is stored only in the UK.

10. Retention and deletion

We keep personal information only for as long as needed for its purpose, any applicable legal obligations, and proportionate security or dispute needs. In particular:

• The Energy Companions localStorage preference remains until you change it, select “Clear saved preference”, or clear browser storage. The clear control removes the saved key and restores the default-on appearance.
• Project files and media stored on your device remain until you delete them or the device/application removes them. Creator Suite does not currently provide a general cloud media library.
• YouTube and Twitch tokens remain in the local connection store while you remain connected. The application does not set a fixed YouTube token-retention period.
• A future account is retained while active; after account closure, information is kept only where needed to meet legal obligations or resolve security/dispute matters.
• Support requests are retained while handled and for a proportionate period needed for follow-up, security or dispute resolution.
• Billing records, if subscriptions are introduced, are retained for applicable accounting and legal periods.
• Providers may have their own retention periods for service, security and abuse-prevention logs.
• On YouTube disconnect, the app removes the local token record and attempts provider revocation. This does not delete content already on YouTube or constitute deletion of the Creator Suite account.
Send a privacy or deletion request to privacy@creatorsuite.stream. Scott Patten will review the request, verify identity proportionately where needed, and respond under applicable law. There is currently no in-app account deletion or data-export control. Before public accounts or Google connections are offered, we will provide a process to carry out deletion requests and meet YouTube’s deadlines for data held across relevant systems. You may also revoke a platform connection in the app and in the platform’s own account settings. Revocation does not itself erase content held by that platform.

11. Security

The pre-release application uses HTTPS for cloud/provider requests and Windows DPAPI CurrentUser protection for several local token/settings files. These measures do not amount to a security certification or guarantee. No system can be guaranteed completely secure.

Keep your device and Windows account secure. Do not send passwords, OAuth tokens or stream keys by email. If you believe a platform credential is exposed, revoke or rotate it through that platform and contact us.

12. Your rights and complaints

Depending on the circumstances and legal basis, you may have the right to request access to, correction of, or deletion of your personal information; restriction of processing; portability of certain information; objection to processing based on legitimate interests; and withdrawal of consent where consent is used. These rights are subject to legal conditions and exceptions.

Contact privacy@creatorsuite.stream to exercise a right or ask a privacy question. You may also complain to the UK Information Commission through ico.org.uk.

13. Children

Creator Suite is a pre-launch product and no public account or download is currently offered. A minimum age and age-assurance approach have not been set. Before public access is offered, the intended age range, any age controls and child-appropriate privacy information will be established.

14. Website storage and similar technologies

The website uses localStorage only for the key creator-suite-companions-enabled-v1, which remembers whether Energy Companions are enabled or disabled so the site can adapt its appearance and function to that choice. The adjacent notice explains that the preference is saved in this browser. The keyboard-accessible toggle changes the choice; turning companions off hides them and stops their animation but still saves the off choice. The free, keyboard-accessible “Clear saved preference” control removes the key and restores the default-on appearance. This control provides a simple means of objecting to the storage. On the inspected local implementation, this limited use is intended to fall within Schedule A1 paragraph 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (the website-appearance exception). If you later choose a setting again, the site saves that choice. The preference is not used for analytics, advertising or tracking. The inspected local site code uses no other cookies, IndexedDB or sessionStorage. The production deployment must be checked for any host- or security-provider technologies before launch.

15. Changes to this policy

We will update this policy before introducing materially different personal-information practices and when the product, providers or features change. The current version and effective date will appear at https://creatorsuite.stream/privacy when it is published.