Privacy Policy

This Privacy Policy explains how CATS22 LLC ("CATS22," "we," "us," or "our") collects, uses, stores, shares and protects information in connection with Astro (the "Service"), available at astro.cats22.agency.

Astro is a content and creative operations tool for brands. It helps a brand research the questions its audience asks, produce educational videos and images, publish them to the brand's own social accounts (Instagram, Facebook Pages, Threads, YouTube, Pinterest and TikTok), read how those posts perform, and manage advertising on Meta. Brands sign up for Astro and use it for their own accounts. It acts only on accounts the brand has connected and only on instructions the brand gives.

1. Information We Collect

1.1 Account information

For people who sign in to Astro: name, email address and a salted password hash. We do not store plain-text passwords. When you create an account we also ask about your brand: its name, email and website, team size, a monthly revenue range, its category, how it handles content today and which platforms it wants to publish to. We use these answers to review and onboard the brand, and we don't share them.

1.2 Meta (Facebook Pages, Instagram, Threads, Meta ad accounts)

When a brand connects Meta, it provides a Business Manager System User token or authorizes Astro through Facebook Login. Astro stores the token encrypted and uses it to: identify the brand's Facebook Page, linked Instagram professional account, Threads account and ad accounts; publish posts, Reels, carousels and stories the brand has approved; read post and account insights (reach, views, saves, shares, follows); and read and manage ad campaigns, ad sets, ads and their performance.

Astro does not read or store direct messages, does not access the personal profiles of people who follow or interact with the brand, and does not build audiences from personal data.

1.3 YouTube (Google)

When a brand connects a YouTube channel, it authorizes Astro through Google OAuth. Astro may request these scopes: youtube.upload, youtube, youtube.force-ssl, youtube.readonly, yt-analytics.readonly and yt-analytics-monetary.readonly, plus basic sign-in scopes (openid, email, profile).

Astro uses them to: upload videos the brand has approved and set their titles, descriptions, thumbnails, captions and playlists; read the channel's own video list and statistics; and read YouTube Analytics reports for the channel's own content. Astro does not access Gmail, Google Drive, contacts or any other Google service.

1.4 Pinterest

When a brand connects Pinterest, Astro uses the authorized account to list the brand's own boards, create Pins on them, and read analytics for the brand's own Pins. Astro does not read other people's Pins or boards.

1.5 TikTok

When a brand connects TikTok, Astro uses the authorized account to publish videos and photo posts the brand has approved and to read performance data for the brand's own content and, where connected, its TikTok Shop products, orders and affiliate activity.

1.6 Content and creator records

Media, scripts and briefs the brand creates or uploads; and, where the brand works with creators, the creator's public handle, contact details the creator provides, and records of content-usage permissions the creator has granted.

1.7 Operational data

Request logs, error logs and basic usage data used to run, secure and debug the Service.

2. How We Use Information

We use the information above only to provide the features a brand uses: research, content production, review, publishing, performance reporting, creator rights management and ad management. We do not sell personal information, use it for advertising profiles, or share it with data brokers.

Some features use AI models (Anthropic's Claude) to draft or analyse content. Only the data needed for that request is sent, and it is processed under Anthropic's commercial terms, which do not permit training on it.

3. Google User Data (YouTube)

This section applies when a brand connects a YouTube channel to Astro with Google sign-in. It describes exactly what Google user data Astro accesses, how it is used, shared, stored, protected, kept and deleted.

3.1 Data accessed

• Google account basics (openid, email, profile scopes): your name, email address and profile picture, to identify the connected account.
• YouTube channel data (youtube.readonly, youtube, youtube.force-ssl): the channel's ID and title, its videos and playlists, and their public statistics (views, likes, comments).
• YouTube Analytics (yt-analytics.readonly, yt-analytics-monetary.readonly): performance reports for the channel's own videos, such as views, watch time, audience retention and, where the channel is monetised, estimated revenue.
• Upload access (youtube.upload): permission to upload videos to the channel.

Astro does not access Gmail, Google Drive, Calendar, contacts or any other Google service.

3.2 How the data is used

• To upload videos the brand has approved in Astro to its own channel, and set their title, description, thumbnail, captions and playlist.
• To show the brand how its videos performed (post analytics, reports and comparisons inside Astro).
• To show which Google account and channel are connected.

Google user data is not used for advertising, is not sold, and is not used to develop, improve or train generalised or non-personalised AI or machine-learning models. When a brand asks Astro for an AI-written summary of its own performance, only the numbers needed for that request are sent to Anthropic under terms that do not permit training on them.

3.3 Sharing

Google user data is shared only with the service providers that run Astro (hosting, database and storage: Railway, Supabase, Cloudflare), only to provide the features above, or when required by law. It is never shared with data brokers, advertisers or other brands. People at CATS22 do not read it except with the brand's permission, for security reasons, or as required by law.

3.4 Storage and protection

Google OAuth tokens are encrypted at rest with AES-256-GCM and never logged. Data is stored in the United States and sent over TLS. Access to production systems is limited to the CATS22 staff who maintain Astro.

3.5 Retention and deletion

YouTube data Astro stores (video IDs, statistics and analytics) is refreshed or deleted at least every 30 days. When a brand disconnects its channel in Astro or revokes access from its Google Account permissions page, Astro deletes the tokens immediately and all stored YouTube data within 30 days. You can also ask us to delete it at any time: see Data Deletion or email mariano@cats22.agency.

3.6 Google and YouTube policies

Astro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs is used only to provide the user-facing features described above. It is not used for advertising, not transferred to others except as needed to provide those features or as required by law, and not read by humans except with the user's consent, for security purposes, or as required by law.

Astro uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Astro's access at any time from your Google Account permissions page.

4. Storage and Security

Data is stored in a PostgreSQL database hosted by Supabase and media files in Cloudflare R2, with the application hosted on Railway, in the United States. All platform tokens are encrypted at rest with AES-256-GCM, connections use TLS, and access to production systems is limited to CATS22 personnel who need it.

5. Sharing

We share information only with the service providers that run Astro (Railway, Supabase, Cloudflare, Anthropic, and, where used, a transcription or social-publishing provider), with the platforms a brand publishes to (which receive the content the brand chooses to publish), and where required by law. Each provider processes data only on our instructions.

6. Retention

Platform tokens are kept until the brand disconnects the account or access is revoked. Published-post records and performance data are kept while the brand uses Astro, except YouTube data, which follows the 30-day rule in §3. When a brand stops using Astro, its data is deleted within 30 days of a deletion request.

7. Your Choices and Data Deletion

• Disconnect any platform at any time from Connections in Astro; the stored token is wiped immediately.
• Revoke access from the platform itself (Meta Business Settings, Google Account permissions, Pinterest or TikTok app settings).
• Request a copy, correction or deletion of your data by email (see §9). Step-by-step instructions are on the Data Deletion page.

8. Children

Astro is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

9. Contact

CATS22 LLC
Email: mariano@cats22.agency

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the latest revision. Material changes will be communicated to connected brands by email.