Privacy Policy

Account Information

• Email address
• Name
• Password (encrypted)
• Organization/workspace name

Usage Data

• Videos created and topics selected
• Feature usage patterns
• Optional survey responses, including how you first heard about GoFaceless
• Device and browser information
• IP address and location (country level)
• Which ad or link brought you to GoFaceless (campaign tags and ad click identifiers from Meta and TikTok)

Photos of People

To put someone into a template or video, you upload photos of them, here or through an AI assistant connected to GoFaceless. These photos show their face.

• We use them only to make the previews and videos you ask for, including reading details such as glasses or hair so the result looks like the person.
• We do not use them to recognise or identify who someone is, and we do not sell them.
• They are shared only with the AI providers listed under Third-Party Services that draw, read, or animate them (image, vision, and video models), to create your result.
• Only upload photos of yourself, or of people who have given you permission.

Payment Information

Payments and subscriptions may be processed by Stripe, the Apple App Store, or Google Play. We do not store your full credit card information on our servers. For store purchases, we receive and retain purchase authority and transaction records needed to verify entitlements, refunds, and reconciliation. Google Play records include the purchase token and its cryptographic digest, linked to the purchasing account and workspace.

How the extension uses source data

The extension shows the source in its user interface and uses it solely to open the source-backed GoFaceless video draft you requested. The information stays in the extension until you click the create action, then it is sent over HTTPS to GoFaceless as part of that draft. Once attached to a GoFaceless session, it follows the same security, retention, access, and deletion rules as your other creative instructions and references.

What the extension does not do

It does not inject scripts into pages, read page bodies, collect cookies or credentials, or monitor browsing in the background. We do not sell extension data or use it for advertising, profiling, creditworthiness, or any purpose unrelated to creating and supporting the requested video draft. Human access is prohibited except with your consent for support, when required for security or law, or after data has been aggregated and anonymized for internal operations.

Information processed

To perform the action you request, we process the creative instructions and references you provide, the connected host and client identity, the selected organization, video session and operation identifiers, approval state, and limited usage and quality information. Tool responses contain only the fields needed to show video progress, review material, the next safe action, and recovery links.

How access is limited

GoFaceless validates the organization, permission profile, current video state, approval, entitlement, and credit rules for every connector action. Agent hosts do not receive provider credentials, GoFaceless access tokens, private system prompts, or internal debug traces. Creating a connection does not authorize social publishing; final video delivery requires separate permission and confirmation.

Third-party host data

The connected AI host may process or retain your conversation and attachment under its own privacy policy. Disconnecting a host stops future GoFaceless access but does not delete copies already retained by that host. Your durable GoFaceless video session remains available in the native product, subject to the retention rules below.

What we access

With your explicit consent through Google's OAuth screen, we request these scopes. The first three are asked when you connect a channel; the fourth only when you turn on YouTube tools, and you can untick any of them on Google's screen:

• youtube.upload — to upload the videos you choose to publish to your channel, at the time you choose.
• youtube.readonly — to read your channel name and avatar, your playlists, the status and public counts (views, likes, comments) of the videos you posted from GoFaceless, their comments, and, if you ask to import your channel, the list of your uploaded videos.
• yt-analytics.readonly — to read YouTube Analytics reports for your channel and the videos you posted from GoFaceless: watch time, audience retention, traffic sources, and the age group, gender and country of your viewers as aggregate percentages. We never receive anything that identifies a viewer.
• youtube.force-ssl — only if you turn on YouTube tools: to add captions to a video you posted, add it to a playlist you pick, change its title, description, tags or privacy when you ask, and post the comment replies you write or approve. We never delete your videos, never post a reply you did not send, and never act on videos GoFaceless did not post unless you ask.

How we use it

We use Google and YouTube data solely to publish videos you explicitly choose to post, to show you their status and performance inside GoFaceless, to carry out the YouTube actions you ask for, and to learn which of your own hooks and formats work best so your next videos improve. When you ask for a suggested comment reply, the comment and your video's details are sent to our AI provider to write the suggestion; you edit and send it yourself. We do not sell it, use it for advertising, transfer it to third parties except as needed to provide the publishing feature, or use it to train AI/ML models. Human access to this data is limited to cases you request (support) or where required for security or law.

Storage and revoking access

Your Google authorization tokens are stored encrypted at rest and are used only to act on your behalf as described above. YouTube Analytics data we keep is refreshed at least every 30 days or deleted, and when you disconnect a channel we delete the YouTube Analytics data stored for it. You can disconnect an account at any time inside GoFaceless, or revoke access directly from your Google Account permissions. Your use of YouTube features is also subject to the YouTube Terms of Service and the Google Privacy Policy.

What we access

• TikTok: user.info.basic lets us read your display name and avatar; video.upload lets us send the videos you select to your TikTok inbox; and video.list lets us read your public video metadata (title, publication date, duration, link, and thumbnail) and available view, like, comment, and share counts. We store this metadata and timestamped metric observations to display your imported videos and their performance history. These public metrics do not include watch time or audience retention. Optional video.publish permission lets us retrieve your current posting permissions and directly post the video you approve, with your chosen privacy, interaction, commercial disclosure, and AI-generated content settings. Direct Post is available only where approved by TikTok and authorized by you.
• Instagram (instagram_business_basic,instagram_business_content_publish,instagram_business_manage_insights): your professional account's ID and username, permission to publish Reels, and view and engagement counts for the posts we publish.
• Facebook Pages (pages_show_list,pages_manage_posts, pages_read_engagement): the list of Pages you manage so you can pick one, permission to publish videos to that Page, and its post links and counts. We never post to a personal profile.
• Threads (threads_basic,threads_content_publish,threads_manage_insights): your profile ID, username and picture, permission to publish posts, and view and engagement counts for the posts we publish.
• X (users.read,tweet.read, tweet.write,media.write, offline.access): your account ID and handle, and permission to upload a video and post it.

How we use it

We use this data only to send or publish the content you choose, to show you the account you connected and the public videos you import, and to show how your posts perform over time. We do not sell it, use it for advertising, share it with third parties except as needed to publish, or use it to train AI models. We never read your direct messages or other people's content.

Storage, disconnecting and deletion

Access tokens are encrypted at rest and refreshed only while the account stays connected. Disconnect an account at any time in your channel's Accounts tab to stop that channel's future publishing. To revoke TikTok access across GoFaceless, use Settings → Connectors → TikTok → Disconnect, or remove GoFaceless from the platform's own settings (TikTok: Settings and privacy, then Security and permissions, then Apps and services permissions; Instagram and Facebook: Settings, then Apps and websites; Threads: Settings, then Account, then Website permissions; X: Settings, then Security and account access, then Apps and sessions). When a platform tells us you removed GoFaceless, we revoke and wipe its tokens at once. To have the profile details we copied from a platform deleted, follow the steps on our data deletion page. Posts already published stay on the platform until you delete them there.