Privacy Policy

Privacy Policy

The purpose of this Privacy Policy is to inform you about the types of personal information Avança Group, LLC (herein referred to as, “Avança”, “we”, “our”, or “us”) collects, uses and discloses when you visit, interact with, or use our proprietary business-to-business SaaS Platform for YouTube channel operations (the “Platform”). This Privacy Policy explains how we use and disclose that information, the choices you have regarding such use and disclosure and how you may correct that information.

Avança is proud to demonstrate our commitment to your privacy. Because our origin servers and primary database are physically hosted in Finland (EU), our data processing is subject to the General Data Protection Regulation (GDPR). We additionally comply with applicable Canadian federal and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (British Columbia).

We will treat Personal Information in a manner consistent with our Privacy Policy unless we have your consent to treat it differently.

1. Collection of Personal Information

   1. To which companies does this Privacy Policy apply?

This Privacy Policy applies to the collection, use, and disclosure of Personal Information by Avança Group, LLC.

2. What is Personal Information?

“Personal Information” means any factual or subjective information about an identifiable individual. Personal Information includes such information as a person’s name, address, email address, phone number, date of birth and financial information. Specific Personal Information, such as your legal name, date of birth, phone number or email address, is obtained only if you supply it voluntarily.

3. What Personal Information do we collect?

When you visit or use our Platform, we automatically collect certain information for security and operational purposes, including: your IP address (captured by Cloudflare at the network edge and by Nginx access logs on our origin server); your web browser User-Agent string; your time zone (stored on your account record to schedule batch operations at your local clock time); and audit-log events such as logins, failed login attempts, batch launches, schedule changes, and password changes. We do not collect individual pages you view within the Platform, search terms, transmitted data volume, or any behavioural or marketing-purpose analytics. We refer to this automatically collected information as “Device Information.” When we refer to Personal Information, we are also talking about Device Information, unless we address Device Information specifically.

We collect Personal Information that you provide to us when creating or managing your account, including: your username; your email address (required for authentication notifications, password resets, and batch reports); your first name (for staff users) or business/channel name (for client users); your time zone preference; and operational preferences such as notification email lists, schedule settings, and custom email template notes. We do not collect profile photos, date of birth, telephone numbers, postal addresses, payment information, or precise geolocation data. No payment data is collected at this time.

Furthermore, Avança may collect the following types of Personal Information upon obtaining your consent:

1. information that we receive about you from other online entities that have initially obtained your information but have transferred it to us on a contractual basis so that we can provide our Platform to you;

2. information, aggregate or user-specific, received from our Platform;

3. other information you may provide when you contact our Customer Service Team or online chat;

4. Device Information to screen and protect against fraud; and

5. YouTube channel operational data such as client channel configurations, scheduled batch settings, video metadata processed on behalf of clients, and audit log entries recording actions taken on client channels. This data is processed on behalf of clients (as a Data Processor under GDPR Art. 28) and does not constitute the personal data of end viewers.

Our Platform is a business-to-business SaaS tool for music industry professionals. All users must have legal capacity to operate a business and a YouTube channel. The Platform has no public-facing surface and no consumer registration. We do not knowingly collect Personal Information from individuals under the age of 18.

1. When and how do we obtain consent?

We collect, use, and disclose your Personal Information only where we have a lawful basis to do so, as described in the “Lawful Basis for Processing” section below. We do not rely on implied consent arising from continued use of the Platform. Where consent is the lawful basis for a specific processing activity (for example, optional marketing communications), we will obtain your express, unambiguous consent before processing, and you may withdraw that consent at any time by contacting us at [email protected].

2. How do we use technology to collect information through the Platform?

Cookies

A cookie is a small data file that is placed on your device and saved in your browser. Cookies do not damage computer systems or files, and only the website that transferred a particular cookie to you can read, modify, or delete such cookie. Cookies do not contain viruses.

A web browser is usually set to accept cookies automatically; however, this setting can be changed. If you don’t want to use cookies with our Site, there is a simple procedure within your browser that will allow you to delete the existing cookies, automatically decline future cookies, or be given the option to accept or decline particular cookies in the future. On most web browsers, the “Help” section of the toolbar will tell you how to prevent your browser from accepting new cookies, how to have the web browser notify you when you receive a new cookie or how to disable cookies entirely.

The cookies we use on our Platform are called session cookies. Session cookies are automatically deleted at the end of your session. For example, if you are using our Platform, session cookies will remember you for the duration of your visit and any subsequent visit while the Platform is open. As soon as you close down the Platform, session cookies will be removed from your device. Please note that declining cookies on our Platform will significantly reduce or impair your user experience.

The Platform does not use Google Analytics or any third-party analytics service. All operational analytics are derived from internal server-side logs that we control (AUDIT_LOG, SYNC_LOG, SYSTEM_LOGS). No third-party analytics, advertising, or tracking scripts are embedded in the Platform.

Cloudflare may set the following security and bot-management cookies: cf_clearance (up to ~30 days, upon completion of an interactive challenge), __cf_bm (~30 minutes, bot management), and _cfuvid (session, rate-limiting). These are strictly necessary cookies set by our infrastructure provider for DDoS protection and abuse prevention; they cannot be declined without breaking service delivery. They are not used for advertising or profiling purposes. The lawful basis for these cookies is our legitimate interest in maintaining the security and availability of the Platform (Art. 6(1)(f) GDPR).

Declining the cookie consent dialog does not decline this Privacy Policy. However, if you do not agree to this Privacy Policy, then you must not access or use the Platform.

Browser Storage (sessionStorage and localStorage): In addition to cookies, the Platform stores the following items in your browser’s sessionStorage:

(1) avanca_session (sessionStorage): your session token, stored for the duration of your browser session or until you log out. No API keys are stored client-side. This is strictly necessary for authenticated access to the Platform;

(2) avanca_remember (localStorage): a rotating remember-me token (7-day expiry) if you select “Remember me” at login, contains a rotating server-validated opaque code only (no role data, no client identifiers, no credentials). This is strictly necessary to maintain your session across browser restarts;

(3) avanca_last_user (localStorage): your username string, stored to pre-populate the login field as a convenience. This item is not strictly necessary, and you may clear it via your browser settings at any time.

None of these items are shared with third parties. The lawful basis for items (1) and (2) is contract performance (Art. 6(1)(b)); the lawful basis for item (3) is our legitimate interest in improving login convenience (Art. 6(1)(f)).

2. Use of Personal Information

   1. How do we use your Personal Information?

The Personal Information you provide to us will be used to: authenticate your identity and manage your account; deliver on-going Platform services including YouTube channel automation operations on behalf of clients; send operational notifications such as batch reports, schedule confirmations, invitation emails, and password reset confirmations; maintain security audit logs; deliver scheduled batch runs at your designated local time zone; and comply with applicable legal and regulatory requirements under GDPR and Canadian federal and provincial privacy law. We do not use your Personal Information for advertising, marketing campaigns, or behavioural profiling.

When you send us an email or enter your Personal Information in an online form, we will collect your Personal Information in order to respond to you, to provide the requested services, or to improve our Platform. We will not pass on such data without your consent.

We do not sell, trade, or rent your Personal Information to third parties. We may share your information, only in the following circumstances:

1. Consent;

2. To comply with legal obligations or court orders;

3. To protect our rights, privacy, safety, or property;

4. In connection with a business acquisition or merger; and

5. With service providers who assist in operating our platform.

Lawful Basis for Processing (GDPR Art. 6)

We process personal data only where we have a lawful basis to do so. The bases we rely on are:

Contract performance (Art. 6(1)(b))	Processing of account credentials, email address, username, time zone, and operational preferences necessary to deliver the Platform services you have contracted for.
Legitimate interests (Art. 6(1)(f))	Processing of IP addresses, User-Agent strings, and audit-log events for security monitoring, abuse prevention, and platform integrity. We have assessed that these interests are not overridden by your rights and freedoms, given that the data is retained only briefly (Nginx logs: 14 days; n8n logs: 7 days) and is used solely for operational security purposes
Legitimate interests (Art. 6(1)(f))	Processing of publicly available contact information about prospective business clients for B2B outreach. You have the right to object to this processing at any time (see Your Rights below).
Legitimate interests (Art. 6(1)(f))	Information about prospective business clients gathered from publicly available sources (such as YouTube channel pages). This includes: business name or channel name; publicly listed email address; YouTube channel URL; and notes on outreach status.
Legal obligation (Art. 6(1)(c))	Where processing is required to comply with applicable law

2. Where do we store your Personal Information?

Our primary servers and PostgreSQL database are hosted by Hetzner Online GmbH in Helsinki, Finland (EU), within the European Economic Area. Certain operational data (including Google Sheets-based logs, AI-generated content via Google Gemini, YouTube data via YouTube Data API, and email delivery via Google Workspace Gmail) is processed by Google LLC on Google Cloud infrastructure, which may involve cross-border data transfers. Cloudflare, Inc. processes network traffic at its global edge network. Each sub-processor (including Hetzner Online GmbH, Cloudflare, Inc., Google LLC, Genius Media Group Inc., lrclib.net, and, when applicable, Stripe, Inc.) relies on Standard Contractual Clauses (EU Commission Decision 2021/914) or other GDPR-compliant transfer mechanisms for any international data transfers.

3. How long will we use, disclose, or retain your Personal Information and Device Information?

We retain personal data only for as long as necessary for the purposes set out in this Policy. Specific retention periods are:

Nginx server access logs	14 days, daily rotation
n8n workflow execution logs	7 days
Security audit log (AUDIT_LOG)	duration of client relationship + 5 years post-termination
PostgreSQL account records	retained for 90 days, then permanently deleted or anonymized
CRM prospect records	retained until a do-not-contact request is received, after which a minimal suppression record is retained solely to honour that request

We implement industry standard security arrangements to protect your Personal Information against risks such as unauthorized access, collection, use, disclosure or disposal. We integrate these security measures into the design, application, and operation of the Platform. We take commercially reasonable measures to evolve with the risks so that the integrity and confidentiality of your Personal Information and our systems are maintained.

For example:

1. Passwords are encrypted using bcrypt hashing;

2. Data is transmitted over secure HTTPS connections;

3. User data is stored in a PostgreSQL database on Hetzner encrypted block storage, with role-based access controls;

4. PostgreSQL data is stored on Hetzner’s block storage (encrypted at the storage layer per Hetzner’s standard offering); and

5. Regular security audits and updates are performed.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

When you delete your account, all personal data not subject to a legal retention obligation will be deleted or anonymized within 30 days.

3. Disclosure of Personal Information

   1. We use third-party sub-processors to help us operate our Platform and to administer business activities on our behalf, such as cloud infrastructure hosting, network security, email delivery, AI-assisted content generation, and YouTube channel data management. We may share your Personal Information with these third parties for those limited purposes. Each is engaged under data-processing terms consistent with applicable privacy law.

Where Avança operates YouTube channel functions on behalf of a client, Avança acts as a Data Processor and the client acts as the Data Controller within the meaning of GDPR Art. 4. Such activities are governed by a separate Client Service Authorization between Avança and the client, as required by GDPR Art. 28.

2. We use:

   1. Cloudflare’s services are governed by Cloudflare’s Data Processing Addendum incorporating Standard Contractual Clauses (EU Commission Decision 2021/914). A copy of the applicable safeguards is available from Cloudflare’s website or on request.

   2. Hetzner Online GmbH (Hetzner), our cloud infrastructure provider, is headquartered in Gunzenhausen, Germany (EU). Hetzner hosts our origin VPS in Helsinki, Finland, on which the PostgreSQL database, n8n workflow engine, Nginx web server, and server-side logs reside. All Personal Information stored at the origin level is held within the EU. Hetzner processes data under its Data Processing Agreement, which incorporates Standard Contractual Clauses (EU Commission Decision 2021/914) for any transfers outside the EEA.

   3. Google processes data on Google Cloud infrastructure under Google’s Cloud Data Processing Addendum incorporating Standard Contractual Clauses (EU Commission Decision 2021/914).

   4. Genius Media Group, Inc. (Genius API) and lrclib.net for lyrics retrieval to support YouTube video metadata generation. Only song title and artist name are transmitted to these services; no user Personal Information is shared.

   5. Stripe, Inc. (planned) for future payment processing for a subscription tier. Stripe is not currently engaged. When and if implemented, Stripe will process billing identifiers and payment data; full card data will not transit our systems (processed via Stripe Elements). A future addendum to this Privacy Policy will address Stripe-specific disclosure when subscriptions launch.

   6. Google Workspace (Gmail) via Nodemailer to send transactional and service-related emails, including account invitations, password reset confirmations, batch summary reports, and scheduled-run notifications. To facilitate these communications, we disclose your email address and the email body content to Gmail. You authorize us to use this service to deliver communications related to your use of the Platform.

3. If you are a prospective client and wish to: access the data we hold about you; request its deletion; or object to our processing (Art. 21 GDPR) — please contact us at [email protected]. We will action your request within one calendar month.

4. Changes

   1. We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of material changes by email to the address on your account at least 30 days before the changes take effect. For minor clarifications, we will update the version date at the bottom of this Policy. If a change affects the lawful basis or purpose of processing, we will provide individual email notice and, where required by law, seek fresh consent. Continued use of the Platform after the effective date of a material change constitutes acceptance of the revised Policy.

   2. We are also committed to keeping your Personal Information accurate. Please notify us of any changes to your information. By doing so, we can ensure our records are accurate, and we’ll be better able to assist you. This includes changes to contact information, address, employment, occupation, and education.

5. Your Rights and Applicable Law

   1. Because our data processing occurs on servers physically located in Finland (EU), data subjects have the following rights under the GDPR: the right of access (Art. 15); the right to rectification (Art. 16); the right to erasure (Art. 17); the right to restriction of processing (Art. 18); the right to data portability (Art. 20); the right to object (Art. 21); and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, please contact us at the address below. We will respond within 30 days.

   2. The Platform is a business-to-business SaaS service. All users access it in a commercial, professional capacity. The Platform is not directed to consumers, households, or individuals acting in a personal capacity. By using the Platform, you represent and warrant that you are accessing it in a commercial or employment context.

   3. Please submit your request to [email protected] and allow 30 days for a response. For your protection and the protection of all of our users, we may ask you to verify your identity before we disclose your Personal Information.

6. Jurisdiction

   1. This Privacy Policy and your use of the Platform are governed by the laws of the Province of British Columbia, Canada, except to the extent that mandatory data protection legislation applicable to you (including the GDPR) provides otherwise. Subject to the following sentence, disputes shall be resolved in the courts of British Columbia. Nothing in this clause limits your right under GDPR Art. 79 to bring proceedings before the courts of the EU member state in which you are habitually resident, or to lodge a complaint with the competent supervisory authority under Art. 77. You agree that you will not file or participate in a class action against us except where prohibited by applicable mandatory law. In the event of any discrepancy between this English-language version and any translated copies of this Privacy Policy, the English version shall prevail.

   2. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, Avança will notify the Finnish Data Protection Ombudsman (tietosuoja.fi) within 72 hours of becoming aware of the breach, in accordance with GDPR Art. 33. Where the breach is likely to result in a high risk to individuals, Avança will notify affected data subjects without undue delay, including a description of the nature of the breach and the measures taken or proposed to address it (Art. 34).

3. Supervisory Authority

Because our primary data processing infrastructure is located in Finland, the lead supervisory authority for GDPR purposes is the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto). You have the right to lodge a complaint with this authority at any time:

• Finnish Data Protection Ombudsman

• Website: tietosuoja.fi

• Email: [email protected]

You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.

7. Contact

   1. For questions about this Privacy Policy, to exercise your data subject rights (access, rectification, erasure, restriction, portability, objection), or to submit a Data Subject Access Request (DSAR), please contact our privacy contact:

Customer Service: [email protected]

Effective date: July 3, 2026

YouTube Analytics data

Where a client connects their channel's analytics, Avança Group accesses two things through Google's APIs:

• YouTube Analytics reports for that channel — the search queries viewers used to find it, where its views come from, view and watch-time figures, and the countries and devices viewers use. This is channel-level reporting data. It does not identify individual viewers, and Avança Group receives no personal information about them.
• The channel's own identity, read once during the consent step, to confirm that the account granting access owns the channel being connected. Without that check a client could connect the wrong account and another channel's figures would be stored against their record.

How it is used. The data is shown to the client in their own dashboard and to Avança Group staff in the Analyzer, where it informs the metadata work carried out for that client — principally which searches are bringing viewers to their videos. It is not used for advertising, not used to train models, and not used for any purpose other than providing that service.

Transfers. This data is not sold, and it is not shared with any third party. It is stored on Avança Group's own infrastructure alongside the rest of the client's account data, under the security measures described above.

Retention and deletion. Analytics are retained while the client's consent stands. When a client disconnects from their Avança Group dashboard, the access token is revoked with Google and the analytics collected under it are deleted immediately. A client may also revoke access directly from their Google account's permissions page. Google does not notify us when they do, so collection stops at once but the analytics already held are not removed automatically: a client who has revoked access that way, or who wants their analytics deleted for any other reason, can disconnect from their dashboard or contact us, and we will delete them. Read access is read-only throughout: this consent does not permit Avança Group to change anything on the client's channel.

Google API Services User Data Policy — Limited Use Disclosure

This notice is published by Avança Group, LLC to satisfy Google's disclosure requirements for applications that use Google APIs. It supplements, but does not modify, our Privacy Policy above.

Avança Group's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.