개인정보처리방침

YouTube and Google user data: collection, use, sharing and retention

Effective September 18, 2026. Tamicon uses youtube.readonly to identify the channel selected by the customer and verify the processing and visibility of videos uploaded through Tamicon. It uses youtube.upload to upload customer-approved videos and metadata to that channel. Upload permission alone does not provide channel identification or video-status queries; read-only permission cannot upload. Tamicon does not request access to Gmail, contacts or viewing history.

Data we access, collect, store and use

• Selected YouTube channel: We retrieve the channel ID, name and handle from YouTube after Google authorization, associate them with the customer’s Tamicon account, and store them to display the chosen channel and verify the publishing destination.
• OAuth authorization: We process access tokens, refresh tokens, granted scopes and expiry information to maintain the connection and make authorized API requests. Refresh tokens are stored in Google Cloud Secret Manager; access tokens obtained by a server job are used to perform its requests. We never collect Google passwords.
• Customer-created upload content: We store the video file, title, description, category, privacy setting, made-for-kids setting, synthetic-media disclosure and publishing consent supplied or approved by the customer, and send the approved content and settings to YouTube. Automatic publishing requires separate consent to its settings. These source files are created or provided within Tamicon, not downloaded from YouTube.
• YouTube upload and verification data: We retrieve and store the uploaded video ID, channel ID, video URL, returned title and description, privacy and upload-processing status, made-for-kids and synthetic-media values to check that the result matches the approved upload. A private-upload recovery check also compares the publication timestamp, category and file size. Check timestamps and bounded error categories support result display, duplicate-upload prevention and recovery.
• Unused data: Additional response fields, such as channel descriptions and thumbnail URLs, are not copied into persistent application records. Tamicon does not query comments, subscriber lists, viewing history, YouTube Analytics or YouTube Reporting data. We do not request Gmail or contacts access.

Refresh, retention, revocation and deletion

Maintenance runs every minute with deletion requests taking priority. For active eligible connections, a successful authorization, channel or video check schedules its next check one day later. We refresh the selected channel name/handle and check the existence and current privacy status of videos uploaded through Tamicon. Temporary failures are retried and are not, by themselves, recorded as the customer revoking consent.

When channel or video API data has not been successfully refreshed for 29 days, expiry cleanup starts so data is not retained and used beyond the 30-day refresh/delete boundary. Detailed historical upload observations and recovery evidence are removed at 29 days; current video visibility and its check time are shown separately from historical completion. User-created source content and accounting records are managed separately from retrieved YouTube API data.

Customers can request deletion in YouTube connection and data deletion or contact tamiconauto@gmail.com. A request blocks further publishing and starts revocation and cleanup of stored YouTube connection/API data and credential versions, with a maximum processing target of seven calendar days. Customers can also revoke access in Google’s third-party connection settings. Authorization is checked regularly; confirmed unavailable authorization triggers local cleanup rather than continued publishing, within 30 days of revocation.

Daily database backups retain the most recent seven days. Before restored data can be used for publishing, old YouTube connections and automatic-publishing consents are cleared and reconnection is required. Separately held support or diagnostic copies are included when verifying a deletion request’s scope and outcome. Deleting Tamicon’s stored data does not delete videos already on YouTube; customers manage those videos in YouTube. Google Privacy Policy and YouTube Terms of Service also apply.

Recipients and purposes: Google/YouTube receives the authorized video, title, description, privacy settings and authentication needed to upload and verify it. Google Cloud/Firebase processes connection and publishing data to host Tamicon, execute publishing jobs, store files and credentials, and troubleshoot the service. OAuth tokens are stored in Google Cloud Secret Manager. Supabase processes Tamicon account authentication and stores channel identifiers, names and handles, uploaded-video identifiers and URLs, processing/privacy status, consent and publishing records in its database and backups. These providers process data needed to deliver the service; Google passwords are never collected or stored.

Public YouTube video URLs may also be included in related posts on the customer-connected WordPress site and its hosting provider. No OAuth tokens or private-video data are sent to those publishing destinations. Videos and metadata are visible to viewers according to their YouTube privacy setting; readers can see links placed in public posts. Necessary disclosures to competent authorities or parties assisting with fraud, abuse or security incidents are limited to the applicable legal or security purpose. Other recipients or purposes require prior notice and applicable consent.

Protection: Tamicon uses HTTPS/TLS in transit and the providers’ encryption at rest for its operational database, backups, cloud files and Secret Manager. Tokens are separated from ordinary content and accessible only to authorized server workloads; they are not exposed in customer screens, AI prompts or routine job logs. Authenticated membership/session checks and tenant-level database policies restrict access to the customer’s own data. Operator access requires separately authorized roles. Connection requests are bound to the signing-in session, and upload execution validates the confirmed channel and authorization. Revocation blocks further uploads and triggers cleanup. Daily database backups retain the most recent seven days; restored YouTube connections and automatic-publishing consents are cleared before reconnection.

Limited use: Google user data is used only for the disclosed connection, publishing, verification and maintenance features. Tamicon does not sell it, use it for advertising or credit decisions, or send it to content-generation AI or use it to train generalized AI/ML models. Human access is limited to explicit user authorization, security investigation or legal obligations. Tamicon’s use and transfer of Google user data follows the Google API Services User Data Policy, including Limited Use requirements. The refresh, revocation and deletion procedures above apply to this data; requests can be sent to tamiconauto@gmail.com.

Instagram data: purposes, recipients and deletion

Effective September 16, 2026. Tamicon requests instagram_business_basic and instagram_business_content_publish through Instagram Login. It uses the professional account ID, username and account type to display and confirm the publishing destination; authentication tokens to perform authorized API operations; and published media IDs, permalinks and processing status to verify results and prevent duplicate posting. Tamicon does not collect Instagram passwords or request messaging, comment-management, follower-list or advertising-management permissions.

Meta/Instagram receives the authorized image, caption and authentication needed for a single-image feed post. Customers either review and publish a post or separately consent to scheduled automated publishing. Google Cloud/Firebase hosts the service and publishing jobs, stores images and credentials, and supports operations. Tokens are stored in Google Cloud Secret Manager. Supabase handles Tamicon authentication and stores connection identifiers, usernames, account types, consent and publishing records, media IDs, URLs and status in its database and backups. Public Instagram permalinks may be included in related posts on the customer’s WordPress site and YouTube channel; tokens are not sent to those destinations.

Tamicon does not sell Instagram data or use it for advertising targeting or generalized AI training. Content-generation AI uses customer-provided or approved business information and drafts, not Instagram tokens, account information or publishing results. Operational storage is configured in Seoul; this does not mean all provider support and operational access is restricted to South Korea. HTTPS/TLS, provider encryption at rest, separated token storage and authenticated tenant/role checks protect access.

Disconnecting in Tamicon blocks new publishing and pending schedules; already submitted Instagram requests may finish. The customer must also remove Tamicon in Instagram’s Apps and Websites settings. The server verifies access denial before destroying the stored token and showing completion. Disconnecting does not automatically erase all connection, consent or publishing history. Daily database backups retain the most recent seven days; separate security, cleanup-audit and support records may exist.

To request deletion of Instagram-related information, email tamiconauto@gmail.com with the Tamicon signup email and requested scope, without passwords or tokens. After verifying the requester, Tamicon confirms the scope and outcome for operational data, backups, support and audit materials, and explains any necessary legal or security retention. Existing Instagram posts are not automatically deleted; the customer can delete them on Instagram.