ShortsIntel

Privacy Policy

Last updated: 21 October 2026

ShortsIntel is published by Jackson Gathondu ("ShortsIntel", "we", "our"). We provide research and monitoring of public short-form video and ad data through our website, console, API and MCP server, including the ShortsIntel plugins and connectors for AI assistants such as ChatGPT, Codex and Claude (together, the "Service"). This policy explains what we collect, why, who receives it, how long we keep it, what we log, and what you can do about it.

1. Data We Collect

a. Account data

  • Your name, email address and, if you sign in with Google, your Google profile picture and the tokens Google issues for the sign-in.
  • Your Organization and team: its name, members, roles and invitations (including the email address of anyone you invite).
  • Sign-in sessions, each with the IP address and browser user agent it was opened from.

b. Credentials and connections

  • API keys: we store a one-way hash and a short display prefix, never the key itself, plus when it was last used.
  • AI assistants you connect over OAuth (for example ChatGPT, Codex or Claude): the client's registration details, your consent, the Organization you chose, and the access and refresh tokens issued to it.
  • Webhook endpoints you register: the URL, an encrypted signing secret, and each delivery's payload, response status and response body.

c. Usage and workspace data

  • Every operation you run (from the console, the API, or an AI assistant's tool call): what was asked, including search terms, creator handles, hashtags, sounds, URLs and filters; the result; which user, API key or assistant made the call; its cost; and when it ran.
  • The Trackers and Collections you create, and the change reports they produce.
  • Your Credit balance and every charge and top-up against it.

d. Billing data

Payments are handled by Polar, which acts as merchant of record and collects your payment details under its own privacy policy. We never receive or store card numbers. We keep the Polar customer reference, billing name and email, and the amount and time of each top-up.

e. Support and contact data

Anything you send us by email, including the message and any attachments.

f. Website analytics

We use Vercel Web Analytics to count page views and referrers in aggregate. It does not use cookies to identify you. We do not run advertising trackers.

g. Public platform data

The Service also processes material published publicly on TikTok, Instagram, YouTube and Facebook, and in the Meta and TikTok ad libraries. Section 7 explains how we handle it.

2. Why We Use It

  • To provide the Service: sign you in, run the operations you request, keep your Trackers running, deliver your webhooks, and return results to you or to the AI assistant you connected.
  • To bill you correctly: quote and charge Credits, record top-ups, and show your usage.
  • To keep the Service secure and available: rate limiting, detecting abuse, investigating failed calls, and measuring the reliability of the data sources we depend on.
  • To communicate with you: sign-in codes, invitations, service and security notices, and replies to support requests.
  • To improve the Service in aggregate, for example which operations are slow or fail.
  • To comply with the law and enforce our Terms.

We do not sell personal data, use it for advertising, or use your queries or results to train AI models.

3. Who Receives It

We share data only with the following categories of recipient, and only what each needs:

  • Infrastructure providers that host and run the Service: Vercel (website, API hosting and web analytics), Railway (databases, background workers and our data-collection and video-analysis services), Upstash (rate limiting and caching), and Amazon Web Services (media storage, delivery and processing).
  • AI model providers: OpenRouter, and the model vendors it routes requests to (currently Google's Gemini models), and Google's Gemini API directly for some video analysis. They receive public video media, captions and comments, and the search terms of your request where the analysis needs them. They do not receive your name, email or account details.
  • Data providers and proxy networks we use to fetch public platform data. They receive the handles, hashtags, search terms and URLs needed to fetch it, not your identity.
  • Email delivery: Resend sends sign-in codes, invitations and notices, so it receives your email address and the message.
  • Payments: Polar, as merchant of record.
  • Sign-in: Google, if you choose to sign in with Google.
  • Recipients you choose: the AI assistants you connect (which receive the results of the tool calls they make), the webhook URLs you register, and the members of your Organization.
  • Legal and corporate: where the law requires it, to protect the rights or safety of our users or the public, or as part of a merger, acquisition or sale of assets, under this policy.

4. Request Logging

  • Hosting logs. Our hosting providers (Vercel and Railway) record each request's IP address, time, path, status and user agent, and we use these logs to investigate errors and abuse.
  • Sessions. Each sign-in session stores the IP address and user agent it was opened from.
  • Operations. Every operation records its parameters (your query patterns: search terms, handles, URLs and filters), the caller, timestamps and cost, as described in Section 1(c). These records do not include your IP address.
  • Free tools. The free tools on our website use your IP address as a rate-limit key for 24 hours.
  • Data source health. For each call we make to an upstream data source we record the endpoint, success, latency and bandwidth. These records do not identify you.

5. How Long We Keep It

  • Account, Organization and team data: while your account is open. Deleted when you ask us to delete the account (see Section 6).
  • Sign-in sessions: expire after 7 days without use.
  • AI assistant tokens: access tokens expire after 1 hour and refresh tokens after 30 days. Revoking an assistant ends its access immediately.
  • API keys: until you revoke them. Revoked keys stop working immediately; the hashed record stays with your account.
  • Operations, results, usage, Trackers, Collections, change reports and webhook deliveries: while your account is open, so you can see your history and usage. Deleted with the account.
  • Billing records (top-ups, charges and balance history): kept after account deletion for as long as tax and accounting law requires.
  • Support emails: as long as needed to resolve the request and keep a record of it.
  • Hosting logs: for our hosting providers' standard log-retention periods, which are short (days to weeks).
  • Free-tool rate-limit keys: 24 hours.
  • Public platform data: see Section 7(c).

6. Your Controls

  • In the console, at any time: revoke API keys, revoke connected AI assistants, delete Trackers, Collections and webhook endpoints, and manage your team's members and invitations.
  • In your AI assistant: remove the ShortsIntel plugin or connector to stop it calling the Service.
  • Export: your operations, results, Trackers, Collections and usage can be read at any time through the API. For a full copy of the personal data we hold about you, email privacy@shortsintel.com.
  • Deletion: to delete your account and its data, email privacy@shortsintel.com from the address on the account. We confirm the request and complete it within 30 days, keeping only the billing records the law requires.
  • Correction and access: email privacy@shortsintel.com to see or correct the personal data we hold about you.

Depending on where you live, you may also have the right to object to or restrict processing, and to complain to your local data-protection authority. See our GDPR page.

7. Public Short-Form Video and Ad Data

The Service analyses short-form video published publicly on TikTok, Instagram, YouTube and Facebook. To do that we collect and process material that is already public on those platforms:

  • Public posts and their captions, hashtags, sounds, thumbnails and publicly reported metrics such as view, like, comment and share counts;
  • Public creator profile information, including handle, display name, biography, and follower and post counts;
  • Public comment text on those posts, and derived analysis of it;
  • Public advertising records made available through the Meta and TikTok ad libraries.

Some of this material relates to identifiable people: creators, and the authors of public comments. We are not their customer and they have no account with us, so the following explains how we handle it.

a. Why we may lawfully do this

Where this material is personal data, we process it on the basis of our legitimate interests (Article 6(1)(f) UK/EU GDPR and equivalent provisions elsewhere): operating a research and analytics service that helps our customers understand what is performing on public short-form video platforms. We have assessed that interest against the rights and freedoms of the people concerned, and we limit the processing accordingly. In particular:

  • We collect only material the platform has made publicly accessible. We do not attempt to access private accounts, restricted posts, direct messages or anything behind a login that is not our own.
  • We use the data to describe content and public performance, not to build profiles of individuals, and we do not use it for advertising, credit, employment, insurance or any other decision about a person.
  • Comment analysis is stored without usernames or author identifiers, so what is retained describes the response to a video rather than who said what.
  • We do not deliberately collect special-category data, and our terms prohibit customers from using the output to identify, target, profile or make decisions about individuals.

b. Where it comes from

We obtain this material from the platforms' own public surfaces and advertising libraries, and through third-party data providers.

c. What we keep, and for how long

  • Video, creator and ad records, and the snapshots of public metrics we take over time, are retained indefinitely: the historical series is what makes change over time measurable, and deleting it would remove the Service's core function.
  • Video media files are deleted once the analysis pass over them is complete. A video a customer asks to download is copied to our storage and that copy is deleted 7 days after it is made. We do not keep a lasting library of downloaded videos.
  • Raw comment text is deleted after 90 days. The derived analysis is kept and, as above, never carries usernames.

d. Your rights, if this is about you

If you are a creator or commenter whose public content we process, you have rights over that processing, including the right to object to processing carried out on the basis of legitimate interests, and rights of access, rectification and erasure, subject to the exemptions in applicable law. Write to privacy@shortsintel.com with enough detail to identify the account or content in question (for example, the platform and handle), and we will respond within the period the applicable law requires.

8. Security

We encrypt data in transit, store API keys only as hashes, encrypt webhook signing secrets, and limit staff access to what each role needs. No system is completely secure. Report vulnerabilities to security@shortsintel.com. See our Security page.

9. International Transfers

Our providers process data in the United States and other countries. Where data protection law requires it, we rely on the providers' contractual safeguards, such as standard contractual clauses, for these transfers.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this policy. If a change is material we will give notice on our website or by email before it takes effect, and update the date above.

12. Contact

Jackson Gathondu: email privacy@shortsintel.com about this policy or your data. For anything else, see Support.