Genesis PublisherGenesis Publisher Privacy Policy
1. Who is responsible
Genesis Publisher is a tool operated by Genesis Media (a digital marketing agency based in Spain). Owner: Javier Mañas Sanchez · Tax ID: 49285358S · Address: Carrer Segle XX, 16, 08758 Cervelló (Barcelona), España · Privacy contact: herramientas.genesisnova@gmail.com.
2. What the tool does
It lets Genesis Media upload and schedule, on a client's YouTube channel or TikTok account, the videos the client has agreed with the agency. Genesis Publisher uses YouTube API Services and TikTok for Developers APIs. You must agree to this policy before connecting your account.
3. What data we process
| Source | Data | Purpose |
|---|---|---|
| Google / YouTube (when connecting) | Channel ID and name, channel profile image URL, granted scopes and an OAuth refresh token (the long-lived permission issued by Google). | Know which channel to publish to and upload and schedule the agreed videos. |
| YouTube (when scheduling) | ID, privacy status and scheduled time of the videos we upload. | Confirm each video was scheduled as agreed. |
| TikTok (when connecting) | App-scoped account ID (open_id), display name, username, profile photo, granted scopes and TikTok access and refresh tokens (stored encrypted with AES-256-GCM). | Show you which account you are posting to and publish what you approve. |
| TikTok (when posting) | The videos and captions your team uploads for your review; the options you choose (who can view, comments/Duet/Stitch, commercial content disclosure, publishing time) with the date and time of your confirmation; and the status returned by TikTok (post ID, published or failed). | Publish to TikTok only what you approve, when you choose, and be able to prove your consent. |
| You / your agency | The videos, titles, descriptions, tags and dates agreed for publication. | Publish them on your behalf. |
We do not access your password, email address, analytics, comments, messages, or any video we did not upload. We do not store access tokens (they expire in one hour and are requested only when needed).
4. How we use and share data
We use the data only to provide the service described above: uploading, scheduling and checking the posts you agreed with Genesis Media. We do not sell it, we do not use it for advertising or profiling, and we do not allow third parties to serve ads in the tool. It is only accessed by the Genesis Media team that manages your content and by these providers, acting as processors or as the platform itself:
- Cloudflare, Inc. — hosts the website and stores the encrypted access permission.
- Google LLC / YouTube — receives the videos and information we publish on your channel. See the Google Privacy Policy.
- TikTok — receives the videos we publish on your account. See the TikTok Privacy Policy.
Genesis Publisher's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Where and how it is stored
The access permission is encrypted before it is stored (4096-bit RSA-OAEP + AES-256-GCM) and kept on Cloudflare. The key to decrypt it only exists on the agency's internal machine, not on the web server. All traffic uses HTTPS. Cloudflare and Google may process data outside the European Economic Area under the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
6. Cookies
We only use one technical cookie, gp_oauth, during the connection process, to protect the authorization against attacks (CSRF/PKCE).
It expires after 15 minutes and is deleted when the process ends. We use no analytics or advertising cookies and allow no third party to set them.
7. How long we keep it
- The access permission, for as long as you keep the service with Genesis Media and do not revoke it.
- Channel or account data is refreshed or deleted at least every 30 days.
- We periodically check that the permission is still valid; if it can no longer be refreshed, we delete your data within 30 days.
- If you revoke access or ask us to delete your data, we delete it as soon as possible and always within 7 days.
- TikTok: videos pending review are deleted once published or after 30 days; the record of your confirmations is kept for as long as the law requires.
8. How to revoke access and request deletion
- YouTube: from our Disconnect YouTube page (we delete and revoke immediately), or from the Google security settings page.
- TikTok: with the “Disconnect TikTok” button at /tiktok/ (we revoke the token on TikTok and delete your data), from TikTok › Settings › Security › Apps and services, or by emailing us. Your use of TikTok is also governed by the TikTok Privacy Policy.
- In any case, by emailing herramientas.genesisnova@gmail.com.
Deleting the data stored by Genesis Publisher does not affect in any way the data stored by YouTube or TikTok: videos already published stay on your channel.
8a. TikTok: publishing through the TikTok API for Business
For clients who authorize it at /tiktok-business/, Genesis Publisher uses the TikTok API for Business Accounts API to publish on their TikTok account the videos agreed with Genesis Media. The account holder signs in with TikTok and accepts the permissions; we never see their password.
| Data | Purpose | Retention |
|---|---|---|
| App-scoped account ID (open_id), username, display name and granted permissions | Know which account we publish to and check it before every post | While connected; deleted within 7 days after disconnecting |
| TikTok refresh token, encrypted (RSA-4096 + AES-256-GCM; the key to decrypt it is not on the web server). The access token, valid for 24 hours, is only used by the agency team that publishes | Publish without asking for your permission every day | Until you revoke it or it expires (at most 1 year) |
| Temporary copy of the video, at a random address on publisher.genesis-nova.com | TikTok downloads the video from that address to publish it | Deleted automatically within 48 hours |
| Caption, settings (comments, Duet, Stitch, promotional or branded content label) and status of each post | Publish what was agreed and confirm it went out | For as long as the relationship with the agency lasts |
Posts are public on your account once TikTok approves them. You can revoke the permission at any time from the TikTok app (Settings › Security › Apps and services) or by emailing us; once revoked we can no longer publish and we delete this data within 7 days. Your use of TikTok is also governed by the TikTok Privacy Policy.
9. Legal basis and your rights
We process your data based on your consent (Art. 6(1)(a) GDPR), given when you connect your account and revocable at any time, and to perform the service you hired from Genesis Media (Art. 6(1)(b) GDPR). You can exercise your rights of access, rectification, erasure, objection, restriction and portability by emailing herramientas.genesisnova@gmail.com, and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
10. Children
The service is for professionals and businesses that are clients of Genesis Media. It is not directed to children under 14.
11. Changes and contact
If we change this policy we will publish the new version here with its date and, for material changes, notify connected clients. For any privacy question or complaint: herramientas.genesisnova@gmail.com.