Privacy Policy

Engagement Board uses YouTube API Services. By connecting your YouTube account, you agree to be bound by the YouTube Terms of Service. Your use of data obtained through these services is also governed by the Google Privacy Policy.

You can revoke Engagement Board’s access to your YouTube and Google data at any time via the Google security settings page: https://myaccount.google.com/permissions. You can also disconnect a channel from within Engagement Board (Settings → Connections), which deletes the channel’s data from our systems as described in Section 8.

Engagement Board’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Engagement Board uses the Instagram API with Instagram Login, provided by Meta Platforms, Inc. By connecting an Instagram professional account you also agree to the Instagram Terms of Use, and Meta’s handling of your data is governed by the Meta Privacy Policy.

We request only the permissions the features you use require: reading your profile and media, reading and replying to comments on your own media, and reading your account insights. We never post new content to your account, and we do not request access to your direct messages.

You can remove Engagement Board’s access at any time from within Instagram (Settings → Website permissions → Apps and websites), or by disconnecting the account in Engagement Board (Settings → Connections). Either route ends our access; what each one deletes is described in Section 8, and step-by-step instructions live on our data deletion page.

Account information. When you sign up we collect your name, email address, and authentication identifiers through our authentication provider. If you choose to provide them, we also store optional profile details (such as pronouns, birthday, and contact preferences). You are not required to provide optional sensitive details to use the Service.

YouTube data (accessed with your authorization). When you connect a YouTube channel, we access and store, on your behalf:

• OAuth access and refresh tokens for your Google/YouTube account (encrypted at rest);
• your channel ID, channel title, and public channel statistics;
• comments and comment threads on your videos, and metadata about your videos;
• caption tracks for your videos, where you use caption-related features;
• channel analytics (e.g., views and engagement metrics) via YouTube Analytics.

Instagram data (accessed with your authorization). When you connect an Instagram professional account, we access and store, on your behalf:

• the long-lived access token for that Instagram account (encrypted at rest);
• your Instagram account ID, username, account type, profile picture, follower count, and media count;
• your media (posts and reels): media IDs, captions, permalinks, thumbnails, media type, timestamps, and engagement counts;
• comments on your media, including the comment text, timestamp, like count, and the commenter’s Instagram username, Instagram-scoped user ID, and profile picture — people who comment on your posts are not Engagement Board users, and we store this only so you can read and reply to them in Engagement Board;
• account insights, including aggregate follower and engaged-audience demographics (age ranges, gender, city, and country). Meta provides these only in aggregate form; we never receive or store the identity of individual followers.

Derived data. To power features, we generate derived data such as comment sentiment scores, text embeddings used for grouping and search, suggested replies, content ideas, and engagement analytics.

Billing data. If you subscribe to a paid plan, our payment processor collects and processes your payment details. We retain subscription status, credit balances, and usage records.

Engagement Board stores a small amount of information on your device and in your browser, and reads it back, so that you can stay signed in. We do not use advertising cookies, analytics or tracking cookies, or any technology that follows you across other websites, and we do not allow any third party to place or read cookies or similar technologies on your device through our Service.

Sign-in cookie. When you sign in, we set a first-party cookie named __session that holds a short-lived sign-in token, so our servers can recognize that requests come from you. It expires after 15 minutes and is renewed while you use the Service, is sent only to Engagement Board, and is deleted when you sign out. It is strictly necessary: the Service cannot keep you signed in without it.

Sign-in session storage. Our authentication provider (Google Firebase Authentication) keeps your sign-in session in your browser’s session storage. It is cleared when you close the tab or window.

Notifications. If you choose to turn on browser notifications, your browser registers a service worker and a push subscription for Engagement Board so it can show you alerts, such as a finished sync. Nothing is registered unless you grant notification permission, and you can withdraw it at any time in your browser’s site settings.

Google, Meta, and payments. When you connect a YouTube channel you are sent to Google’s sign-in and consent pages, and when you connect an Instagram account you are sent to Meta’s. If you subscribe to a paid plan, you complete payment on our payment processor’s checkout page. Each of those services sets its own cookies on its own website, under its own policies, such as how Google uses cookies and the Meta Privacy Policy. Engagement Board does not receive or control those cookies.

Your choices. You can view, block, or delete cookies and site data in your browser settings. If you block the sign-in cookie or session storage, you will not be able to stay signed in to the Service.

• To display, organize, and analyze your YouTube comments and channel engagement.
• To display, organize, and analyze the comments on your Instagram media, and to show you audience insights (including aggregate follower demographics) for your Instagram account.
• To generate AI-assisted reply suggestions, sentiment signals, and content recommendations.
• To post, reply to, moderate, update, or delete comments on your behalf only when you direct us to(for example, by approving a reply or applying a moderation action).
• To update video and channel metadata or thumbnails when you explicitly request it.
• To operate, secure, maintain, and improve the Service, and to provide customer support.
• To process payments and manage subscriptions.

We do not use YouTube or Instagram data for advertising, and we do not sell your personal information, YouTube data, or Instagram data. We do not use your data or content to train generalized AI/ML models.

Some features send comment text and related context to a third-party AI provider to generate reply suggestions and analysis. We send only the data necessary for the feature you are using. Our AI provider processes this data to return results to us and does not use it to train their models on our behalf.

We do not sell your data. We share information only with service providers that help us operate the Service, under contractual confidentiality and data-protection obligations:

• Google / Firebase — authentication and the YouTube API Services.
• Meta Platforms — the Instagram API with Instagram Login, for accounts you connect.
• OpenAI — AI generation and analysis features.
• Stripe — payment processing.
• Google Cloud (incl. Cloud Storage) — hosting and file storage.
• Resend — transactional email delivery.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.

Ongoing retention of YouTube data. In line with the YouTube API Services Developer Policies, we do not keep stale copies of YouTube data. Stored YouTube data (such as videos and comments) is automatically refreshed from the YouTube API at least every 30 days, or else deleted from our systems. A daily process keeps your recent and active content current and removes older data that is not refreshed within that window. If your connection stops working (for example, access is revoked and not restored), the associated stored data is deleted after a short grace period.

Disconnecting a channel. When you disconnect a YouTube channel, we revoke the OAuth grant with Google and delete that channel’s stored data from our systems, including the OAuth tokens we hold, comments, videos, sentiment data, embeddings, drafts, and related records.

Ongoing retention of Instagram data. Stored Instagram data (media, captions, comments, and insights) is refreshed from the Instagram API on a rolling basis so that what you see reflects the account as it is now; data that is no longer available from Instagram is removed on the next refresh. If an Instagram connection stops working and is not restored, the associated stored data is deleted after a short grace period.

Disconnecting an Instagram account. When you disconnect an Instagram account in Engagement Board (Settings → Connections), or when you remove Engagement Board from your Instagram account settings, we delete that account’s stored data from our systems: the access token, your media and captions, the comments and commenter details we cached, sentiment data, embeddings, drafts, and related records.

Deleting your account. When you delete your account, we revoke your YouTube OAuth grant(s) with Google, hard-delete your personal and content data (profile, social handles, YouTube and Instagram tokens and content, sync state, notifications, and preferences), and anonymize your account record. We delete your authentication account with our auth provider. We retain billing and cost records (e.g., invoices, credit ledgers, usage counters) in anonymized form as required for accounting, tax, and legal compliance.

Revoking at Google. We revoke Engagement Board’s access automatically when you disconnect a channel or delete your account. You can also review or remove access yourself at any time at https://myaccount.google.com/permissions.

Removing access at Instagram. The Instagram API has no server-side revoke endpoint, so removing Engagement Board under Instagram → Settings → Website permissions → Apps and websites is how you end our access there. Instagram notifies us when you do, and we mark the connection as disconnected. If you also want the data we already hold deleted, ask Instagram to delete your data from Engagement Board in the same screen, or disconnect the account in Engagement Board, or email us — each of these deletes it.

How to request deletion. You can request deletion at any time by using the in-app account deletion control, by following the steps on our data deletion page, or by emailing us at info@secondlifesoftware.com.

We use industry-standard safeguards, including encryption in transit (TLS) and encryption of stored OAuth tokens at rest. Access to production data is restricted. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at info@secondlifesoftware.com. We will respond consistent with applicable law (including the GDPR and CCPA/CPRA where they apply).

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal information from them.

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Effective date” above. Material changes will be communicated as required by law.

EngagementBoard LLC
San Diego, CA, USA
Email: info@secondlifesoftware.com

This Policy is governed by the laws of the State of California, USA, without regard to conflict-of-laws principles.