Privacy Policy

1. Introduction

AirCreator is a service operated by AIRCREATOR.COM LLC, a Puerto Rico limited liability company with its principal office at 954 Ave Ponce de Leon, Suite 205, PMB 10737, San Juan, PR 00907. This Privacy Policy explains how we collect, use, store, and protect your information when you use AirCreator and its associated products.

AirCreator includes three core products:

• AirClone — analyzes your top-performing videos and builds an AI clone of your communication style and personality.
• AirPublish — lets you upload, schedule, and publish content to your connected YouTube, Instagram, Facebook, TikTok, Pinterest, and Threads accounts.
• AirIdeas — suggests content ideas in your style using your AI Clone profile.

By using AirCreator, you consent to the practices described in this policy. If you do not agree, please do not use the service.

2. Information We Collect

2.1 Account information

When you sign up using your Google account (or via email and password), we receive your name, email address, and profile picture from the authentication provider. We use this information to create and maintain your AirCreator account.

2.2 Connected platform data

When you connect a social media platform (YouTube, Facebook, Instagram, TikTok, Pinterest, or Threads), we receive an OAuth access token and (where applicable) a refresh token from that platform. We use these tokens to access the data described in this policy, on your behalf, and only for the purposes you authorize.

From your connected platforms, we read information including:

• Channel, page, or profile identifiers (channel ID, page ID, account ID, username, display name)
• Public profile data (bio, subscriber/follower count, profile picture URL)
• Video metadata (titles, descriptions, thumbnails, view counts, like counts, comment counts, durations, publish dates)
• Aggregated analytics (e.g. 180-day view totals used to identify your top-performing videos)

2.3 Audio

To build your AI Clone, AirClone fetches audio from up to 50 of your highest-performing videos. The audio is resolved and downloaded via a third-party audio service, then uploaded to our managed cloud storage (Supabase Storage). The audio file is stored at a publicly accessible URL on our storage and is retained until you request deletion of your account.

2.4 Transcripts

The fetched audio is transcribed using a third-party transcription service. Transcripts are held in memory during the AI processing pipeline only and are not stored in our database. They are passed only to the AI analysis service described in §2.5 and discarded once processing completes.

2.5 AI Clone profile

From the transcripts and video metadata, we use Google Gemini (gemini-2.5-flash) to generate your AI Clone profile, which we store in our database. This profile contains:

• Derived analysis — communication tactics, audience description, niche classification, personality patterns, content preferences, and stylistic fingerprint.
• Verbatim excerpts from your videos — specifically, "signature lines" (your catchphrases) and "repeated phrases" (exact phrases you use frequently). These verbatim phrases are extracted from your transcripts and stored as part of your AI Clone profile.

Your AI Clone profile is retained until you request account deletion. It is used to generate content ideas, suggestions, and outputs in your style across AirCreator's products.

2.6 Profile picture

We download a copy of your channel or page avatar and upload it to our managed cloud storage (Supabase Storage) at a publicly accessible URL. This copy is retained until account deletion. We use this image to display your profile in AirCreator.

2.7 Onboarding quiz responses

During onboarding, you may answer questions about your content style, audience, and goals. These responses are stored in your AirCreator profile and used to refine your AI Clone.

2.8 Uploaded content (AirPublish)

When you use AirPublish, the videos you upload for publishing are stored on our managed cloud storage. AirPublish accesses these files on your behalf to publish to your connected platforms when you schedule or initiate a publish action.

2.9 Operational data

For security, debugging, and service-quality purposes, we record events including the action performed, IP address, user agent, and timestamps in an audit log. We do not log access tokens, refresh tokens, or the content of your videos.

3. How We Use Your Information

• Account information — for account creation, authentication, and session management.
• Platform OAuth tokens — to access data from your connected platforms on your behalf, only for the operations described in this policy.
• Video metadata — to populate your content library, rank your top-performing videos, and feed the AI Clone analysis.
• Audio and transcripts — exclusively to generate your AI Clone profile.
• AI Clone profile — to generate content suggestions, ideas, and outputs in your style within AirCreator.
• Quiz responses — to improve the accuracy and personalization of your AI Clone.
• Uploaded videos — solely to publish or schedule them to your connected platforms when you initiate the action.
• Operational data — for security, troubleshooting, abuse prevention, and service improvement.

We do not use your data to serve advertisements, train AI models for any purpose other than building your own AI Clone, or sell or transfer it to third parties for advertising or marketing.

4. YouTube Data and YouTube API Services

AirCreator uses YouTube API Services. By connecting your YouTube account, you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.

Scopes we request when you connect YouTube:

• openid — identifies you across Google services
• https://www.googleapis.com/auth/userinfo.email — reads your email address
• https://www.googleapis.com/auth/userinfo.profile — reads your basic Google profile information
• https://www.googleapis.com/auth/youtube.readonly — reads your YouTube channel metadata, public video data, and basic analytics
• https://www.googleapis.com/auth/youtube.upload — uploads videos to your YouTube channel (used by AirPublish only when you initiate a publish action)
• https://www.googleapis.com/auth/youtube.force-ssl — posts the first comment on a video you publish, only when you choose to add one

Limited Use disclosure. AirCreator's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use YouTube data. The data we receive from the YouTube API is used solely to provide AirCreator's described features — building your AI Clone profile and (for AirPublish) uploading content you choose to publish. We do not sell, share, or transfer your YouTube data to third parties for advertising, marketing, or any unrelated purpose.

Revoking access. You can revoke AirCreator's access to your YouTube data at any time via your Google Account permissions page. Revoking access will prevent future data fetching, but data we have already stored about your account will remain until you also request data deletion (see §14).

5. Facebook Data

When you connect a Facebook Page to AirCreator, we request the following permissions:

• public_profile, email — basic identity
• pages_show_list — list the Facebook Pages you administer
• pages_read_engagement — read engagement data on your Pages
• pages_manage_posts — publish content to your Pages on your behalf when you initiate a publish action
• pages_manage_engagement — posts the first comment on a Page post you publish, only when you choose to add one
• business_management — read business assets associated with your account

By connecting Facebook, you also agree to the Meta Terms of Service and Meta Privacy Policy.

You can revoke AirCreator's access via Facebook Settings → Apps and Websites.

6. Instagram Data

AirCreator integrates with Instagram via Meta's official APIs. We support Instagram Business and Creator (professional) accounts, which you connect by logging in directly with Instagram. Personal Instagram accounts cannot be connected (Meta's Instagram Basic Display API was deprecated by Meta on December 4, 2024).

When you connect Instagram, we request permissions including:

• instagram_business_basic — reads your professional account profile and media
• instagram_business_content_publish — publishes content to your account when you initiate a publish action
• instagram_business_manage_insights — reads engagement insights for your media
• instagram_business_manage_comments — posts the first comment on Instagram media you publish, only when you choose to add one

We do not access your direct messages.

7. TikTok Data

When you connect a TikTok account to AirCreator, we receive an OAuth access token and a refresh token from TikTok. We use these tokens to access the data described below on your behalf, and only for the purposes you authorize. When you connect TikTok, we request the following scopes:

• user.info.basic — reads your TikTok open ID, display name, and avatar, used to identify and display your connected account
• user.info.profile — reads your public profile information (profile link, bio, and verified status)
• user.info.stats — reads your aggregate account statistics (follower count, following count, likes, and video count), used for analytics
• video.list — reads a list of your public videos and their metadata (titles, descriptions, view counts, like counts, and comment counts), used to populate your content library and per-post analytics
• video.publish — publishes video or photo content to your TikTok account, used by AirPublish only when you initiate or schedule a publish action

To publish a video, AirPublish temporarily stages your uploaded video file at a URL on our own verified domain (cdn.aircreator.cloud, backed by Cloudflare R2) so that TikTok can retrieve it for posting. The staged copy is automatically deleted immediately after TikTok finishes retrieving it. We do not access your TikTok direct messages.

By connecting TikTok, you also agree to be bound by the TikTok Terms of Service and the TikTok Privacy Policy.

You can revoke AirCreator's access to your TikTok account at any time from the TikTok app: Profile → Settings and privacy → Security & permissions → Manage app permissions. Revoking access will prevent future data fetching, but data we have already stored about your account will remain until you also request data deletion (see §14).

8. Threads Data

AirCreator integrates with Threads via Meta's official Threads API. You connect your Threads account by logging in through Meta's authorization flow. We support public Threads professional/creator accounts. When you connect Threads, we receive a long-lived OAuth access token from Meta, which we use to access the data described below on your behalf, and only for the purposes you authorize. We request the following permissions:

• threads_basic — reads your Threads profile information (account ID, username, display name, profile picture, and bio) and your own posts, used to identify and display your connected account
• threads_content_publish — publishes text, image, and video posts to your Threads account, used by AirPublish only when you initiate or schedule a publish action
• threads_manage_insights — reads engagement insights for your Threads posts (views, likes, replies, reposts, and quotes) and your follower count, used to populate your analytics and per-post metrics

To publish a video, AirPublish temporarily stages your uploaded video file at a URL on our own verified domain (cdn.aircreator.cloud, backed by Cloudflare R2) so that Threads can retrieve it for posting. The staged copy is automatically deleted after Threads finishes retrieving it. We do not access your Threads direct messages.

By connecting Threads, you also agree to be bound by the Meta Terms of Service and the Meta Privacy Policy.

You can revoke AirCreator's access to your Threads account at any time from the Threads app: Settings → Account → Website permissions. Revoking access will prevent future data fetching, but data we have already stored about your account will remain until you also request data deletion (see §14).

9. Pinterest Data

AirCreator integrates with Pinterest via the official Pinterest API (v5). You connect your Pinterest account by logging in through Pinterest's OAuth authorization flow. We receive an OAuth access token and a refresh token from Pinterest, which we use to access the data described below on your behalf, and only for the purposes you authorize. We request the following scopes:

• user_accounts:read — reads your Pinterest account profile (username, display name, profile picture, follower count, and board count), used to identify and display your connected account
• boards:read — lists the boards on your account so you can choose where a Pin is published
• boards:write — creates a board on your behalf when you choose to publish to a new board, or when your account has none (we create a default board named "AirCreator"). Pinterest also requires this scope to create Pins.
• pins:read — allows AirCreator to read your Pins and their metadata, for example to confirm and reference Pins published through AirCreator
• pins:write — creates and publishes image and video Pins to your account, used by AirPublish only when you initiate or schedule a publish action

When you publish a Pin, AirPublish provides your media to Pinterest. For image Pins, Pinterest retrieves the image from a publicly accessible URL on our managed cloud storage. For video Pins, AirPublish uploads the video file directly to Pinterest's media servers, and Pinterest separately retrieves the required cover image from a URL on our storage. We do not access your Pinterest private messages.

By connecting Pinterest, you also agree to be bound by the Pinterest Terms of Service and the Pinterest Privacy Policy.

You can revoke AirCreator's access to your Pinterest account at any time from your Pinterest settings: Settings → Security, then remove AirCreator under the connected apps section. Revoking access will prevent future data fetching, but data we have already stored about your account will remain until you also request data deletion (see §14).

10. AI Processing Pipeline

When you complete onboarding for AirClone, our system runs the following pipeline using your connected platform data:

1. Read your channel/page metadata and your video list from the connected platform's API.
2. Identify your top-performing videos using public engagement metrics and (for YouTube) basic analytics.
3. Resolve and download audio from up to 50 of those videos via a third-party service (RapidAPI for YouTube; Apify-managed downloaders for Instagram and Facebook).
4. Upload the audio file to our managed cloud storage.
5. Transcribe the audio. For YouTube, we use a third-party transcript service (Apify) to read the video's auto-generated captions. For Instagram and Facebook audio, we use Deepgram (Nova-2) for speech-to-text.
6. Send transcripts and metadata to Google Gemini (gemini-2.5-flash) to generate your AI Clone profile and classify your niche.
7. Save your AI Clone profile, niche classification, audio file URL, and profile picture URL to our database.

Transcripts are not persisted to our database; they are processed in memory during the pipeline run only. Audio files and your profile picture, however, are uploaded to our managed cloud storage and retained until you request account deletion.

11. Storage and Hosting (AirPublish)

Videos you upload via AirPublish are stored on our managed cloud storage. Files remain in storage until you delete them or until you request account deletion. They are made accessible to the connected platforms only when you initiate a publish or schedule action.

12. Third-Party Service Providers

We rely on the following third-party service providers to operate AirCreator. Where we share your information with these providers, we do so only to the extent necessary to provide the service:

• Google — YouTube Data API v3, YouTube Analytics API v2, OAuth, Google Cloud Run (compute), and Google Gemini (AI analysis).
• Meta — Facebook Graph API, Instagram Graph API, and the Threads API for Facebook, Instagram, and Threads data.
• TikTok — TikTok Login Kit and Content Posting API, used to authenticate your TikTok account, read your profile and video data, and publish content you choose to publish.
• Pinterest — Pinterest API (v5), used to authenticate your Pinterest account, read your profile and board data, and publish content you choose to publish.
• Apify — runs third-party scraper actors for YouTube transcripts and for Instagram/Facebook audio resolution.
• RapidAPI — runs the audio-resolution service used to fetch YouTube audio.
• Deepgram — speech-to-text transcription for Instagram and Facebook audio.
• Supabase — managed PostgreSQL database and managed object storage for your AirCreator data.
• Cloudflare — used by AirPublish for managed storage (Cloudflare R2) of uploaded videos, including temporarily staging media on our verified domain so platforms such as TikTok and Pinterest can retrieve it for publishing.

We do not sell your data. We do not share your data with third parties for advertising, marketing, profiling, or any purpose unrelated to providing AirCreator.

13. International Data Transfers

AirCreator is operated by a Puerto Rico-based US company. The third-party service providers listed in §12 may process your data in the United States and other jurisdictions. By using AirCreator, you consent to the transfer of your information across borders and acknowledge that the data-protection laws of those jurisdictions may differ from those of your home jurisdiction. Where required, transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States are made on the basis of the European Commission's Standard Contractual Clauses or an equivalent valid transfer mechanism.

14. Data Retention and Deletion

The following table describes how long we retain different categories of data:

Disconnecting a platform. When you disconnect a connected platform within AirCreator, the connection is marked inactive. We stop fetching new data from that platform on your behalf. However, the data we have already collected (audio files, AI Clone profile, profile picture, audit logs, and stored OAuth tokens) is retained in our systems unless you also request account deletion.

Full account deletion. To request permanent deletion of all data associated with your account, email support@aircreator.com from the email address on file with the subject "Data Deletion Request". We will process your request within 48 business hours and confirm by email once deletion is complete. This will erase your AirCreator profile, AI Clone profile (including verbatim phrases), audio files, profile picture, OAuth tokens, uploaded videos, and audit logs associated with your account.

Platform-level revocation. Independently of AirCreator, you can revoke our access to your social-media data directly through the platform:

• Google: myaccount.google.com/permissions
• Facebook: facebook.com/settings → Apps and Websites
• Instagram: through the linked Facebook Page settings
• TikTok: in the TikTok app, Profile → Settings and privacy → Security & permissions → Manage app permissions
• Pinterest: in Pinterest settings, Security → remove AirCreator under connected apps
• Threads: in the Threads app, Settings → Account → Website permissions

15. Your Rights

15.1 Rights available to all users

Subject to limits in applicable law, every AirCreator user has the following rights:

• Right to access — request a copy of the personal information we hold about you.
• Right to correct — ask us to correct inaccurate or incomplete information.
• Right to delete — request that we erase your account and personal information (see §14).
• Right to withdraw consent — disconnect a platform or request account deletion at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, email support@aircreator.com from the email address on file.

15.2 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know what categories of personal information we collect, the sources, the purposes, and the categories of third parties we share with — all of which are described in §§2, 3, and 12 above.
• Right to delete personal information we hold about you, subject to limited statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA, so there is nothing to opt out of, but the right is preserved.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for any purpose beyond what is reasonably necessary to provide the Service.
• Right to non-discrimination for exercising any of these rights.

To exercise these rights, email support@aircreator.com with the subject "California Privacy Request". We may verify your request by asking you to confirm details associated with your account.

15.3 European Economic Area, United Kingdom, and Switzerland (GDPR / UK-GDPR)

If you are in the EEA, the United Kingdom, or Switzerland, you also have the following rights under the General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection:

• Right of access, rectification, erasure, and restriction of processing.
• Right to data portability — receive a copy of your information in a structured, commonly used, machine-readable format.
• Right to object to processing based on our legitimate interests.
• Right to lodge a complaint with your national data-protection supervisory authority.

For most processing required to deliver AirCreator (account management, OAuth-token use to fetch data on your behalf, content publishing, security logging) the legal basis is performance of a contract with you. For the AI Clone training described in §§2.3–2.5 and §10, the legal basis is your explicit consent, which you give when you start the AirClone onboarding flow and which you can withdraw at any time by disconnecting the relevant platform or requesting account deletion.

The data controller for users in these regions is AIRCREATOR.COM LLC, contactable at support@aircreator.com.

16. Data Security

We use industry-standard security measures to protect your information, including:

• HTTPS encryption for all data in transit between your device, our services, and third-party APIs
• Authenticated, session-bound access to your account using HttpOnly, Secure cookies
• Cryptographically signed (HMAC-SHA256) state parameters during OAuth flows to prevent CSRF attacks
• Access controls on our backend systems and managed cloud infrastructure (Supabase, Google Cloud)
• Operational logging of authenticated requests for abuse detection

No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

17. Children's Privacy

AirCreator is not directed at children under the age of 14, and we do not knowingly collect personal information from children. If you believe we may have collected information from a child, please contact us at support@aircreator.com and we will delete it.

18. Cookies

We use one essential cookie, session_token, to keep you signed in. It is HttpOnly, Secure, and SameSite=Lax. We do not use advertising cookies or third-party analytics that share your data with advertisers.

19. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page, and we may notify you by email for significant changes.

20. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at support@aircreator.com, or by mail at:

AIRCREATOR.COM LLC
954 Ave Ponce de Leon, Suite 205, PMB 10737
San Juan, PR 00907
United States