Privacy Policy

YouTube API Services

If you connect a YouTube channel, Next5 uses YouTube API Services. By connecting, you also agree to be bound by the YouTube Terms of Service (https://www.youtube.com/t/terms). Google’s Privacy Policy applies to data Google handles (https://policies.google.com/privacy).

We ask for two permissions. youtube.upload lets Next5 upload the Shorts you approve to your channel and set their thumbnail. youtube.readonly lets Next5 read your channel’s ID, name and picture once, when you connect, so we can show you which channel will receive your posts. We do not read your other videos, comments, subscribers, playlists or private data, and we never change or delete anything on your channel.

We protect Google user data with encryption in transit (TLS 1.2 or higher) and at rest (AES-256-GCM), strict access controls, and security procedures that keep it confidential. See “How we protect your data” below.

We store your channel ID, name and picture, and the access and refresh tokens Google gives us, encrypted. We use this data only to publish the videos you approve. We do not sell it, use it for advertising, share it with anyone except as needed to run the service, or use it to train AI models. Next5’s use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can disconnect at any time in Settings → Integrations: we then delete the stored tokens. You can also revoke Next5’s access at https://security.google.com/settings/security/permissions. Videos already published stay on YouTube until you delete them there.

What we collect

Your email, name, business name and handle; the photos you upload (selfies, full-body photos, product photos); the photos we create; payment references and amounts; and basic technical data such as IP address for security and consent records.

Why we use it

To create and deliver your photos, run your account and plan, prevent abuse, send service emails (receipts, renewal reminders, photos ready) and improve quality — for example by reviewing photos you asked us to redo.

Connected TikTok and Instagram accounts

When you connect TikTok, TikTok shares with us, with your permission: your account’s basic profile (a user ID, display name, username and profile picture) an access token that lets Next5 publish posts you approve (scopes user.info.basic and video.publish), and read access to your account’s totals (follower, following, like and video counts; scope user.info.stats) and to your public posts and their view, like, comment and share counts (scope video.list). Before each post we also ask TikTok which privacy options and comment settings your account allows, so we can show them to you.

We use this only to show which account will post, to publish the posts you approved, to check whether each post went live, and to show you how your posts and account are doing on your Analytics page. We do not read your messages or who your followers are, we never post anything you did not approve, and we never sell or share this data. Access tokens are stored encrypted.

We keep your TikTok profile details and tokens until you disconnect. Disconnect in Settings → Integrations, or remove Next5 in the TikTok app (Settings and privacy → Security → Manage app permissions); we then delete the tokens. We keep a record of posts already sent (time, status and link) with your account history.

How we protect your data

Encryption in transit: every connection to Next5, and from Next5 to Google, TikTok, Meta and our providers, uses HTTPS (TLS 1.2 or higher).

Encryption at rest: access and refresh tokens for YouTube, TikTok and Instagram are encrypted with AES-256-GCM before they are saved, using a secret key kept outside the database. Our database (Railway) and file storage (Cloudflare R2) are also encrypted at rest by those providers.

Access control: tokens are only decrypted on our servers, at the moment a post you approved is sent. They are never sent to your browser, never written to logs and never shown to anyone, including Next5 staff. Only a small number of Next5 administrators can access production systems, using individual accounts with two-factor authentication.

Data minimisation: we only ask for the permissions a feature needs, and we only store the fields listed in this policy. When you disconnect an account, we delete its tokens right away.

Incidents: if we learn of a breach that affects your data, we will tell you by email without undue delay and tell the relevant platform (Google, TikTok or Meta) as their policies require.

Who processes it

WaveSpeed and reAPI (image generation), OpenAI (captions and slideshow text), Exa (reading the public pages of your website), Cloudflare R2 (storage), Railway (database), Vercel (hosting), Maileroo (email), Google/YouTube, TikTok and Meta (only when you connect and post) and our payment provider. Each only receives what it needs for its task. We never send your Google or YouTube data to image or AI providers.

How long we keep it

Selfies and full-body photos: until you delete them. Product photos: 12 months after last use. Created photos and slideshows: while your account is active and for 90 days after your plan ends. YouTube, TikTok and Instagram tokens and profile details: until you disconnect, then deleted right away.

Your choices

Delete your face data anytime in Settings → Privacy. Disconnect YouTube, TikTok or Instagram anytime in Settings → Integrations. Email us to receive a copy of your data or to delete your account; we respond within 7 days.