Privacy Policy

Effective date: 12 July 2026 · Operator: MCAS / Darren Kenny · Domain: mcasui.com

1. Overview

This Privacy Policy describes how MCAS (“we”, “us”) collects, uses, and shares information when you use websites and applications at mcasui.com and related services (the “Services”), including developer apps that connect to TikTok, YouTube, X (Twitter), and LLM providers for content operations.

Contact: darren.kenny7@gmail.com

2. Information we collect

2.1 You provide

• Account or contact details (e.g. email) if you contact us or configure the Services.
• Content you create or upload (scripts, videos, captions, configuration).
• Payment-related data if you purchase credits or subscriptions (processed by Stripe or similar; we do not store full card numbers).

2.2 From third-party platforms (with your authorization)

• TikTok: open_id, display name / basic profile fields, access and refresh tokens, and metadata needed to upload or publish videos you initiate.
• YouTube / Google: OAuth tokens and channel/video metadata required for upload and analytics features you enable.
• X (Twitter): tokens and post/search metadata for distribution and research features you enable.
• LLM providers (e.g. xAI): prompts and responses generated while operating the content pipeline.

2.3 Automatically

• Basic technical logs (IP address, user agent, timestamps, error codes) for security and reliability.
• Optional product analytics if enabled (e.g. Cloudflare Web Analytics).

3. How we use information

• Operate, maintain, and improve the Services.
• Authenticate you and call third-party APIs on your behalf as you configure.
• Publish or schedule content you request to platforms such as TikTok and YouTube.
• Measure pipeline performance (views, engagement, research metrics) for features you run.
• Process payments and prevent abuse or fraud.
• Comply with law and enforce our Terms of Service.

We do not sell your personal information.

The public Content Studio site on mcasui.com may display sanitized metadata about operator-shipped posts and harvest signals (titles, timestamps, public platform URLs, and scores). It does not publish OAuth tokens, private account data, or full internal scripts.

4. How we share information

• Service providers that host infrastructure (e.g. Cloudflare, cloud VPS), process payments (e.g. Stripe), or provide AI APIs (e.g. xAI), under their terms.
• Platforms you connect (TikTok, Google/YouTube, X) when you use features that call their APIs.
• Legal disclosure if required by law or to protect rights, safety, and security.

We do not share your content publicly except when you instruct the Services to publish it.

5. Tokens and secrets

OAuth access tokens, refresh tokens, and API keys are stored only as needed to operate the Services (for example in server environment configuration or encrypted token files on the operator infrastructure). They are not embedded in public client-side code. You may revoke access at any time in the third-party platform’s security or app settings.

6. Retention

We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and maintain security. You may request deletion of personal data we control by emailing us; some logs may be retained for a limited period for security.

7. Security

We use reasonable technical and organizational measures (HTTPS, access controls, secret separation from source code). No method of transmission or storage is 100% secure.

8. International transfers

Infrastructure and subprocessors may process data in the UK, EU, US, or other regions. Where required, we rely on appropriate safeguards for cross-border transfers.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to / restrict certain processing. Contact us to exercise these rights. You may also lodge a complaint with a supervisory authority.

10. Children

The Services are not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

11. Changes

We may update this Policy by posting a new version at this URL with a revised effective date. Material changes will be indicated by updating the date above.

12. Contact

Privacy questions: darren.kenny7@gmail.com