Privacy Policy

This policy explains what data Growthing (https://growthing.fototale.fr) processes, why, for how long, and how you can control it. Growthing is a tool that publishes videos and images to YouTube, Instagram and TikTok on your behalf, at your request.

1. Data controller

Growthing SARL, registered office: 64 rue Réaumur, 75002 Paris, France. Contact: contact@growthing.com.

2. Data we process

• Growthing account: email address, password (stored only as a salted scrypt hash), session cookie.
• Connected social accounts: access and refresh tokens (encrypted at rest with AES-256-GCM), account identifier, username, display name, profile picture URL, granted permissions and token expiry dates.
• Your content: the video or image files you upload, their technical metadata (duration, dimensions, codecs, frame rate), title, description and publishing options.
• Publishing records: identifiers and links of the posts created on each platform, status and error messages.
• Subtitles: when you use the subtitling feature, the transcript of your video (words and their timings), the caption style and the hook you configure.
• Technical logs: outgoing API calls (operation, HTTP status, error code, duration — never tokens) and server logs, which may include your IP address.

3. Data obtained from platform APIs

YouTube

Growthing uses the YouTube API Services. With your authorization (scopes youtube.upload and youtube.readonly), it accesses your channel identifier, title, handle and thumbnail, the list of video categories, and the status of the videos it uploads for you (processing, privacy status). It uses this data only to upload the videos you choose, show which channel is connected and track processing. By using Growthing you also agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy. You can revoke Growthing's access to your data at any time via the Google security settings page.

Instagram (Meta)

With the instagram_business_basic and instagram_business_content_publish permissions, Growthing accesses your professional account identifier, username, name, account type and profile picture, your publishing quota, and the identifiers and permalinks of the posts it publishes for you. With instagram_business_manage_insights, it reads your follower count and the statistics of your recent posts (views, reach, likes, comments, shares, saves) to display them on the Analytics page; these figures are fetched on demand and not stored. See the Instagram Privacy Policy. You can remove Growthing from Instagram's settings (Apps and websites).

TikTok

With the user.info.basic and video.publish scopes, Growthing accesses your TikTok identifier (open_id), display name and avatar, your creator settings (nickname, username, available privacy levels, interaction settings, maximum video duration) and the status of the posts it publishes for you. With user.info.stats and video.list, it reads your profile counters and your recent public videos with their statistics (views, likes, comments, shares) to display them on the Analytics page; these figures are fetched on demand and not stored. See the TikTok Privacy Policy. You can remove Growthing from the authorized apps in your TikTok security settings.

4. Purposes and legal bases

• Providing the service you request (connecting accounts, uploading and publishing content, showing publishing status): performance of a contract.
• Security, debugging and abuse prevention (logs, encrypted tokens): legitimate interest.

Growthing does not use your data for advertising, profiling or any purpose other than the service, and never sells it.

5. Sharing

• Your content and texts are sent only to the platforms you select, when you publish. To publish, Instagram (and TikTok when configured to download media) retrieves the file from a temporary, unguessable URL on Growthing's server, available only while the publication is in progress.
• Hosting provider: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Genève), Suisse.
• Subtitles: transcription runs locally on this server (whisper.cpp). No audio, and no video, is sent to any third party.
• No other third party receives your data, except where required by law.

6. Cookies and device storage

Growthing places a single, strictly necessary session cookie (HTTP-only) on your device to keep you signed in. It uses no analytics or advertising cookies and no third-party trackers.

7. Retention

• Tokens and social account data: until you disconnect the account; deleted immediately on disconnection.
• Uploaded files that are never published nor attached to a subtitling project: deleted automatically after 24 hours.
• Published files: deleted from the server as soon as every platform has published, when you asked for it before publishing (the option is on by default); otherwise until you delete the publication in the History page. Only the file is deleted: its name, size and characteristics stay in your history.
• Subtitling projects (transcript, style, hook) and their files: until you delete them in the Subtitles page.
• Data obtained from the YouTube API Services: refreshed or deleted no later than 30 days after it was obtained, and deleted when you disconnect your YouTube account.
• API call logs: 30 days. Sessions: 30 days.

8. Security

HTTPS everywhere, tokens encrypted at rest, hashed passwords, access limited to the account owner.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, and to object to its processing. Contact contact@growthing.com. We answer within one month, and delete data within 7 days of a deletion request. You may also lodge a complaint with the French data protection authority (CNIL). See also how to delete your data.

10. Minors

Growthing is intended for adults (18+).

11. Changes

We may update this policy; the date above shows the latest version. Significant changes will be announced in the application.