Cereus Media Engineby Cereus Enterprises

Privacy Policy

Effective date: [REVIEW: effective date] · Last updated: [REVIEW: date of approval]

Draft for review — not yet in effect. Highlighted items marked “REVIEW” need confirmation by Cereus Enterprises and, where noted, legal counsel before this policy is published.

1. Who we are

Cereus Media Engine (“CME”, “we”, “us”) is a software service provided by Cereus Enterprises LLC [REVIEW: state of organization and business mailing address]. CME helps businesses create, organize, and automate short-form media content and, optionally, upload it to YouTube.

2. What this policy covers

This policy explains how CME handles information when you use the CME application and when you visit this website, cme.cereusenterprises.com.

CME is currently in private development and is not yet open for public sign-up. This policy describes how CME is designed to handle information. We will update it before CME becomes generally available if anything changes. [REVIEW: remove or revise this paragraph at public launch.]

3. Information we collect

Account information

When you sign in, CME receives an identifier for your account from our sign-in provider, along with your email address and display name. CME uses these to create and recognize your account and to show who reviewed or approved content. [REVIEW: name the sign-in provider once chosen, and confirm the fields it shares.]

Content you provide

  • Brand details, such as brand names and descriptions, and brand logos you upload.
  • Product details, such as product names and descriptions, and product images you upload.
  • Your choices in the app, such as content you approve or reject and the YouTube disclosures you select for an upload.

Content CME generates for you

Scripts and other text, narration audio, and rendered videos that CME produces from your brand and product information, along with their review status.

YouTube connection information

If you choose to connect a YouTube channel, CME receives and stores:

  • OAuth access and refresh tokens issued by Google, which let CME act on your behalf within the permissions you granted (see section 5);
  • your YouTube channel ID, used to confirm which channel is connected; and
  • records of uploads CME makes for you, such as the video ID YouTube returns, the upload's status, and its privacy setting.

Technical information

Like most online services, the servers that host CME and this website may record standard request information, such as IP address, browser type, and the time of a request, for security and reliability. [REVIEW: confirm once hosting providers are chosen, including what their logs contain.]

This website

This marketing website does not use cookies, analytics, advertising, or tracking scripts, and it has no forms. If you email us, we receive the information you choose to include.

4. YouTube API Services and Google user data

CME uses YouTube API Services to let you connect a YouTube channel and upload videos to it. By using CME's YouTube features, you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

When you connect YouTube, CME requests only these permissions:

https://www.googleapis.com/auth/youtube.upload
Used only to upload the videos you explicitly choose to your connected channel. CME creates these uploads as private. CME does not use this permission to edit or delete your existing videos.
https://www.googleapis.com/auth/youtube.readonly
Used only to read your channel's ID when you connect, so CME can confirm which channel it is connected to. CME does not use it to read your videos, playlists, comments, subscribers, or analytics.

CME's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not sell Google user data, do not use it for advertising, and do not use it to train generalized artificial intelligence or machine learning models. [REVIEW: owner to confirm these commitments.]

5. How credentials and tokens are handled

  • CME never sees or stores your Google password. You sign in on Google's own pages.
  • The exchange of Google's authorization code for tokens happens on CME's servers, not in your browser.
  • Tokens are stored encrypted using AES-256-GCM authenticated encryption, with a key held by the CME server rather than in the database.
  • Tokens are never displayed in the CME app and are not stored in your browser's local storage.
  • Tokens are used only to carry out the YouTube actions described in section 4.

[REVIEW: confirm the production deployment matches this description, including where the encryption key is kept.]

6. How we use information

  • To provide CME: creating your account, storing your brands and products, generating and rendering content, and uploading videos when you ask us to.
  • To keep CME secure and reliable, including detecting abuse and diagnosing problems.
  • To communicate with you about your account, support requests, and important changes to CME.
  • To comply with legal obligations.

We do not sell your personal information. [REVIEW: confirm, and confirm there are no marketing uses that need separate disclosure or consent.]

7. How information is shared

We share information only as needed to run CME:

  • Google and YouTube — when you connect a channel or ask CME to upload, the video file and its title, description, any tags, privacy setting, and disclosure settings are sent to YouTube.
  • ElevenLabs — if you generate narration, the narration text is sent to ElevenLabs to produce the audio. [REVIEW: confirm narration is enabled at launch, and add a link to ElevenLabs' privacy policy.]
  • Infrastructure providers — companies that host CME, its database, and file storage process information on our behalf. [REVIEW: list providers once chosen, e.g. hosting, database, storage, sign-in, email, and payments if any.]
  • Legal reasons — when required by law, or to protect the rights, safety, or security of our users, the public, or CME.
  • Business transfers — if Cereus Enterprises LLC is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. [REVIEW: counsel to confirm.]

8. Disconnecting YouTube and revoking access

You can disconnect YouTube at any time:

  • In CME: open the brand's publishing destinations and choose to disconnect YouTube. CME deletes its stored copy of your YouTube tokens and asks Google to revoke them. CME tells you whether Google confirmed the revocation.
  • In your Google Account: remove CME's access from the Google security settings page. This works even if you can no longer sign in to CME.

Disconnecting does not delete videos that were already uploaded to YouTube. You can manage or remove those in YouTube Studio.

9. How long we keep information

We keep information for as long as it is needed to provide CME to you, unless you ask us to delete it or the law requires otherwise. [REVIEW: retention periods are not yet defined. Set periods for account data, uploaded and generated content, YouTube tokens after disconnection, upload records, and logs. YouTube API Services policies limit how long certain data obtained from YouTube may be stored without being refreshed; confirm CME's approach before publishing.]

10. Deleting information and your choices

  • You can remove brand logos and product images from within CME.
  • You can disconnect YouTube at any time, as described in section 8.
  • CME does not currently offer self-service account deletion. To ask us to delete your account or other information, contact us using the details below. [REVIEW: define the deletion-request process and what can actually be deleted before publishing.]

11. Cookies

This website does not set cookies. When you connect YouTube in the CME app, CME sets a short-lived cookie that links Google's response back to the browser that started the connection. It is used only for that security check and is cleared when the connection finishes. [REVIEW: add any cookies used by the sign-in provider once chosen.]

12. Security

We use safeguards designed to protect your information, including encryption of stored YouTube tokens and HTTPS for the YouTube connection in production. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children

CME is intended for businesses and adults. It is not directed to children under 13, and we do not knowingly collect personal information from them. [REVIEW: confirm the minimum age, consistent with the Terms of Service.] (YouTube's “made for kids” setting in CME describes a video's audience, not CME's users.)

14. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, or to object to certain processing. To make a request, contact us using the details below. [REVIEW: counsel to confirm which laws apply (for example US state privacy laws, GDPR/UK GDPR) and the required disclosures.]

15. Changes to this policy

We may update this policy as CME changes. We will post the updated policy on this page and change the “Last updated” date. If changes are significant, we will give additional notice, such as by email or in the app.

16. Contact us

Cereus Enterprises LLC
Email: [REVIEW: privacy contact email]
Mailing address: [REVIEW: business mailing address]

You can also visit our Support page.