Privacy Policy.

Vertmix Consulting Inc. · Effective October 30, 2026 · Last updated October 30, 2026 · Version 2026-10-30

This policy explains what information Vertmix Studio collects, why, who receives it, how long we keep it, and what you can do about it. We have tried to write it in plain words. If anything is unclear, write to [email protected].

Who we are

Vertmix Studio (“Studio”) is provided by Vertmix Consulting Inc. (“Vertmix”, “we”, “us”, “our”), a company registered in Ontario, Canada.

Studio is an online workspace for teams. It holds people, records, files, tasks, meetings and installable apps, including apps that connect to YouTube, TikTok and Instagram.

Privacy Officer. Our Privacy Officer is accountable for how we handle personal information. For Quebec, the Privacy Officer is our person in charge of the protection of personal information. You can reach the Privacy Officer at [email protected]. We have not appointed a separate data protection officer; the Privacy Officer handles every privacy question.

Contacts.

• Privacy questions, data deletion, rights requests, complaints and legal notices: [email protected].
• Help with Studio, and reports of security problems: [email protected].

What this policy covers

This policy covers:

• our website, studio.vertmix.com;
• the Vertmix Studio app at app-studio.vertmix.com;
• the Vertmix Studio desktop app, and the Vertmix Studio apps for iOS and Android, which show the same app;
• the MCP endpoints, which let an AI client you choose (such as Claude) work in Studio for you, and which our staff use to read and answer Support requests and to read our administration console;
• the emails Studio sends;
• the Growth Partner portal and Support inside Studio;
• the accounts you can sign in with: Google, Microsoft, Discord, or your organisation’s single sign-on;
• the accounts you can connect: YouTube, TikTok, Instagram, Notion and Wise. Each of YouTube, TikTok and Instagram has its own section below.

In this policy, a studio is the shared space your organisation, team or business uses in Studio. The studio’s Owners decide who is in it and what each person may see. A connected account is an account on another service (for example a YouTube channel) that someone in your studio has linked to Studio.

This policy does not cover how YouTube, TikTok, Instagram or other services handle your information on their own sites. Their own privacy policies do.

Your account, and your studio’s content

We play two different roles.

• We decide how to use (we are the “controller” of) your account details, sign-in records, billing details, Support requests, information about how people find Studio, Growth Partner records, and visits to our websites.
• We act for your studio (we are its “processor”) for everything a studio puts into Studio: its records, contacts, files, pages, form responses, meetings, books, jobs and other content. The studio decides what goes in and who sees it. We use that content only to run Studio for the studio, as it directs.

If you want to see, correct or delete something a studio holds about you (for example, you answered a studio’s form, or you are one of its customers), ask that studio. If you write to us instead, we will pass your request to the studio and help it answer.

For data from the accounts you connect, we also follow each platform’s own rules, which are described in the sections on Google user data and YouTube API Services, TikTok and Instagram (Meta).

What we collect, and how

Information you give us

• Your account: first and last name, email address, password (we store only a scrambled form of it, called a hash), and, if you add them, a phone number, a job title and a profile picture.
• Two-factor authentication: if you turn it on, the secret your authenticator app uses and your backup codes, both stored encrypted.
• Your studio: its name, its members and their roles, and, in the create-a-studio wizard, optional answers about your business (industry, team size, your role, main use, and how you heard about us, with a note if you answer “Other”).
• Billing: a billing manager can enter a billing name, billing email, postal address and tax ID. Payments for your Studio plan go through PayPal: for your plan, we never see or store your card or bank numbers.
• Support: your Support requests, messages and attachments. When you write a request, Studio offers to attach technical details (the page you were on, your browser, screen size, language, time zone, app version and recent errors). You can see them, and switch them off, before you send.
• Content: whatever you and your studio put into Studio (see Your account, and your studio’s content).
• Growth Partners: if you apply to be one, your profile (name, photo, bio, region, languages, booking link, website), your application answers, your signature on the partner agreement (its version, your typed name, the time, and a one-way coded version (a keyed hash) of the network you signed from), how you want to be paid (a PayPal email address, or a Stripe account), and the leads and notes you keep in the portal.

You need to give your name and email address to create an account. Everything else is optional, although some features need it (for example, billing details to pay for a plan).

Studio does not ask for health information or other sensitive categories of information (such as racial or ethnic origin, religion or sexual orientation), and it is not designed to hold them. Please don’t put them in Studio unless the law allows it.

Information collected as you use Studio

• Sign-in records (sessions): when you sign in, we record the time, your IP address and your browser (its “user agent”). You can see your sessions, and sign them out, in Account settings → Security.
• Presence and activity: when you were last active, and which record you have open, so people in your studio can see it. We also note which days an account was active in a studio, to count active users.
• Audit trail: who did what in a studio and when (for example, “Ana disconnected a YouTube channel”), with the person’s name. It holds no IP address.
• Notifications we show you in Studio.
• Error reports: when something breaks, the error message, technical details, the page, your browser, the app version and your account ID.
• AI use: which AI feature was used, how much, its cost, and the name of the item it worked on. Your conversations with the assistant are kept so you can return to them.
• MCP tokens: if you make one, a scrambled form (hash) of the token, its first characters, its permissions, when it was last used and when it expires.

Information from services you sign in with

If you sign in with Google, Microsoft or Discord, or with your organisation’s single sign-on, we receive your name, your verified email address, your account ID on that service and, where the service gives one, your profile picture: from Google and Discord at each sign-in (unless you chose your own picture in Studio), and from Microsoft once, when your account is made. We also receive sign-in tokens, which we store encrypted. We do not keep the ID token.

We use this information to sign you in and to show your profile. When an account is made by signing in with one of these services, our sign-up statistics also record which service it was and the domain of the email address (for example “gmail.com”), never the address itself (see How people find Studio).

Your profile picture is not secret: any signed-in Studio account that has the picture’s link can load it.

Information from accounts you connect

When you connect an account, Studio reads from it, and posts to it where you allow. What we read and post is in Google user data and YouTube API Services, TikTok and Instagram (Meta). In short:

• Notion: the pages and databases you choose to share with Studio on Notion’s consent screen, which Studio copies into your studio’s workspaces.
• Wise (used by the Books app): a read-only Wise token you paste in, which Studio stores encrypted, and the profile, balances and transactions (including the names of the people and businesses you paid or were paid by) it reads.

How people find Studio

To understand which campaigns, partners and pages bring people to Studio, we record, for each new account and only in its first 7 days:

• how you signed up (email, Google, Microsoft, Discord or single sign-on) and whether you were invited;
• the campaign that brought you, if the link named one (for example utm_source), and the type of ad click (for example “a Google ad click”), never the click’s ID (our website passes the click’s ID on to Studio in its links, and Studio keeps only its type);
• a Growth Partner code, if you arrived through a partner’s link;
• the domain of the website that sent you, never the full address;
• the page you landed on;
• your country (from your browser’s time zone, or from our network provider), your time zone and your language;
• the domain of your email address and whether it is a personal or work address, never the address itself;
• your device type (phone, tablet or computer).

When a studio is created through a partner’s link, we also keep a one-way coded version (a keyed hash) of the network it was created from, to spot partners who refer themselves.

If you cancel a plan, we keep the reason and any note you choose to give.

If your browser sends a Global Privacy Control signal, see Cookies and storage on your device for what that stops.

Visits to our websites

• studio.vertmix.com sets no cookies, runs no analytics and loads nothing from other companies. Its web server keeps a standard log of each request (IP address, time, page, referring page and browser).
• app-studio.vertmix.com keeps a similar web server log. Studio also counts anonymous visits from browsers that have never signed in: one count per browser session, added to a daily total by the kind of channel that brought the visit (for example a search engine or a campaign) and the first part of the page landed on, with no ID and no cookie. Studio does not count your visit when your browser sends a Global Privacy Control signal. Cloudflare also counts page views for us, without cookies (Cloudflare Web Analytics); that count does not change with Global Privacy Control.
• The Contact us link on our website opens a booking page run by Microsoft (Microsoft Bookings). If you book a call there, Microsoft receives what you enter, for us.

The desktop and phone apps

The desktop app and the iOS and Android apps show the same Studio app and add no tracking or analytics of their own. The phone apps ask for your camera, microphone or photos only when you use a feature that needs them, such as a meeting or an upload.

Google user data and YouTube API Services

Vertmix Studio uses YouTube API Services. By connecting a YouTube account or using Vertmix Studio’s YouTube features, you agree to be bound by the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

Limited Use. Vertmix Studio’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

“Google user data” in this section means information we receive from Google’s APIs: from signing in with Google, from a YouTube channel you connect, and from public YouTube data we read.

What we access, and why

When you sign in with Google (the openid, email and profile permissions): your name, email address, profile picture and Google account ID. We use them to sign you in and to show your profile. When your account is made by signing in with Google, our sign-up statistics also record that it was made with Google and the domain of your email address, never the address itself.

When you connect a YouTube channel, you choose in Studio’s Connect dialog, and again on Google’s consent screen, which of these Studio may use (it always needs the first):

We do not ask for access to your channel’s revenue.

The reach report. When you choose a second thumbnail to test, Studio asks you to agree to the test and keeps your agreement with that content. A test starts only on content that has it. The first test on a channel asks YouTube to create a reach report (a YouTube Reporting API job) on it. Studio reads your videos’ thumbnail impressions from it. We delete the report when the channel is disconnected, unless it is still connected in another studio.

Public YouTube data read with our own key. When someone in your studio pastes a link to a YouTube channel or video in Compilations or Stitch and does not use a connected channel, Studio reads that channel’s public details and its videos’ public details (titles, descriptions, thumbnails, publish dates, durations and view, like and comment counts) with Vertmix’s own YouTube API key.

No downloads. Vertmix Studio no longer downloads videos or audio from YouTube. To work with a video’s footage, Compilations and Stitch use a file someone in your studio uploads or chooses from the Drive. Video files a studio downloaded from YouTube before stay in its Drive as its own files until the studio deletes them. Studio does not publish those files to YouTube, TikTok or Instagram.

How we use it

We use Google user data only to provide the features you see in Studio and described above, and, for the sign-in details only, for the sign-up statistics described above. We do not use it, or transfer it, for anything else. In particular:

• We do not use Google user data for advertising, including retargeting, personalised or interest-based ads.
• We do not sell Google user data, and we do not transfer it to advertising platforms, data brokers or information resellers.
• We do not use Google user data to decide whether someone is creditworthy, or for lending.
• We do not use Google user data to train generalised AI or machine-learning models. When an AI feature works with it, the request tells OpenRouter not to send it to AI providers that train on or collect the data they are sent (see AI features).
• No person at Vertmix reads your Google user data unless you ask us to in a Support request about it and agree, it is needed for security (for example, to investigate abuse), the law requires it, or it has been combined and made anonymous for our internal operations.

Where it is stored, and who sees it

Google user data is stored in our database and file storage, and the tokens that let Studio reach your channel are encrypted. The tokens never reach your browser.

People in your studio. A channel you connect starts shared with everyone in your studio (except people on its Customer role): they can see its data and use it in the studio’s apps, including to publish to it. The person who connected it, the studio’s Owners and anyone whose role lets them manage connected accounts can narrow that to teams or named people at any time, in Studio settings → Connectors → the channel’s ⋯ menu → Share…. The Owners, and anyone whose role manages connected accounts, can always see and use it. If your studio lets its Growth Partner in (Studio settings → Partner), the partner works in the studio like a member, so a channel shared with everyone in the studio is shared with the partner too. Share the channel with teams or named people to keep it from the partner.

Service providers. Google user data is stored by our cloud hosting provider (and, for the profile picture copied from Google, by Wasabi) and carried by Cloudflare. Our email delivery provider sends notifications that name your channel, and OpenRouter receives it only when you ask an AI feature to work with it (see AI features). They are listed in Who we share it with.

YouTube. What you publish goes to YouTube.

Revoking access

You can stop Studio’s access to your YouTube data in two ways:

• In Studio: Studio settings → Connectors → the channel’s ⋯ menu → Disconnect. Studio deletes the saved sign-in at once and asks Google to revoke the access. If the same channel is still connected in another studio, Studio does not ask Google to revoke the access, so that studio keeps working, and removes only this studio’s connection.
• At Google: in addition to Studio’s own Disconnect, you can revoke Vertmix Studio’s access to your data at any time on the Google security settings page.

How long we keep it

• Saved sign-in (tokens): deleted at once when you disconnect, or when we find that the access was revoked.
• Everything we copied from your channel: deleted within 7 days after you disconnect it, ask us to delete it, or delete your Studio account, apart from Studio’s own logs (below).
• Access revoked at Google: we check every connected channel once a week. When Google tells us the access is gone, we remove the connection at once and delete what we copied within 7 days, so within 30 days of your revoking it at the latest.
• Your channel’s own statistics: Creators keeps the daily numbers YouTube reports for the videos you published through Studio (views, watch time, likes and the like) for as long as the channel stays connected. YouTube allows an app to keep a channel’s own statistics while it re-checks, at least every 30 days, that the channel still authorises it. We re-check every week.
• All other data Studio reads from YouTube’s API, including your channel’s name and details, the details of your videos (those you published through Studio included), and public data read with our own key: refreshed from YouTube, or deleted, within 30 days of when we read it, apart from Studio’s own logs (below).
• Studio’s own logs: a few records keep a channel’s name or a video’s title (and, for old downloads, a video’s YouTube ID) as it was when they were written. They are not refreshed from YouTube, and a disconnect does not remove them. An automation’s approval request can name the channel it will publish to, as the record of what a person approved (Studio’s publishing template does): it is kept with its run for 90 days, and the notification asking for it until 90 days after it is read. A Stitch named after its channel is called that in its notifications, which stay until 90 days after they are read. Files and folders an app filed in your studio’s Drive under a channel’s name or a video’s title (such as Compilations’ review folders, or the finished video of a Stitch named after its channel) are your studio’s files and keep that name until your studio renames or deletes them; the audit-trail lines and AI usage records about them keep it for 400 days, and Studio’s record of the render that made such a file keeps it until the studio is deleted. Studio’s records of the downloads it made from YouTube before 30 October 2026 keep each video’s title and YouTube ID, and the folder it was filed in, which can carry the channel’s name, until the studio is deleted; Studio uses them to refuse to publish those files. Assistant conversations keep what the assistant showed until you delete them. Lines written before 30 October 2026 can keep the names and titles they were written with, for as long as each is kept: the audit trail for 400 days, the history lines on a record as long as the record, notifications until 90 days after they are read, Studio’s internal record of what apps did for 400 days, and automation records for 90 days.

What stays after a disconnect is your studio’s own work: its content, the files it uploaded, the record that a piece of content was published (without the channel’s name or YouTube’s ID and link for it), and which thumbnail a test kept. Lines in the studio’s audit trail stay for 400 days; within 7 days of a disconnect, Studio removes the channel’s name from the lines about the connection itself, so they say only that it was a YouTube channel. Studio’s own logs, above, also stay.

Changes, and questions

If we ever want to use Google user data in a way this policy does not describe, we will update this policy and ask you to agree again in Studio before we do. Questions or complaints about how we handle YouTube or other Google user data: [email protected].

TikTok

When you connect a TikTok account, Studio asks TikTok for two permissions, and nothing else:

We do not ask for your follower and like counts, your list of videos, or permission to send drafts. An account connected before 30 October 2026 may also have granted Studio permission to send drafts. Studio no longer uses it. To withdraw it, remove Vertmix Studio in TikTok’s settings (see below) and connect the account again.

How we use it. Only to show your connected account and to post the videos you choose, as you choose. The video goes to TikTok only from Creators’ TikTok post screen (in its Publish and Schedule dialogs): when you press Publish there, or at the time you chose there with Schedule, after Studio checks your TikTok settings again. Only the person who connected a TikTok account can post to it. Automations, the assistant, MCP clients and other people in your studio cannot post to it. People you share the account with can see its posts’ progress.

What we never do. We never sell TikTok data. We never use it for advertising or to build profiles of anyone, and we never share it except with the people in your studio the account is shared with (at first everyone in the studio, until the person who connected it or an Owner narrows it; they can see the account and its posts’ progress, but cannot post to it), the service providers who run Studio for us (see Who we share it with), and authorities when the law requires it. No AI feature in Studio reads data from your TikTok account.

Where it is stored. In our database and file storage. Tokens are encrypted and never reach your browser.

Removing access.

• In Studio: Studio settings → Connectors → the account’s ⋯ menu → Disconnect. Studio deletes the saved sign-in at once and asks TikTok to revoke the access, unless the same account is still connected in another studio.
• At TikTok: in TikTok’s settings, under Security and permissions → Manage app permissions, remove Vertmix Studio. TikTok tells us, and Studio removes the connection.

How long we keep it. While the account is connected. Within 7 days after you disconnect it, remove Studio at TikTok, ask us to delete it, or delete your Studio account, we delete everything Studio copied from it, including the account’s name and TikTok’s IDs and links for its posts, apart from Studio’s own logs. Your studio keeps its own content and the record that it was published.

Instagram (Meta)

Studio connects only Instagram professional accounts (Business or Creator). When you connect one, Studio asks Instagram (Meta) for two permissions:

We do not ask for permission to read your posts’ insights (views and reach), and Studio does not read them. An account connected before 30 October 2026 may also have granted Studio permission to read views and reach. Studio no longer uses it. To withdraw it, remove Vertmix Studio at Instagram (see below) and connect the account again.

How we use it. Only to show your connected account and to publish what you choose, as you. Studio posts only when a person in your studio tells it to: when someone who may use the account presses Publish or Schedule in Creators, or when a person approves a post that an automation or agent has prepared. Nothing is sent before that approval; in Studio’s publishing template, the approval shows what will be published and to which account.

What we never do. We never sell, license or buy Instagram data, and we never use it for advertising. We do not use it to make decisions about people’s eligibility for anything (such as housing, jobs, insurance or credit), for surveillance, or to discriminate against people, and we never try to re-identify anonymised data. We keep pages that could show it, such as shared links and public forms, out of search engines. No AI feature in Studio reads data from your Instagram account.

Where it is stored, and who sees it. In our database (at our cloud hosting provider) and file storage (Wasabi), with tokens encrypted; Wasabi also serves the private, time-limited link Instagram fetches your reel or photo from. Our service providers are listed in Who we share it with. The account starts shared with everyone in your studio (except people on its Customer role), who can see it and post to it; the person who connected it, the studio’s Owners and anyone whose role manages connected accounts can narrow that with Share… in the account’s ⋯ menu.

Removing access, and deleting your data.

• In Studio: Studio settings → Connectors → the account’s ⋯ menu → Disconnect. Studio deletes the saved sign-in at once. Instagram does not let an app withdraw its own access, so also remove Vertmix Studio at Instagram.
• At Instagram: open Apps and websites in your Instagram settings and remove Vertmix Studio. Meta tells us, and Studio removes the connection at once.
• Ask Meta to have your data deleted: if you send a deletion request through Instagram, Meta passes your request to us, and Instagram shows you a confirmation code and a link from us. You can follow the deletion at https://app-studio.vertmix.com/connectors/deletion/<code> (put your code in place of <code>), without signing in.
• Or write to [email protected]. Our data deletion instructions explain every way.

How long we keep it. While the account is connected. Within 7 days after any of the steps above, or after you delete your Studio account, we delete everything Studio copied from the account, apart from Studio’s own logs. Your studio keeps its own content and the record that it was published.

Why we use it, and our legal bases

Where the law asks us to name a legal basis (for example the GDPR in the European Economic Area and the UK GDPR in the United Kingdom), these are ours:

Our legitimate interests are: running a secure and reliable service, understanding which campaigns and partners bring customers so we spend sensibly, paying partners accurately, helping studios through their Growth Partner, and improving Studio. We do not rely on them where your rights outweigh them. You can object, as explained in Your rights.

In Canada, we rely on your consent, given when you create an account (or, if we made it for you, when you first sign in) after reading this policy, for the uses needed to provide Studio. For uses that are not needed to provide Studio (recording how you found Studio, and showing your studio to its Growth Partner), you can say no at any time without leaving Studio: write to [email protected], and we clear the campaign, ad-click, referring-site and partner details we recorded about how you found Studio, or remove your studio’s Growth Partner. A Global Privacy Control signal also stops our websites from keeping or sending the campaign, ad-click, referring-site and partner details of your visit. You can withdraw the rest of your consent by disconnecting an account or by deleting your account, subject to legal and contractual limits (for example, we must keep tax records).

For content a studio puts into Studio, the studio decides the legal basis, because we act for it.

AI features

AI features send the content you ask them about through OpenRouter. Studio’s AI features run through OpenRouter, Inc., a service in the United States that passes each request to an AI model provider and returns its answer. That includes:

• what you type to the assistant, and the records, pages, files and app results it reads to answer you;
• AI steps in automations and agents your studio sets up;
• apps’ AI features, such as Clips, Cuts, Frame’s reviews, Compilations’ search and Books’ categorising and invoice drafts;
• summaries and sorting of form responses;
• turning speech into text (the audio is sent), where transcription is switched on for your studio (it is off unless Vertmix switches it on for your studio); this covers meeting recordings, Frame’s spoken reviews, and the videos Clips, Cuts, Frame’s automatic reviews and Compilations work on;
• meeting transcripts, summaries and action items;
• search indexes (called embeddings) made from transcripts, so you can search by meaning;
• drafts our Support staff ask for when answering your Support request, which send the request’s conversation.

Not for training. On every chat request (including the assistant’s tool steps) and every search-index request, Studio tells OpenRouter not to send it to AI providers that train on or collect the data they are sent (OpenRouter’s data_collection: "deny" setting). Speech-to-text requests cannot carry that instruction, so which provider turns your audio into text follows our OpenRouter account’s privacy settings. We do not use your content to train AI models. Some apps can learn from your studio’s own choices (for example, Frame’s review examples); that learning stays inside your studio and is off until your studio turns it on.

What goes with a request. Only the content the feature needs. We do not attach your account ID. The content itself may contain names or other personal information, if they are in what you asked about.

What we keep. Stored AI answers are deleted after 14 days (we keep them so a retried request is not paid for twice). AI usage records and assistant conversations are kept as set out in How long we keep it.

Switching it off. Vertmix switches AI features, and transcription separately, on or off for each studio. Both are off unless we have switched them on for yours. A studio’s Owners can ask us to switch either off at [email protected]. Inside a studio, an app’s own AI settings, such as Frame’s automatic reviews and learning, can be turned off in that app.

YouTube, TikTok and Instagram data. No Studio feature sends data from YouTube, TikTok or Instagram to an AI provider on its own:

• No AI feature reads from your TikTok or Instagram account. The assistant and automations can see what Creators shows you about a post, such as its status and link.
• YouTube data reaches an AI feature only when someone asks for it: when you ask the assistant, or an AI client you connected through MCP, to run an app action that reads YouTube data (for example, Compilations’ “Connect a YouTube channel”), that action’s answer goes to the AI so it can answer you; an automation someone in your studio built can do the same with such an action and a later AI step; and when you run a Cut, the channel facts you chose to put in its brief go with it.
• The one background process that works on a channel’s videos is Compilations’: it transcribes and indexes the video files in a library, through OpenRouter, so you can search them. These are files someone in your studio uploaded or chose from the Drive. Studio no longer downloads videos from YouTube; video files a studio downloaded before stay in its Drive as its own files until the studio deletes them. YouTube’s titles, descriptions, statistics and analytics are not part of what it sends.

AI clients you connect. If you connect an outside AI client through an MCP token, it receives whatever you ask it to read in Studio, and its own provider’s terms apply to that.

AI answers can be wrong, so check them before you rely on them.

Who we share it with

We share personal information only as described here. We do not share personal information with related companies.

• People in your studio, as the studio’s roles and sharing settings allow.
• Your studio’s Growth Partner, if your studio has one (because it signed up through the partner’s link or code, or because we asked a partner to look after it). In its partner portal, the partner sees your studio’s plan, billing standing and the payments it earns commission on, a health score worked out from your studio’s activity and use, its onboarding progress, and your studio’s Support requests, which the partner can answer. The partner can enter your studio only if someone who manages it lets it in (Studio settings → Partner → “Allow my partner to access this studio to help me”), and they can turn that off at any time. Once in, the partner sees what its role in your studio (Growth partner) allows, including connected accounts shared with everyone in the studio; your studio can narrow that role on its Roles page. The partner agreement requires partners to keep what they see in your studio confidential. To stop the partner seeing your studio’s information in its portal, Support requests included, write to [email protected] and we remove the partner from your studio.
• The platforms you connect, when Studio reads from them or posts to them for you.
• Places your studio sends data: webhooks, “Call a URL” automation steps, form webhooks, and AI clients connected through MCP tokens. Your studio chooses these.
• Service providers who run parts of Studio for us, listed in the table below.
• Professional advisers, such as lawyers and accountants, who must keep it confidential.
• Authorities, when the law requires it, or to protect someone’s safety.
• A buyer or successor, if Vertmix is merged, sold or reorganised. Google user data would move only with your prior consent.

Service providers (sub-processors)

Our service providers may use the information only to provide their service to us, under written terms that require them to protect it. One exception: Studio turns addresses into map positions with the OpenStreetMap Foundation’s public service (Nominatim), under that service’s published usage and privacy policies, not a contract with us; Studio sends it only the address text, with no name or account.

We update this table before a new service provider receives personal information. The services you connect (YouTube, TikTok, Instagram, Notion and Wise) and the services you sign in with (Google, Microsoft, Discord, single sign-on) are not our service providers: you choose them, and their own terms apply.

We do not sell your information

We do not sell personal information, and we do not use data from Google, YouTube, TikTok or Instagram for advertising.

We also do not share personal information for cross-context behavioural advertising (advertising based on your activity on other sites and apps).

No third-party ads

We do not show ads in Vertmix Studio, and we do not let advertisers or other third parties place ads or their own content in it. Your browser does load some things from other companies while you use Studio; they are all listed under “Content your browser loads from others” in Cookies and storage on your device.

Cookies and storage on your device

Studio’s cookies are all needed for it to work. Studio and our website also keep a few items in your browser’s storage that are not needed for it to work: the campaign and partner details that brought you, and notes that keep an anonymous visit or a sign-up from being counted twice. If your browser sends a Global Privacy Control signal, Studio and our website don’t keep or send the campaign and partner details, and Studio does not count your visit. We do not use advertising cookies, and we do not use cookies to track you across other sites.

Cookies on app-studio.vertmix.com

On https, the better-auth.* cookie names start with __Secure-.

Other storage on your device in Studio

Studio also keeps some information in your browser’s storage (“local storage” and “session storage”):

The desktop and phone apps keep the same information inside the app.

Storage on studio.vertmix.com

Our website sets no cookies. It keeps two items in your browser’s local storage:

Content your browser loads from others

• Cloudflare Web Analytics (on app-studio.vertmix.com): a small script that counts page views without cookies.
• Your studio’s files, which your browser sends to and fetches from our file storage at Wasabi directly. Wasabi sees your IP address.
• Our video meeting server, when you join a meeting.
• Map pictures from OpenStreetMap (tile.openstreetmap.org), when you view a map. The OpenStreetMap Foundation sees your IP address and the area you view.
• Pictures from YouTube, TikTok and Instagram, such as video thumbnails and profile pictures, which your browser loads from those services’ servers. Those services see your IP address.
• Pictures and media at other addresses that someone in your studio puts into a page, record or form, which your browser loads from wherever they are.
• Sign-in pages of Google, Microsoft and Discord, which set their own cookies on their own sites.

Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, our websites don’t keep or send sign-up attribution (campaign, ad-click, referrer or partner details) for that visit, and Studio does not count the visit. It does not stop Cloudflare’s page-view count. Vertmix Studio still records your time zone and language, which it needs to show times correctly, and, when you create an account, the other sign-up details listed in What we collect, and how (such as how you signed up, your email’s domain, your country and your device type).

There is no common standard for “Do Not Track” signals, so our websites do not respond to them; we honour Global Privacy Control as described above. Apart from the services listed under “Content your browser loads from others”, which see your IP address and the page that asked for the content, we do not allow other companies to collect personal information about your activity over time and across other websites through our websites.

How long we keep it

We keep information only as long as we need it for the purposes in this policy, then delete it or make it anonymous. Studio does most deleting with scheduled jobs; where a row below gives a time limit, Studio enforces it. When this policy says something is deleted, it is deleted from Studio at that time. If a backup we keep to recover from a failure holds a copy, that copy remains until the backup is replaced.

Disconnecting and deleting

Disconnect a connected account

Studio settings → Connectors → the account’s ⋯ menu → Disconnect. Studio deletes the saved sign-in at once, asks Google or TikTok to revoke the access (Instagram does not let an app do this, so remove the app at Instagram too), and deletes everything it copied from a YouTube, TikTok or Instagram account within 7 days, apart from Studio’s own logs. If the same YouTube or TikTok account is still connected in another studio, Studio leaves the platform’s permission (and a YouTube channel’s reach report) in place for that studio and removes only this studio’s connection. Pages imported from Notion, and the bookkeeping the Books app made from Wise, are your studio’s own content and stay until the studio deletes them.

What stays after disconnecting YouTube, TikTok or Instagram is your studio’s own work: its content, its files, the record that content was published (without the account’s name or the platform’s ID and link for it), and which thumbnail a test kept. Lines in the studio’s audit trail stay for 400 days; within 7 days of a disconnect, Studio removes the account’s name from the lines about the connection, so they say only which platform it was, and lines about an app’s records name only the kind of record. The few names and titles Studio’s own logs keep also stay.

Remove Studio at the platform

• Google and YouTube: the Google security settings page.
• TikTok: TikTok’s settings → Security and permissions → Manage app permissions.
• Instagram: Apps and websites in your Instagram settings.

TikTok and Meta tell us when you do this. For Google, we check every connection once a week (and every TikTok and Instagram connection too). Either way, when we learn the access is gone, Studio removes the connection at once and deletes what it copied within the next 7 days.

Delete your Studio account

Account settings → Profile → Delete account, or Delete account on the screen that asks you to agree to the Terms. We email you a link; nothing is deleted until you open it in a browser where you are signed in to that account (on a phone, sign in at app-studio.vertmix.com in your phone’s browser first, then open the link there). Opened anywhere else, it deletes nothing and still works for its day. You don’t need a password, so accounts that sign in with Google or single sign-on can be deleted too. If you are the last Owner of a studio that other people still use, Studio asks you to make someone else an Owner first, because a studio with no Owner cannot be run.

Deleting your account deletes, at once: your account, sessions, linked sign-in methods, two-factor authentication, studio memberships, MCP tokens, profile pictures, the days your account was active, the record of how you arrived (how you signed up, the campaign, referring site and landing page, your country, time zone, language, email domain and device), and every studio nobody else is in (apart from its Growth Partner), with all its content. It removes every account you connected in studios that continue, and deletes what Studio copied from a YouTube, TikTok or Instagram account within 7 days, apart from Studio’s own logs. The answers you gave in the create-a-studio wizard about the business belong to that studio’s sign-up profile and are kept, with the ID your account had but without your name or email address; your own role, which you gave there too, is deleted with your account.

What stays:

• content you made in studios that continue (it belongs to those studios), including assistant conversations you did not delete;
• audit lines with your name, for up to 400 days;
• your Support requests, without your name or email address, unless you ask us to delete them;
• Growth Partner earnings, payouts and statements, and payment records, for tax;
• anonymous visit counts, and coded sign-up and cancellation events that carry no name or email address.

Delete a studio

A studio’s Owners, and anyone whose role lets them manage the studio, can delete it in Studio settings → Danger zone, once its paid plan has ended. This deletes everything in the studio, including its files, and removes its connected accounts as Disconnect does. We keep the studio’s Support requests, its payment records and subscription history, its partner’s earnings, its audit trail for up to 400 days (including a line saying it was deleted), and its sign-up profile: how it came to Studio and its answers about the business (industry, team size, main use and how it heard about us). The sign-up profile is kept as part of our business records; it keeps the ID of the account that created the studio and any note typed in the wizard, but no name or email address field.

Ask us by email

Write to [email protected] from the email address on your account, and say what you want deleted. It is free. We delete data from Google, and data copied from a connected YouTube, TikTok or Instagram account, within 7 days after we have confirmed the request is yours, and act on any other deletion request within 30 days. If a studio holds the data, we pass your request to that studio within 7 days and tell you we did. Our data deletion instructions gather all of these steps on one page.

Your rights

Everyone

Wherever you live, you can ask us to:

• tell you what personal information we hold about you, and give you a copy;
• correct it;
• delete it;
• give it to you in a structured, common, machine-readable format so you can take it elsewhere.

You can do much of this yourself: edit your profile in Account settings, export a database view as CSV, download Drive folders as a zip, export form responses, disconnect accounts and delete your account. For a copy of the personal information we hold about you as an account holder (your profile, sign-in history, Support requests, billing and sign-up details), write to [email protected]. We send it in a common format (JSON or CSV) within 30 days, or, where the law allows, tell you within that time why we need longer.

To protect you, we answer requests sent from the email address on your account, or we ask you to confirm the request from inside Studio. Requests are free, unless they are clearly unfounded or excessive.

Requests about content a studio holds go to that studio (see Your account, and your studio’s content).

Canada and Quebec

You may access and correct your personal information, withdraw consent, and challenge how we comply with the law. We answer within 30 days. Under Canada’s federal privacy law we may extend that by up to 30 days when the law allows; if we do, we tell you within the first 30 days, with the reason and your right to complain to the Privacy Commissioner of Canada about the extension. In Quebec, you can also ask for computerised information about you in a structured, commonly used technological format, or ask us to send it to another organisation; and you can ask us to stop spreading information about you, or to de-index a link to your name, where the law allows.

European Economic Area, United Kingdom and Switzerland

You have the rights of access, correction, erasure, restriction, portability and objection. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. We answer within one month. If a request is complex, we may extend that by up to two more months, and we will tell you why within the first month.

Your right to object. You can object at any time to our use of your information based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the information to establish, exercise or defend legal claims. You can always object to direct marketing, and we will then stop using your information for it. To object, write to [email protected].

California and other US states

Depending on your state, you may have the right to know what personal information we collect, use and disclose, to get a copy, to correct it, to delete it, and to opt out of its sale, of sharing for targeted advertising, and of profiling. We do not sell personal information or share it for targeted advertising, and we do not profile people in ways that have legal or similarly significant effects. We use sensitive information (your sign-in details) only to sign you in and to protect your account. We will not treat you differently for using your rights.

In the past 12 months we collected these categories, from you, from your use of Studio, and from the services you sign in with or connect: identifiers (name, email address, IP address, account IDs); customer records (billing name, address and tax ID); commercial information (plan and payments); internet activity (sessions, pages viewed, how you found Studio); a general location (your country); audio and video (meeting recordings and the videos you upload); professional information (job title); and sign-in details. We disclose them only for the business purposes in this policy, to the recipients in Who we share it with.

We answer within 45 days, and may extend that once by 45 days if we tell you. You can make a request through an authorised agent; we will ask the agent for your signed permission and may ask you to confirm your identity. If we decline your request, you can appeal by replying to our answer with the word “Appeal”. We answer appeals within 45 days. If you are not satisfied, you can contact your state’s Attorney General.

Complaints to a regulator

You can complain to us first (see Contact us, and complaints), or to a regulator at any time:

• Canada: the Office of the Privacy Commissioner of Canada.
• Quebec: the Commission d’accès à l’information.
• United Kingdom: the Information Commissioner’s Office.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
• European Economic Area: the data protection authority in the country where you live or work, or where you think the problem happened.

International transfers

Vertmix is in Canada. The European Commission and the United Kingdom recognise Canada as giving adequate protection to personal information handled under PIPEDA, Canada’s federal privacy law. We store Studio’s data with our cloud hosting provider, in the country shown in Service providers, and its files with Wasabi in Virginia, United States. AI requests go to OpenRouter in the United States and to the AI providers it chooses, mostly in the United States. Information stored in another country may be accessible to that country’s courts, law-enforcement and national-security authorities.

When personal information about people in the European Economic Area, the United Kingdom or Switzerland goes from us to a service provider in a country without an adequacy decision, such as the United States, we rely on the provider’s certification under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) or on standard contractual clauses in our agreement with it. Write to [email protected] for details of the safeguard for a provider.

Security, and reporting a vulnerability

We protect your information with:

• encrypted connections (TLS) everywhere, with HTTP Strict Transport Security;
• each studio’s data kept apart in our database by row-level security, so one studio’s requests cannot read another’s;
• roles and permissions inside each studio, and an audit trail of who did what;
• tokens for connected accounts encrypted with AES-256-GCM, and never sent to your browser;
• sign-in tokens from Google, Microsoft, Discord and single sign-on encrypted;
• passwords stored only as hashes (scrypt);
• optional two-factor authentication with an authenticator app, with backup codes;
• limits on repeated attempts at sign-in and other sensitive actions;
• a record of each time our staff use View as, and of what staff change (see When our staff see your data).

No system is perfectly secure. If a breach of security puts you at real risk of significant harm, we will tell you, and the authorities, as the law requires.

Report a vulnerability. If you find a security problem in Studio, email [email protected] with the details. Please give us a reasonable time to fix it before telling anyone else, and do not access other people’s data while testing.

How we govern personal information

Our Privacy Officer is responsible for our privacy rules and has approved them. In summary:

• Keeping and destroying. We keep information only for the periods in How long we keep it, then delete it or make it anonymous.
• Who may see it. Only staff who need it for Support, security, billing or the law, through the Support desk, our administration console and View as, each opened by a permission on the staff member’s role. What they change is recorded, and so is each View as visit.
• Platform data. Data from Google, YouTube, TikTok and Instagram is used only as this policy and those platforms’ rules allow.
• Service providers. A service provider receives personal information only under written terms that protect it (or, for the public address lookup, under its published policies), and only after we list it in this policy.
• Assessments. Before we start a new system that handles personal information, or send personal information outside Quebec, we assess the privacy risks.
• Incidents. We keep a record of every privacy incident. We notify the people affected and the authorities when the law requires it.
• Complaints. We acknowledge a complaint within 30 days, look into it, tell you the outcome, and tell you how to take it to a regulator.

When our staff see your data

• Support desk. When you write to Support, our Support staff see your request, its attachments and the technical details you chose to send, your name, your studio’s plan and billing standing, and the errors you met in that studio from a week before your request on (their message and how often; only an administrator can open an error’s technical trace). They do not see your studio’s workspaces, files or records through the desk.
• View as. A staff member whose role holds a specific permission can sign in as your account for up to one hour. They then see what you would see in Studio, including the data of connected YouTube, TikTok and Instagram accounts that are shared with you. The start and end of each visit are recorded on our own audit trail, and what they change in your studio is recorded in its audit trail under their own name. A visit cannot change your password, sign-in methods, email address, billing or MCP tokens, cannot connect an account, delete a studio or join a meeting, never lets a Growth Partner into your studio, and cannot post to TikTok.
• Google user data. No person at Vertmix reads your Google or YouTube data unless you ask us to in a Support request about it and agree, it is needed for security, the law requires it, or it has been combined and made anonymous.
• Administration. Our administrators can see accounts, studios, billing details (never card numbers), the information about how people found Studio, AI usage and error reports, to run the service. Staff can read the Support desk and these figures, and answer Support requests, through our own MCP tokens, within the same permissions.

Children

Vertmix Studio is a business tool for adults. You must be 18 or older, and of the age of majority where you live, to use it. It is not directed to children, and we do not knowingly collect personal information from children under 13, or under the age of digital consent where they live. If we learn we have, we will delete it. Contact [email protected] if you believe a child has given us information.

Automated decisions

We do not make decisions about you that have legal or similarly significant effects based only on automated processing. Studio’s AI features suggest and draft; a person decides. Dispatch’s route planner proposes routes, and a person in the studio reviews and publishes them. Checks on Growth Partner referrals raise flags that a person at Vertmix reviews.

Meetings, recordings and transcripts

If your studio uses Meetings:

• During a meeting, participants’ audio, video, screen sharing and chat pass through our video meeting server. Studio keeps the chat, and records who joined and left, and when. Guests from outside the studio give their name and email address.
• A meeting is recorded only if it was scheduled with recording on. A recording includes each person’s microphone as a separate track. The video server’s copy is deleted once the recording moves to your studio’s Drive.
• Transcripts are made only where transcription is switched on for your studio (it is off unless Vertmix switches it on for your studio). The audio is sent through OpenRouter to be turned into text. Each line is named after the person whose microphone it came from; Studio does not recognise faces or voices.
• AI summaries and action items are made through OpenRouter.
• The meeting room is deleted a day after the meeting. Recordings, chat and transcripts stay as studio content until the studio deletes them.

The studio is responsible for telling participants about recording and transcription, and for getting any consent the law requires.

Email from us

Studio sends emails you need to use it: email checks, password resets, sign-in and deletion links, invitations, notifications, Support replies, form receipts and messages your studio’s apps send. They come from [email protected] through our email delivery provider. They contain no tracking pixels or remote images. Each one says why you got it, and each one, except a message that carries a one-time code (such as a form’s email check), links to this policy and our Terms of Service.

Messages your studio’s apps, forms and automations send are your studio’s messages; your studio is responsible for having the consent the law requires to send them.

We do not send marketing email today. If we start, we will send it only as the law allows, identify Vertmix Consulting Inc. with our mailing address, and include an unsubscribe link that takes effect within 10 business days.

Changes to this policy

When we change this policy, we change its version and its effective date at the top. When a change matters to you, we tell you before it takes effect, by email or in Studio, and Studio asks you to agree to the new version on one screen the next time you sign in, and records which version you agreed to and when. We never start using Google user data in a new way before you have agreed to a policy that describes it.

Version history

• 2026-10-30: first version.

Contact us, and complaints

• Privacy questions, rights requests, deletion and complaints: our Privacy Officer, [email protected].
• Help with Studio, and security reports: [email protected].

If you are unhappy with how we handled your information, write to [email protected] first. We acknowledge every complaint within 30 days, look into it, and tell you what we found and did. If you are still not satisfied, you can go to a regulator, as listed in Your rights. In the United Kingdom, you can complain to us first and then to the Information Commissioner’s Office.