This Privacy Policy describes how Octaneon ("Octaneon", "we", "us", or "our") collects, uses, and discloses information when you use the Octaneon control plane and related services (the "Service"). Octaneon is a human-in-the-loop content operations platform. Auto-generate and auto-post are off by default; every public action requires an authorized operator.
The Service is operated by CoreSpeed LLC, 10145 Prattville Avenue, Las Vegas, NV 89148-5501, United States. References to "Octaneon" in this policy mean CoreSpeed LLC acting as the operator of the Service.
1. Information we collect
Account information
When you sign up we collect your email address, display name, avatar (if provided by your identity provider), and authentication metadata such as email-verification timestamps.
Brand and workspace information
Operators associate themselves with one or more brands. For each brand we store the brand name, timezone, roles, invitations, and configuration you provide.
Connected-source data
With your explicit authorization, Octaneon connects to third-party services (YouTube, Meta / Facebook / Instagram, X, TikTok, Google Analytics 4, WordPress, Postmark inbound email, and others). For those connections we store:
- OAuth access and refresh tokens, encrypted at rest.
- Account identifiers, handles, and granted scopes.
- Content and metrics you asked us to ingest (videos, transcripts, comments, posts, analytics, emails, uploaded documents).
Usage and diagnostics
We record limited diagnostic information (request timestamps, error logs, feature usage) to operate, secure, and improve the Service.
2. How we use information
- To provide the Service, including brand voice ingestion, content generation, analytics, and human-approved publishing.
- To authenticate operators and enforce role-based access.
- To send transactional messages (verification, invitations, security notices).
- To detect abuse and secure the Service.
- To improve the Service, always subject to your instructions and applicable law.
3. Sharing and disclosure
We do not sell personal information. We share information only:
- With subprocessors that operate the Service under contract (cloud hosting, database, AI inference, transactional email, and analytics providers).
- With Windsor.ai, our metrics subprocessor, which receives Facebook and Instagram Page-level performance data for the accounts you connect. Windsor caches that data rather than storing it, and their copy is removed when the connection is unlinked.
- With third-party platforms you have explicitly connected, only as needed to fulfil your requested action (for example, publishing an approved post).
- When required by law, subpoena, or lawful government request.
- In connection with a merger, acquisition, or sale of assets, with notice to affected users.
4. Facebook / Meta Platform data
When you connect a Meta account, Octaneon requests only the permissions needed to operate the features you enable (for example, pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, and instagram_manage_comments). Platform data received from Meta is used only to provide the Service to you, is not sold or transferred to data brokers, and is stored subject to the retention rules in this policy. To request deletion of your Meta-derived data, see our User Data Deletion page.
Deleting your Meta data removes your identifiers and ends our access under your authorization. It does not prevent a different administrator of the same Page from connecting it later and re-importing that Page’s content under their own authorization; your account identifiers are not restored by that import.
5. YouTube and Google user data
Octaneon uses YouTube API Services. By connecting a YouTube channel you also agree to be bound by the YouTube Terms of Service, and Google’s own handling of the data exchanged through that connection is described in the Google Privacy Policy.
With your authorization Octaneon reads your channel, videos, playlists, and comment threads and your channel’s YouTube Analytics views and engagement; writes video uploads, caption tracks, thumbnails, and comment replies that an operator has approved; and, where you connect it, reads Google Analytics 4 traffic and page reports for the property you choose.
We use this data only to provide the features you enable: showing channel and website performance, building your brand’s searchable knowledge base from your videos, transcripts, and comments, generating caption tracks, draft replies, articles, content ideas, and recommendations from that material, and publishing what an operator approves. To produce those outputs, video media, transcripts, comments, and performance metrics are processed by an AI model provider acting as our processor under contract. If you connect your own AI assistant through Octaneon’s Agent Access, it can read your performance data and knowledge base and draft, schedule, or publish content on your instruction. Otherwise Google user data is shared only with the infrastructure subprocessors that host and store the Service (cloud hosting, database, and data warehouse). It is never sold, never transferred to data brokers or advertising platforms, never used for advertising, and is handled in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Octaneon’s access to your Google and YouTube data at any time from the Google security settings page, or by disconnecting the source from Brand → Integrations. Revoking access stops all further reads and writes; data already stored is removed under the retention rules below or on request.
6. Data retention
We retain account and brand data for as long as your account is active. Connected-source content is retained until you request deletion. Encrypted OAuth tokens are deleted when a connection is removed. Deleted records may persist in routine backups and in our data warehouse's short-term recovery window for up to 30 days, after which they rotate out.
7. Security
We use industry-standard controls including TLS in transit, encryption at rest, role-based access control, row-level security in our database, and encryption of sensitive credentials (OAuth tokens, WordPress application passwords) using a per-workspace key. No system is perfectly secure; we encourage strong passwords and email verification.
8. Your choices
- You may disconnect any third-party integration from Brand → Integrations at any time.
- You may request access, correction, or deletion of your data by contacting us (see below).
- Depending on your jurisdiction you may have additional rights under GDPR, UK GDPR, CCPA/CPRA, or similar laws.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect information from them. If you believe we have, please contact us and we will delete the data.
10. International transfers
Octaneon is operated from the United States. If you access the Service from outside the United States, you consent to the transfer of your information to the United States and other jurisdictions where our subprocessors operate.
11. Changes
We may update this Privacy Policy from time to time. Material changes will be announced in the control plane and reflected in the "last updated" date above.
12. Contact
Questions or requests about this policy can be sent to privacy@octaneon.ai, or by post to CoreSpeed LLC, 10145 Prattville Avenue, Las Vegas, NV 89148-5501, United States.