✦ privacy policy

Privacy, plainly.

effective october 21, 2026 · last updated october 24, 2026

This policy explains what information Bawnseye Studios collects, why, and what we do with it. It covers our website and the Café, the social media manager we built and use in-house to run social accounts for ourselves and our clients.

The short version: the Café is a private, invite-only tool run by Bawnseye Studios. It isn't sold or offered to the public. We use it to post, schedule, read stats and handle comments on accounts our clients have asked us to manage, and clients we invite can sign in to see and manage their own accounts. We never sell data, never use it for advertising, and never use it to train AI models. Clients can disconnect their accounts at any time.

Who we are
What we collect
How we use it
AI features
Who we share it with
Google & YouTube data
Facebook & Instagram data
TikTok data
Storage & security
How long we keep it
Disconnecting & deleting data
Your rights
Children
Changes
Contact

01 Who we are

Bawnseye Studios ("Bawnseye", "we", "us") is a branding, marketing and design studio. We run the website you're on, the Café (our in-house social media manager), and the Website Desk at website.bawnseye.com, where our website clients ask for changes to their sites.

The Café is invite-only. Nobody can sign up for it. It's used by Bawnseye Studios staff, and by clients the studio has invited, who can only see and manage their own workspace. When this policy says "clients", it means businesses and creators who have hired us and asked us to manage their social media accounts or build and look after their website. When it says "you", it means anyone whose information we handle: website visitors, people who apply to work with us, clients, and people who comment on accounts we manage.

02 What we collect

On our website

Client applications. When you fill out our application form, we receive what you type in it, such as your name, role, email, phone number, business details and goals. The form is delivered to our inbox by FormSubmit, an email form service.
Basic technical data. Our website has no analytics, advertising or tracking cookies. Fonts load from Google Fonts, so your browser's IP address and user agent are seen by Google when the page loads, as they would be by any website host.

In the Café, for accounts a client has asked us to manage

Account connections. Basic account details (such as a YouTube channel name, Facebook Page name and ID, Instagram business username and ID, and TikTok display name), plus the access tokens each platform gives us when the account owner signs in and approves access. We never see or store the account's password.
Content we publish. Videos, thumbnails, titles, captions, hashtags, tags and posting schedules.
Performance stats. Views, likes, comment counts, follower counts and similar numbers for the client's own posts and accounts.
Comments. Comments left on the client's posts, including the commenter's public username or display name and the comment text, and the replies we post.
Past captions, titles and replies. The client's own recent Instagram captions and their like and comment counts, their YouTube and TikTok video titles and view counts, and replies the client wrote to comments, used to learn the client's writing style.
Sign-in emails. For staff and invited clients, the email address they sign in to the Café with.

On the Website Desk, for website clients

Your email and name. You start with the email we have on file for you, so we know which website is yours. Anyone else is turned away.
Your change request. Your chat with Muse (our AI website advisor), the change plan it writes with you, any photos or files you add, and the date you need it by.
A text copy of your public homepage, so Muse can refer to what's on your site right now.
Basic technical data. The IP address a request comes from is held briefly in memory to stop abuse (too many requests), and isn't saved with your request. No analytics or tracking cookies.

We only collect what the platforms make available to the account owner through their official APIs, and only for accounts whose owner has authorized us.

03 How we use it

To publish and schedule posts to the client's accounts.
To show the client's performance stats so we can improve their marketing.
To read, reply to, hide or mark comments as handled on the client's posts.
To draft titles, captions, hashtags and comment replies in the client's voice (see AI features).
To let invited clients sign in and manage their own workspace, and keep everyone else out.
To plan, make and confirm the website changes our website clients ask for.
To review client applications and get back to you.

We do not sell information, use it for advertising, build profiles of the people who comment, or use it to train AI models. We don't use one client's data for another client.

04 AI features

The Café uses Google's Gemini API to suggest titles, captions, tags and comment replies. To do that, we send Google the relevant text (for example a draft caption, the client's past captions, titles and comment replies, or a comment and its thread) and sometimes a single frame from a video. Google processes it under the Gemini API Terms.

On the Website Desk, Muse uses the same Gemini API to help website clients plan a change. We send Google the chat, the photos and PDFs added to it, and a text copy of the client's public homepage. Muse only writes the plan: a person at Bawnseye reviews every request, and nothing changes on a website until we approve it.

Smart auto-reply is off by default. It's only turned on by the client in their own Café, or by us with the client's agreement. When it's on, the Café replies to new, friendly comments in the client's voice. "Reply to all" does the same for comments already waiting, spread out over time at the same hourly pace. It's built to skip offensive comments, spam, comments that just tag other people, and anything a real person should answer, such as business, personal or sensitive questions. Daily and hourly limits apply, and the client can have it turned off at any time.

We share information only as needed to do the work:

The social platforms themselves (YouTube/Google, Facebook and Instagram/Meta, TikTok), when we publish, read stats or manage comments on the client's behalf.
Google (Gemini API), to generate AI suggestions as described above.
FormSubmit, which delivers website applications to our inbox.
Cloudflare, which carries connections to the Café and the Website Desk from outside the studio, and emails the one-time code used to sign in to the Café.
Authorities, if the law requires it, or to protect our rights, our clients or the public.

If Bawnseye Studios is ever merged or sold, this information may transfer, and this policy will continue to apply to it.

06 Google & YouTube data

The Café uses YouTube API Services. By letting us connect your YouTube channel, you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is covered by the Google Privacy Policy.

We use Google user data only to upload videos, read channel and video statistics, and read and reply to comments on the connected channel. Bawnseye's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove the Café's access to your Google account at any time at myaccount.google.com/permissions.

07 Facebook & Instagram data

For Facebook Pages and Instagram business or creator accounts, we use Meta's official Graph API to publish videos and Reels, read insights, and read, reply to and hide comments. Meta's handling of your data is covered by the Meta Privacy Policy.

You can remove our access at any time in Facebook under Settings & privacy → Settings → Business integrations, or by removing Bawnseye from your Page's access in Meta Business Suite. See Disconnecting & deleting data to have us delete what we hold.

08 TikTok data

For TikTok, we use the official Content Posting API to send videos to the account's TikTok inbox as drafts, which the account owner finishes and posts in the TikTok app. We also read basic profile info and video stats. TikTok's handling of your data is covered by the TikTok Privacy Policy. You can remove our access in the TikTok app under Settings and privacy → Security → Apps and services (the wording may vary by app version).

09 Storage & security

The Café runs on computers controlled by Bawnseye Studios. Each client has a separate workspace, with its own connected accounts, posts, stats and comments, so one client's data is never mixed with another's. Access tokens are stored in files only the studio's operating-system account can read, and are never published or shared.

When staff or clients open the Café from outside the studio, the connection goes through Cloudflare (Cloudflare Tunnel and Cloudflare Access). Everyone signs in with a one-time code sent to their email. The Café itself checks Cloudflare's signed sign-in token on every request and only lets in staff and the clients the studio has invited. A client sees only their own workspace and can't change the Café's settings or anyone else's data. The Café's data stays on the studio's computers; Cloudflare only carries the connection.

No system is perfectly secure, but we take reasonable steps to protect what we hold.

10 How long we keep it

Access tokens are kept while we manage the account, and deleted when the account is disconnected or our work together ends.
Stats and comments are cached copies we refresh regularly. Each refresh replaces the last one.
Uploaded videos and post records are kept while we work together so we can see what was posted and when.
When a client leaves, their sign-in stops working right away, and we take them off the Café and delete their workspace within 90 days, or sooner if they ask.
Website change requests (the chat, the plan and your files) are kept as part of your site's change history while we look after it. When a client leaves, they're included in the hand-off package or deleted, whichever the client prefers. Chats that are never sent are deleted after 3 days.
Applications are kept for as long as they're useful for following up, and deleted on request.

Content that's already been posted lives on the platforms. Deleting it from the Café doesn't delete it from YouTube, Instagram, Facebook or TikTok.

11 Disconnecting & deleting data

To have us delete information connected to your account:

Email apply@bawnseye.com with the subject "Data deletion request", and tell us which account or accounts it's about.
We'll confirm the request, revoke and delete the stored access tokens, and delete the account's stats, comments, captions and post records from the Café within 30 days.
You can also remove our access yourself at any time using the platform links above. That stops all access immediately.

If you commented on an account we manage and want your comment handled, you can delete it on the platform, or email us and we'll remove our cached copy.

12 Your rights

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, or to object to how we use it. You can ask us to do any of these by emailing us. We won't treat you differently for asking. If you're unhappy with our answer, you may be able to complain to your local data protection authority.

13 Children

Our website and services are for businesses and adults. We don't knowingly collect personal information from children under 13 (or the minimum age where you live). If you think we have, email us and we'll delete it.

14 Changes

If we change this policy, we'll update the date at the top of this page. If a change is significant, such as a new way we use client data, we'll tell our clients directly before it takes effect.

15 Contact

Questions about privacy, or a request about your data? Email apply@bawnseye.com.

See also our User Agreement & Terms of Use.