Howlitzer Privacy Policy
Effective date: 9 October 2026
This policy explains what personal data Howlitzer collects, why we use it, who receives it, how long we keep it, and the rights you have. It covers the Howlitzer website, Howlitzer sign-in, and the Howlitzer apps Conduit, Motion, QA, Library and Flow (together, the "Services").
The Services are for businesses and professionals. They are not offered to consumers.
1. Who we are
Howlitzer is operated by Influensea Inc., a corporation registered in the State of Wyoming, USA (filing number 2022-001190656), with its mailing address at 6847 N 9th Ave, Ste A 324, Pensacola, FL 32504, USA ("Howlitzer", "we", "us"). We are the controller of the personal data described in this policy, except where section 11 says otherwise.
- Contact for privacy questions and requests: info@howlitzer.com
- Our representative in the European Union (GDPR Article 27): Miraculous Equation — Unipessoal Lda, Rua 25 de Abril n.º 292, 1.º A, 4710-914 Braga, Portugal · info@miraculous.pt. You and any data protection authority may contact our representative instead of us.
- Data protection officer: we have not appointed one, because the law does not require us to.
2. The data we collect
2.1 Your account
You sign in to every Howlitzer app with one Howlitzer account, and you sign out of all of them in one step. When you create an account or sign in, we collect:
- Identity and contact details: your email address, username, display name and, if you add one, a profile picture. We record when you verified your email address.
- Password: if you use one, we store only a one-way hash of your password, never the password itself.
- How you sign in: you create your account with your email address and a password. After that, you can also sign in with your Google account. We do not offer sign-in with any other provider (such as Facebook) today. If we add one, we will describe it here first.
- Sign-in with Google: if you choose it, Google asks you to let Howlitzer see your basic profile and email address. Google then sends us your Google account ID, your email address and whether Google has verified it, your name and your profile picture. We store these with your account. We link your Google account to your Howlitzer account only when Google has verified your Google email address and it is the same address you verified with Howlitzer. We use Google only to sign you in: we do not keep Google's access or refresh tokens after you sign in, and we do not read anything else in your Google account. Google's use of your data is described in the Google Privacy Policy. You can remove Howlitzer's access at Google security settings, or ask us to remove the link (section 7).
- Your acceptance of our terms: when you create an account, we record the date and time, and the version of the Terms of Service and this policy that you accepted.
- Sessions and security: for each sign-in session we store a hash of the session token, your IP address, your browser's user-agent string and the expiry time. We keep a security log of sign-ins, failed sign-in attempts, account changes and changes to who may act for whom. Each entry records the IP address and the user agent, and some entries record your username or the email address used. To stop password-guessing, we count recent attempts per IP address and per account; the per-account counter uses a hash of the email address.
2.2 Organisations, customers and brands
If you use the Services for an organisation, you or your agency may register organisations (for example, an agency's customers) and the brands they own. For each organisation we store its kind (company or individual), legal name, display name, country and registration number. For each brand we store its name. We also store who is a member of which organisation, their role, and any authority one organisation gives another to act for it.
If you register an organisation or a person other than yourself, you confirm that you may give us their details and that you have told them about this policy (see the Terms of Service).
2.3 Conduit — your connected social media accounts
Conduit publishes content to social media accounts that you connect. You connect an account on the platform's own sign-in screen. You never type your platform password into Conduit.
When you connect an account, we receive and store:
- the access tokens that the platform issues to Conduit, and, where the platform issues them, refresh tokens. We encrypt them before we store them;
- the account's identifier and name (for example, your YouTube channel ID and title, your X user ID and @handle, your Facebook Page ID and name, or your Instagram account ID and @username);
- the permissions you granted.
| Platform | Permissions Conduit asks for | Why |
|---|---|---|
| YouTube (Google) | Upload videos; read your channel details | To publish the videos you choose, and to show you which channel is connected |
| X | Read and write posts; read your profile; upload media; stay connected | To publish posts you choose |
| Facebook (Meta) | List the Pages you manage; read a Page's basic details; publish posts and Reels to a Page; find the Pages and Instagram accounts your Business portfolio manages | To let you choose a Page and publish the posts you choose to it |
| Instagram (Meta) | Read the Instagram professional account linked to your Page (its ID and @username); publish Reels and Stories | To publish the posts you choose |
| TikTok | Read your basic account information, your account ID (open_id) and display name (user.info.basic); publish videos to your account (video.publish) |
To show which TikTok account a post will go to, and to publish the videos you preview and confirm |
Identify your LinkedIn account, your member ID and name (openid, profile); create posts on your behalf (w_member_social) |
To show which LinkedIn account a post will go to, and to publish the posts you choose |
For Facebook and Instagram, Conduit connects only the Pages on which you may create content. Conduit does not read comments or insights on Facebook or Instagram.
Conduit supports only the platforms in this table. We will add each new platform, with the permissions it asks for, to this table before Conduit offers it.
TikTok. Conduit asks TikTok for two permissions, and no others:
- user.info.basic: we read your account's open_id and display name once, when you connect the account. We use them to identify the connected account and to show its name in Conduit, so that you know which TikTok account a post will go to.
- video.publish: we use it to publish a video to your account with TikTok's Direct Post. Before you post, Conduit asks TikTok for your account's posting settings (your nickname, the privacy levels your account offers, the interactions you turned off, and the longest video you can post) and shows them to you. Conduit will publish a TikTok post only after you preview and confirm that post.
We encrypt the TikTok tokens before we store them, and we use them only to publish the posts you confirm. When you disconnect a TikTok account in Conduit, we ask TikTok to revoke Conduit's access, and we delete the tokens at once.
Platform we are adding: Pinterest. Conduit does not offer Pinterest yet. Before it offers Pinterest, we will add it to the table above with the permissions it asks for. When you connect a Pinterest account, we will receive and store:
- the access token that the platform issues to Conduit, and a refresh token where the platform issues one. We encrypt them before we store them;
- your account's identifier and display name on that platform;
- the permissions you granted.
We will use this data to publish the content you submit to that account, and to show you the result. Conduit does not read your comments, messages, followers or analytics on TikTok, LinkedIn or Pinterest. Before it does, we will add that data, the permissions it needs and why we use it to this policy. We delete this data within 7 days when you ask us to remove the connection or to delete your account (sections 6 and 7), in the same way as for every other platform.
LinkedIn. Unless LinkedIn approves Conduit as a Marketing Developer Platform partner, LinkedIn issues no refresh token to Conduit, and its access token lasts 60 days. After 60 days, you must connect your LinkedIn account again to keep publishing.
What we do with platform data. We use it only to publish what you ask us to publish and to show you the result. When you schedule a publication, we store the plan: the media source, and each post's title, description, tags and times, and the details of each post we publish for you. Conduit publishes a post only after you approve it: you preview and confirm that post, or you approve it as part of a plan or of an automation that you set up. We record each confirmation: what you previewed, who confirmed it and when we received it. Conduit then posts to each account you selected. On YouTube, videos are unlisted unless you choose another visibility.
Some platforms charge for each post. Conduit shows you the charge, and asks you to accept it, before you connect such an account.
Google and YouTube. Conduit uses YouTube API Services. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's use of your data is described in the Google Privacy Policy. You can disconnect a YouTube channel in Conduit at any time. You can also remove Conduit's access to your Google account at Google security settings. Conduit's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Facebook and Instagram. You can disconnect a Facebook Page or Instagram account in Conduit. We then delete our copy of its access token and ask Meta to remove Conduit's access. Where we cannot do that (for example, for accounts connected before 28 September 2026), Conduit shows you a link to remove it yourself in Facebook at Settings & privacy → Settings → Business integrations. To have the data we hold deleted, see our Data deletion instructions.
No sale, no advertising. We do not sell data we receive from any platform. We do not use it for advertising, and we do not give it to advertising networks or data brokers.
2.4 QA — video analysis and clips
QA turns a long video into short clips and draft posts. You upload a video file to QA. QA produces a transcript, suggested moments, draft posts and vertical clips. QA does not download videos from links.
We keep the file you upload only for a short time. It is stored in Cloudflare's file storage, which is not public. While QA works on the job, our processing server also keeps a working copy. We delete the file and the working copy when the job ends. Every uploaded file also expires 2 days after the upload, whether or not a job was started, and Cloudflare then removes it, normally within one more day.
To do this:
- Speech is transcribed on our own servers.
- The transcript is sent to AI model providers (Anthropic, Google and OpenAI) to choose moments and write draft posts.
- Video frames (about one frame per second) are sent to Google's Gemini model. It returns the position of the main speaker in each frame, so the clip keeps that person in view. This locates a face in the frame. It does not identify the person, and we do not create a facial template or any other biometric identifier.
- Finished clips are checked for quality: a few frames and part of the transcript are sent to Google's Gemini model, which scores framing, motion, captions, colour and audio.
QA has no mode that keeps your video or transcript away from these providers. Every QA job sends data to them as described above.
We store the results (transcript, clips, draft posts and scores) and your organisation's brand profiles. A brand profile belongs to the organisation it was made for (see section 7). If you create a share link for a sample, only people who are signed in to Howlitzer and have access to that job can open it. The link expires after 30 days by default and after 90 days at most.
Before 2 October 2026, QA downloaded videos from links that you gave it. We keep a video downloaded in that way with its QA job until we delete it, either when you ask us to (see section 7) or in a planned clean-up of these videos.
Videos you analyse may show or name other people. You must have the right to use those videos (see the Terms of Service).
2.5 Library, Motion and Flow
Library (media storage), Motion (video production) and Flow (automation for agencies) do not process customer content yet. Flow is available only by invitation. You sign in to it with your Howlitzer account, and Cloudflare checks that sign-in before it lets you reach Flow. We will update this policy to describe what each app collects before it processes customer content.
2.6 Emails
We send you the emails the Services need: to verify your email address and to reset your password. Our email provider, Resend, sends them for us. We send other emails only to people who ask for them: the waiting-list emails in section 2.9. We do not send any other marketing email.
2.7 Cookies and similar technologies
We set one cookie, howlitzer_session, to keep you signed in to every Howlitzer app. It lasts up to 7
days and page scripts cannot read it. When you open Flow, Cloudflare Access sets its own cookies (such as
CF_Authorization) to confirm that you signed in. They last up to 24 hours. All of these cookies are
strictly necessary for the Services, so they do not need your consent.
We do not use analytics, advertising or tracking cookies, and we do not load other tracking technologies.
2.8 No analytics
We do not use an analytics service, and we keep no analytics history. Before 26 September 2026, Howlitzer sign-in sent sign-in events (for example, a successful sign-in) to an analytics provider. On 26 September 2026 we stopped this and deleted all of that data.
2.9 Waiting list
If you join the Howlitzer waiting list on our website, we collect your name, your work email address, your agency's name and size, and the note you add, if any. We also record when you signed up, when you confirmed your email address, and which version of the sign-up text you agreed to.
We use these details only to run the waiting list: to confirm your email address, to invite you to Howlitzer, and to send you short updates about Howlitzer's launch. We do not use them for anything else, and we do not share them with anyone except the providers in section 4 that store the list (Cloudflare) and send our emails (Resend).
When you sign up, we send you an email with a link. You are on the list only after you open that link and confirm. The link works for 72 hours. If you do not confirm, we delete your details 7 days after you signed up.
To stop abuse of the form, we count sign-ups from each IP address. We do not store your IP address itself. We store only a keyed hash of it, and we delete that after 24 hours.
You can leave the list at any time with the link in any of our emails, or by writing to info@howlitzer.com. When you leave, we delete your details. We do not track whether you open our emails or click their links.
3. Why we use your data, and our legal basis
Where the EU or UK GDPR applies, we must have a legal basis for each use of your data.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account; sign you in | Account and session data | Performance of our contract with you (Art. 6(1)(b)) |
| Publish, analyse and store content you ask us to | Conduit and QA data | Performance of our contract (Art. 6(1)(b)) |
| Keep the Services secure; stop fraud and password-guessing | Sessions, security log, attempt counters, waiting-list sign-up counters | Our legitimate interest in security (Art. 6(1)(f)) |
| Keep records of organisations, brands and who acts for whom | Section 2.2 | Performance of our contract with the organisation that uses the Services, and our legitimate interest in knowing who is authorised to act for whom (Art. 6(1)(f)) |
| Record that you accepted our terms | Acceptance date, time and version | Our legitimate interest in proving our agreement with you (Art. 6(1)(f)) |
| Send service emails | Email address | Performance of our contract (Art. 6(1)(b)) |
| Run the waiting list, confirm your email address, and invite you | Waiting-list details (section 2.9) | Your consent (Art. 6(1)(a)). You can withdraw it at any time by leaving the list |
| Keep a record of your consent to the waiting list | Sign-up and confirmation times, and the version of the sign-up text | Our legal duty to show that you consented (Art. 6(1)(c) and Art. 7(1)) |
| Meet legal obligations and answer lawful requests | As required | Legal obligation (Art. 6(1)(c)) |
We need your account data to provide the Services. Without it, we cannot give you an account.
We do not make decisions about you based only on automated processing that have legal or similarly significant effects. QA's scores rate video clips, not people.
No AI training. We do not use your content or your personal data to train AI models.
4. Who receives your data
We use these service providers. Each one processes data only to provide its service to us, under a written agreement.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, network, databases, file storage, and the sign-in check for Flow | Global network; Cloudflare, Inc. is in the United States |
| Resend | Sends service emails and waiting-list emails | United States |
| Anthropic | AI analysis of transcripts (QA) | United States |
| Google (Gemini) | AI analysis of video frames and transcripts (QA) | United States |
| OpenAI | AI analysis of transcripts (QA) | United States |
| Sign-in with Google, if you choose it (Google receives the fact that you signed in to Howlitzer) | United States | |
| Influensea Inc. (our own server) | Runs Conduit's publishing service and QA's video processing, and holds Conduit's encrypted platform tokens | Portugal |
Conduit's publishing service and QA's video processing run today on one server that we operate in Portugal. We plan to move them to a cloud hosting provider. Before we do, we will update this table and section 5 with the new provider and its location.
Social media platforms. When you publish through Conduit, we send your content and the post details to the platform you chose (YouTube, X, Facebook, Instagram, TikTok or LinkedIn, and Pinterest when Conduit offers it). Each platform handles that content under its own privacy policy.
Your organisation. If your account belongs to an organisation, that organisation can see your membership and the content you create in its workspace.
Other disclosures. We disclose data if the law requires it, to protect the rights and safety of our users or others, or to a buyer or successor if our business is reorganised or sold. We do not sell personal data.
5. International transfers
Howlitzer is operated from the United States, and some of our providers are in the United States. When personal data from the European Economic Area or the United Kingdom is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses and, for the United Kingdom, the International Data Transfer Addendum. You can ask for a copy at info@howlitzer.com.
6. How long we keep your data
| Data | How long |
|---|---|
| Sign-in sessions | 7 days from sign-in |
| Email verification and password reset links | A verification link stops working after 24 hours, and a password reset link after 1 hour. We keep a record that a link was sent, and to which address (never the link itself), with your account, and delete it when your account is deleted |
| Account data, and the record that you accepted our terms | Until your account is deleted (section 7) |
| Security log | 12 months from each event. We keep it for that time also after your account is deleted, so entries from before the deletion can still show your IP address, user agent and, in some entries, your username |
| Conduit platform tokens and account details | Until you disconnect the account in Conduit, ask us to remove the connection, or delete your account. When you disconnect, we delete the tokens at once; on a request, within 7 days. For YouTube, we also delete the tokens if Google tells us that your permission has been removed, or if we cannot renew Conduit's access for 30 days (section 9) |
| Publication plans and results | Until your account is deleted, or earlier if you ask us to delete them |
| QA jobs, transcripts and clips | Until your account is deleted, or earlier if you ask us to delete them |
| QA brand profiles | Until the organisation they belong to is deleted, or earlier if it asks us. Deleted with your account if the organisation ends with it, or on your request if you are its only member (section 7) |
| Videos you upload to QA | Expires 2 days after the upload (deleted earlier when the QA job ends); Cloudflare then removes it, normally within one more day |
| QA sample share links | 30 days by default, 90 days at most |
| Waiting list, if you do not confirm your email address | Deleted 7 days after you signed up. The confirmation link works for 72 hours |
| Waiting list, after you confirm | Until you leave the list, 90 days after we invite you, or 24 months after you confirmed, whichever comes first. If you create a Howlitzer account, your account data is then kept as described above |
| Record of your consent to the waiting list | Deleted together with your waiting-list details |
| Waiting-list sign-up counters (a keyed hash of the IP address) | 24 hours |
7. Deleting your account and your data
To delete your account, or any of your data, write to info@howlitzer.com from the email address on your account. Tell us what you want deleted: your whole account, or only your Conduit or QA data. There is no delete button in the Services today.
When we delete your account:
- your sessions end at once, and you can no longer sign in;
- if every login on your account is your own, we delete the account completely;
- if an organisation owns a login on your account (for example, a login it created for its staff), we delete your name, username, email address, picture and password. We keep a placeholder with no personal data, so the organisation's records stay consistent;
- we delete your Conduit connections, platform tokens and publication plans, and your QA jobs, transcripts and clips;
- QA brand profiles belong to the organisation they were made for, and they stay with it, without your details. We delete them with your account only when the organisation ends with it (for example, a workspace that only you used), or when you are the organisation's only member and you ask us to delete your QA data. If a brand profile that we keep contains your own personal data (for example, your name, image or voice as the brand), we remove that data;
- we delete the link to your Google account and the details Google sent us. To stop Google from treating Howlitzer as connected, also remove it at Google security settings (section 2.1).
We complete your request within 7 days and confirm to you when it is done. One exception: if an organisation has not yet said whether a login on your account belongs to it, it has 14 days to decide. In that case we complete your deletion within one month of your request.
The security log is not deleted with your account. We keep it for 12 months from each event (section 6).
Deleting data from Howlitzer does not delete content you already published on a platform (for example, a video on YouTube). Delete it on that platform.
Facebook and Instagram: see Data deletion instructions.
8. Your rights
If the EU or UK GDPR applies to you, you have the right to:
- access your data and get a copy of it;
- correct inaccurate data;
- delete your data;
- restrict how we use it;
- receive the data you gave us in a structured, machine-readable format, and have it sent to another provider. We fulfil this on request;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent. This does not affect processing before you withdraw it. To leave the waiting list, use the link in any of our emails.
- complain to a data protection supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. You can also complain in the EU country where you live or work, or where you think the breach happened.
Users in the United Arab Emirates. You can ask us for access to, correction of, or deletion of your data, and object to its use, in the same way.
To use a right, write to info@howlitzer.com. We handle requests to delete your data or to get a copy of it within 7 days (section 7 describes the one exception). We reply to other requests within one month. We may ask you to prove who you are. We do not charge a fee.
Removing platform access. You can disconnect a social media account in Conduit at any time. We then delete our copy of its tokens at once. For YouTube (Google), X and TikTok, we also ask the platform to remove Conduit's access. For Facebook and Instagram, see section 2.3. You can also remove Conduit's access in the platform's own settings, or ask us to remove the connection (section 7).
9. Security: how we protect your data
This section describes how we protect sensitive data: the access tokens that social media platforms issue to Conduit, the data we receive from Google APIs, and your sign-in data.
Encryption in transit. All traffic between your browser and the Services uses HTTPS (TLS). Conduit's publishing service calls Google and the other platforms only over HTTPS (TLS). Our publishing server is reached only through Cloudflare's access-controlled tunnel. It is not open to the public internet.
Encryption at rest. We encrypt every platform access token and refresh token before we store it, with authenticated encryption (Fernet: AES-128 with an HMAC-SHA256 integrity check). The encryption key is not stored in the database that holds the encrypted tokens. It is kept in our password vault and given to the publishing service when it starts. Your account data is held in Cloudflare's databases, which Cloudflare encrypts at rest (D1, KV). We store passwords only as salted hashes (bcrypt), never in readable form.
Access control. Platform tokens are decrypted only on our publishing server, and only to call the platform for you. No screen, API or support tool of ours shows or returns a token. Each organisation sees only its own connected accounts. Access to our administration tools needs a separate credential.
What we do with Google user data. Conduit uses Google user data only to provide the features you use: it reads your YouTube channel's identifier and title, and it uploads the videos you confirm, with the title, description, tags and visibility you choose. Conduit asks Google only for the permissions to upload videos and to read your channel (section 2.3). Conduit's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data. We do not use it for advertising. We do not give it to data brokers or other third parties, except Google itself and the service providers in section 4 that host the Services. We do not use Google user data to develop, improve or train any AI or machine-learning model, and we do not send it to any AI service.
Deletion. When you disconnect a YouTube channel in Conduit, we ask Google to revoke Conduit's access, and we delete our copy of the tokens at once, even if Google does not answer. If Google tells us that your permission has been removed, or if we cannot renew Conduit's access for 30 days, we delete the tokens. When you ask us to delete your account or to remove a connection, we do so within 7 days (section 7).
Logs. We keep access tokens and authorization codes out of our logs.
Incidents. No system is completely secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.
10. Age
The Services are for professionals and businesses. You must be at least 18 to use them. We do not knowingly collect data from anyone under 18.
11. When we act for your organisation
If an organisation (for example, an agency or a brand owner) uses the Services, the content and customer records it puts into its workspace are processed by us on that organisation's behalf. For that data the organisation is the controller and we are its processor, under our data processing terms. Requests about that data should go to the organisation first; we will help it answer them.
12. Changes to this policy
We post every change on this page and update the date at the top. If a change is significant, we tell you by email or in the Services before it takes effect.
13. Contact
Influensea Inc. · 6847 N 9th Ave, Ste A 324, Pensacola, FL 32504, USA · info@howlitzer.com