Privacy Policy

1. Introduction

H and W Steam Institute Inc. ("Company," "we," "us," or "our") respects your privacy and is committed to protecting personal information collected through the QuickAdVideo platform available at https://quickadvideo.com (the "Platform"), including related services, applications, and APIs (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our Services, including when you connect third-party accounts such as Facebook, Instagram, TikTok, YouTube, Meta Ads, Canva, GoHighLevel, and Stripe.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

• Clients who register for and use the Services
• Authorized users within a Client workspace
• Visitors to the Platform website
• Users who connect third party social media, advertising, design, or CRM accounts to the Platform

This Policy does not apply to third-party websites, platforms, or services that may be linked to or integrated with the Services. Each third-party platform has its own privacy policy that governs data you provide directly to them.

3. Information We Collect

3.1 Information You Provide Directly

We may collect the following information when you register, subscribe, or use the Services:

• First and last name
• Business email address
• Telephone number
• Company name and role/title
• Login credentials (encrypted)
• Billing and payment related identifiers (processed by Stripe)
• Scripts, prompts, videos, images, and other content you upload ("User Content")

3.2 Information Collected Automatically

When you access the Platform, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Operating system
• Usage logs, timestamps, and interaction data
• Cookies and similar tracking technologies

3.3 Information Collected from Third Party Platform Integrations

When you connect third party accounts to the Platform, we collect and store the following information depending on the integration:

Facebook (Meta Platforms, Inc.)

When you connect your Facebook account, we request the following permissions: pages_manage_posts, pages_read_engagement, pages_show_list, pages_read_user_content. We collect:

• Facebook user ID and name
• Page IDs, names, categories, and permissions
• Page access tokens
• Ad account IDs and names (for ads management)
• Campaign, ad set, and ad performance data (impressions, reach, spend, clicks)

Facebook data use is subject to the Meta Privacy Policy and Meta Platform Terms.

Meta Ads (Meta Platforms, Inc.)

For Meta Ads management, we request: ads_management, ads_read, business_management, pages_read_engagement. We collect:

• Business ID and name
• Ad account details (IDs, names, currencies, timezones, status)
• Campaign, ad set, and ad creative data
• Ad performance insights (impressions, reach, clicks, spend, conversions, CTR, CPC, CPM)
• Targeting parameters and audience data

Meta Ads data use is subject to the Meta Privacy Policy and Meta Advertising Policies.

Instagram (Meta Platforms, Inc.)

When you connect your Instagram account, we request: instagram_business_basic, instagram_business_content_publish. We collect:

• Instagram user ID and username
• Profile information
• Access tokens for content publishing

Instagram data use is subject to the Instagram Privacy Policy and Meta Platform Terms.

TikTok (ByteDance Ltd.)

When you connect your TikTok account, we request: user.info.basic, video.upload, video.publish. We collect:

• TikTok user ID (open_id) and username
• Access and refresh tokens for video publishing

TikTok data use is subject to the TikTok Privacy Policy and TikTok Terms of Service.

YouTube (Google LLC)

When you connect your YouTube account, we request: youtube.upload, youtube, youtube.readonly, userinfo.profile. We collect:

• YouTube channel ID and username
• User profile information
• Access and refresh tokens for video uploading

YouTube data use is subject to Google's Privacy Policy and the YouTube Terms of Service. By using our YouTube integration, you also agree to be bound by the Google Privacy Policy. You can revoke our access to your YouTube data at any time via Google Security Settings.

Canva (Canva Pty Ltd)

When you connect your Canva account, we request: asset:read, asset:write, design:meta:read. We collect:

• Access and refresh tokens
• Design and asset metadata

Canva data use is subject to the Canva Privacy Policy.

GoHighLevel (HighLevel Inc.)

When you connect your GoHighLevel CRM account, we request: medias.readonly, medias.write, contacts.readonly, contacts.write, oauth.readonly, oauth.write. We collect:

• Sub-account/Location ID
• Contact data (names, email addresses, phone numbers, tags)
• Access and refresh tokens for media uploads and contact sync

GoHighLevel data use is subject to the GoHighLevel Privacy Policy.

Stripe (Stripe, Inc.)

When you make purchases or subscribe, Stripe processes your payment. We receive:

• Stripe customer ID
• Payment intent IDs and payment status
• Subscription status and billing period
• Payment amounts and currency

We do not store your credit card number, expiration date, or CVV. All payment information is processed and stored by Stripe in accordance with the Stripe Privacy Policy.

4. How We Use Personal Information

We use personal information for the following purposes:

• To provide, operate, and maintain the Services
• To create and manage user accounts and workspaces
• To generate AI powered videos and related outputs
• To process subscriptions and payments via Stripe
• To publish content to connected social media accounts (Facebook, Instagram, TikTok, YouTube)
• To manage advertising campaigns on Meta Ads (Facebook and Instagram)
• To sync contacts and upload media to your GoHighLevel CRM
• To enable design editing through Canva integration
• To provide customer support and technical assistance
• To improve and optimize the Platform and Services
• To ensure security, prevent fraud, and enforce our Terms
• To comply with legal and regulatory obligations

5. Legal Basis for Processing (Where Applicable)

Where required under applicable law, we process personal information based on:

• Performance of a contract
• Legitimate business interests
• Compliance with legal obligations
• Your consent, where applicable (including consent granted via OAuth authorization for third-party integrations)

6. Use of Artificial Intelligence & Training Data

User Content (including scripts, prompts, and videos) may be processed by artificial intelligence systems to:

• Generate requested outputs
• Improve, train, and enhance our AI models
• Maintain and develop our Services

All AI processing is conducted in accordance with this Privacy Policy and applicable laws.

7. Disclosure of Personal Information

We may disclose personal information to:

• Authorized employees and contractors
• Hosting, infrastructure, and cloud service providers (including Supabase)
• Payment processors (Stripe, Inc.)
• Analytics and security service providers
• Third-party platforms you authorize via OAuth (Facebook/Meta, Instagram, TikTok, YouTube, Canva, GoHighLevel)
• Legal or regulatory authorities when required by law

We do not sell personal information.

8. Third-Party Platform Integrations

The Platform integrates with the following third-party services. When you connect these services, data is shared in accordance with both this Privacy Policy and the respective platform's policies:

You may disconnect any third-party integration at any time through the Connections page on the Platform. Disconnecting will revoke our access to that platform's data going forward, but will not delete data already collected during the period of connection.

For YouTube specifically, you may also revoke access through Google Security Settings.

9. Token Storage and Security

When you connect third-party accounts, we store OAuth access tokens and refresh tokens securely in our database. These tokens are:

• Stored encrypted at rest in our Supabase-hosted database
• Used solely for the purposes you authorized (e.g., posting content, managing ads)
• Automatically refreshed before expiration to maintain your connection
• Deleted when you disconnect the integration

We use PKCE (Proof Key for Code Exchange) for enhanced security where supported (e.g., Canva). All OAuth flows use CSRF protection via state parameters.

10. Data Storage and Security

Personal information is stored on secure servers located in the United States, hosted by Supabase.

We implement reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or disclosure.

However, no system can be guaranteed to be 100% secure.

11. Data Retention

We retain personal information only for as long as necessary to:

• Fulfill the purposes described in this Policy
• Comply with legal, accounting, or regulatory obligations
• Resolve disputes and enforce agreements

User Content may be deleted following termination of Services, subject to contractual obligations. Third-party access tokens are deleted upon disconnection of the integration or account termination.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable core Platform functionality
• Maintain authentication sessions
• Improve user experience
• Analyze usage and performance

You may control cookies through your browser settings. Disabling cookies may affect functionality.

13. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Request deletion of personal information
• Object to or restrict certain processing
• Withdraw consent, where applicable
• Disconnect third-party integrations at any time through the Connections page
• Revoke third-party platform access directly through each platform's settings

Requests may be submitted using the contact details below.

14. California Privacy Rights (If Applicable)

California residents may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information is collected
• The right to request deletion
• The right to non-discrimination

We do not sell or share personal information for cross-context behavioral advertising.

15. Children's Privacy

The Services are intended for business and professional use only and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

16. Third-Party Links

The Platform may contain links to third-party websites and services. We encourage you to review their privacy policies before providing any information. Key third-party privacy policies:

• Meta/Facebook Privacy Policy
• Instagram Privacy Policy
• TikTok Privacy Policy
• Google/YouTube Privacy Policy
• Canva Privacy Policy
• GoHighLevel Privacy Policy
• Stripe Privacy Policy

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on the Platform and will become effective as of the updated effective date.

Continued use of the Services constitutes acceptance of the updated Privacy Policy.

18. Contact Information

For questions or requests related to this Privacy Policy or personal data, contact: