Effective · May 24, 2026 · Last updated · May 24, 2026
Privacy policy
Draft v1 — pending counsel review. This policy is a good-faith first pass written in plain English. For questions until external review is complete, email
jeffreydway@gmail.com.
This policy explains what data BETR Studios collects, why we collect it, who we share it with, and the choices you have. It applies to everyone who uses BETR — brands, creators, and consumers — across the Studios workspace, the BEST consumer app, and any companion mobile clients we publish under the BETR name.
Who we are
BETR Studios is a software platform that connects brands and creators around video content and operates the BEST consumer video experience. Privacy questions:
privacy@betr.studio.
Data we collect
- Account info — email, display name, profile photo, role (brand / creator / consumer), and any optional profile fields you fill in (bio, location, socials).
- Authentication tokens — when you sign in with Google or Apple SSO, we receive an OAuth identifier plus the basic profile fields you authorize. We don’t see your password.
- Connected social platforms — when you connect YouTube, LinkedIn, Instagram, X, or TikTok via OAuth, we store the access + refresh tokens required to perform the actions you’ve authorized (read channel metadata, publish videos, fetch analytics). We never request scopes we don’t actively use.
- Uploaded content — videos and supporting assets you upload are stored with our video infrastructure provider (Mux); we keep the metadata (title, description, thumbnail) in our database.
- Engagement signals — on the BEST consumer surface, we record what you watch, like, comment on, save, and how long you watch it. These power your feed, your history, and your recommendations.
- Payment data — handled by Stripe. We don’t store full card numbers; we keep the customer/subscription IDs Stripe returns plus invoice history needed to operate billing.
- Usage telemetry — page views, feature interactions, performance counters, and error reports. Used to debug and improve the product. No third-party advertising trackers.
- Communications — emails you send to support, comments and messages you post inside the product.
Why we collect it
Strictly to run the product you signed up for. Concrete purposes:
- Provide the Studios + BEST services, including account creation, auth, and feature access.
- Match creators to brand briefs and calculate BETR Scores (creator performance estimates).
- Generate AI-assisted briefs, scripts, and creative variations on your behalf.
- Publish content to the social platforms you've connected, on the schedule you authorize.
- Process payments, payouts, and subscription billing via Stripe.
- Send transactional notifications (security, billing, content status, collaboration invites) and product updates you've opted into.
- Detect, prevent, and respond to abuse, fraud, and security incidents.
- Comply with legal obligations.
Sub-processors we share data with
We use a small set of vendors to operate the service. Each is bound by their own DPA which we’ve reviewed:
- Supabase — primary database + auth infrastructure.
- Mux — video storage, encoding, streaming, and thumbnail generation.
- Stripe — payments, subscriptions, and creator payouts.
- Anthropic — AI model provider. We send creator profile fields, campaign briefs, and other product content when you use AI-assisted features (brief generation, script generation, copy variations, analytics summaries). Anthropic does not train on our API traffic.
- Railway — hosting for the Studios web + worker apps.
- Google / Apple — SSO providers when you use those sign-in methods.
- Connected social platforms — YouTube, LinkedIn, Instagram, X, TikTok. Only data you authorize, only via the official OAuth flows.
We do not sell personal data to third parties. We do not share brand-side data with other brands; creator analytics are only shown to creators you’ve invited and the team running your brand workspace.
Your rights
- Access + export — download everything we hold about you: /legal/data-export (requires sign-in).
- Delete — schedule permanent account deletion with a 30-day grace period: /legal/account-delete.
- Opt out of model improvement — by default, consumer activity signals (watch time, likes, saves) may be used in aggregated form to improve the BETR recommendation models. You can opt out from /consumer/preferences/privacy.
- Disconnect — revoke any social platform integration from Settings → Connections; this also clears the stored tokens.
- Correction — fix inaccurate profile data from Settings, or email us if a field isn’t editable in-product.
- Anything else: privacy@betr.studio.
Cookies and similar technologies
We use a minimal set of cookies and equivalent browser storage:
- Essential — auth sessions, CSRF protection, load-balancing. Can’t be turned off without breaking sign-in.
- Analytics — page views and feature usage counters so we know what to fix. No advertising identifiers.
- Preferences — your theme (dark / light), sidebar state, and other UI settings.
You can control analytics + preference categories from the cookie banner on first visit, or from
/consumer/preferences/privacy.
Data retention
We keep account data as long as your account is active. When you delete your account, personal data is removed within a 30-day grace period (so accidental deletions can be undone). Some system logs and security records are retained for up to 90 days for fraud + abuse investigations. Aggregate analytics that no longer identify you may persist beyond that.
International transfers
BETR Studios is operated from the United States, and data is processed there by default. EU/EEA users have the rights afforded under GDPR (access, rectification, erasure, restriction, portability, objection); California residents have the rights afforded under CCPA/CPRA (know, delete, correct, opt-out of sale — we do not sell personal information). To exercise any of these, email privacy@betr.studio. EU-specific data residency is on our roadmap for enterprise pilots.
Children's privacy
BETR Studios is not directed at children. You must be at least 13 years old to create an account (16 in the EEA). If we learn we have collected data from a child below that age without parental consent, we delete it.
Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the engineering team using least-privilege controls. We will notify affected users without undue delay in the event of a personal-data breach.
Changes to this policy
We will notify active users by email at least 14 days before material changes take effect. Continued use after a change takes effect constitutes acceptance.