Journal Automation ("we", "the service") is operated by Emran Hasan Rabbi. It helps a news publisher turn the stories they publish into social media cards and videos, and post them to the publisher's own Facebook Page, YouTube channel and Telegram channel. This policy explains what we hold, why, and how to get rid of it.
Our users are news organisations. We do not offer this service to consumers, and we do not build profiles of the people who read our customers' websites.
Solely to provide the service: to draw the card or video, to publish it to the destinations the customer has connected, to enforce the licence the customer has bought, and to support them when something goes wrong.
To produce and deliver the content, article text and images pass through:
No other party receives customer data. Google user data is handled more narrowly still, as set out in the next section.
When a customer chooses to connect a YouTube channel, they sign in with Google and grant Journal Automation two permissions:
youtube.upload — to upload the videos the customer has chosen
(such as the night bulletin or the daily reel) to their own channel.youtube.readonly — used only to read the connected channel's
name and ID, so the customer can see which channel is linked.From Google we receive and keep only an OAuth refresh token and the channel's name and ID. We do not read the channel's existing videos, comments, subscribers or analytics, and we do not access any other Google service or account data.
How we use it. Only to upload the customer's own videos to the channel they connected, and to show them which channel that is. Google user data is not used for advertising, is not used to train any AI or machine-learning model, and is not read by people except with the customer's permission for support, for security, or where the law requires it.
Who we share it with. We do not share, transfer, sell or disclose Google user data to any third party. It is exchanged only with Google itself, through the YouTube Data API, when we upload a video or refresh access. It is never sent to Meta, Telegram, AI or speech providers, advertisers or data brokers, and never to the customer's own website. The only exception is where disclosure is required by law, and then only to the extent required.
Limited Use. Journal Automation's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Keeping and deleting it. The refresh token is kept only while the channel is connected. When a customer disconnects, we revoke the token with Google and delete it, together with the channel name and ID, at once. A token Google reports as no longer valid is deleted automatically. A customer can also remove our access at any time from myaccount.google.com/permissions, or ask us to delete everything — see Data Deletion.
Data is held on our own server. Rendered cards and videos are kept for a short working period and then removed. Site and licence records are kept while the account is active, and for up to 90 days after it ends so that a customer who returns is not treated as new. Access tokens are deleted as soon as an account is disconnected or closed.
Access tokens for Google (YouTube) and Facebook are the most sensitive data we hold. We protect them as follows:
If we ever learn that customer data has been accessed without authorisation, we will tell the affected customers promptly and revoke the tokens involved.
The service is for news businesses and is not directed at anyone under 18.
If this policy changes materially, active customers are told by email or through the plugin before the change takes effect.