Privacy Policy

Draft prepared 5 October 2026 · Effective date: [TODO: set on publication]

DRAFT — NOT LEGAL ADVICE — ATTORNEY REVIEW REQUIRED BEFORE PUBLISHING. Prepared 2026-10-05 by A1Media Marketing LLC from facts available at drafting; unverified items marked [TODO].

1. Who we are

A1MEDIA OS (os.a1mediamarketing.com) is a private dashboard run by A1Media Marketing LLC, a Texas limited liability company ("A1", "we", "us"). Address: [TODO: mailing address]. Privacy questions: [TODO: privacy email].

The dashboard is only for A1's clients and staff. Accounts are created by A1; there is no public sign-up.

2. What this policy covers

This policy explains what we collect when you use A1MEDIA OS and the content services we deliver through it (research, scripts, video editing, thumbnails, reporting). Our contract with your business (the Master Services Agreement and Data Processing Agreement) also applies and wins if it says something different.

3. Information we collect

What you give us

• Account details: your email address and a password (we store only a scrambled "hash" of it, never the password itself).
• Brand intake: answers you or your account manager enter about you and your business, such as your name, role, website, social media handles, story, audience, offers, customer objections, proof points and the words your customers use.
• Voice samples: past scripts or captions you paste in so our tools can match your voice.
• Videos and photos: raw footage you upload for editing (up to 2 GB per file) and photos for thumbnails. We remove hidden photo data (such as camera and location metadata) from photos when they are uploaded.
• Feedback and chat: approvals, change requests, and messages you send to A1 AI, our in-app assistant.

What we collect automatically

• Sign-in data: a session cookie (see section 7) and, briefly, your IP address to slow down repeated wrong-password attempts.
• Server logs: basic error and request logs on our server.
• Actions in the app: a record of key staff actions (for example, creating a login) for security.

What we get from other sources

• Your public posts: view, like and comment counts on videos you post on YouTube and Instagram, used to report your results.
• Your website and public web results about your business, to pre-fill your brand intake.
• Your GoHighLevel account (if connected): business figures such as contact counts, deals and appointments. Deal and appointment names may include your customers' names.
• Public creators you choose to follow in the app (their public posts and stats).

We do not ask for and do not want health information, financial-account numbers, government ID numbers, or information about children. Please do not upload it.

4. How we use it

We do not send marketing emails or text messages from this dashboard.

5. AI tools

We use artificial-intelligence services to draft research, scripts, captions, edit plans and thumbnail backgrounds. To do that, the relevant text (for example, your intake answers, voice samples, scripts and chat messages) is sent to our AI providers:

• Anthropic (Claude) for writing, chat and edit planning.
• Cloudflare Workers AI for generating thumbnail background images from a text description. Your photo is combined with the background on our own server.

AI output can be wrong. A1 staff and you review content before it is published. We do not use your content to train our own AI models. [TODO verify: confirm the AI providers' data-use and training settings for our account before publishing this sentence.]

6. Who we share it with

We share data only with service providers who help us run the service, under contracts that limit their use of it:

• Hosting: our server provider [verify: Hostinger, US data center].
• AI providers: Anthropic and Cloudflare (section 5).
• Google (Google Drive, to move video files to and from our editing system; YouTube, for public statistics).
• Slack (internal notices to our team that an edit is ready).
• HighLevel (GoHighLevel), when your account is connected.
• Meta (Instagram public statistics), when connected.

We may also share data if the law requires it, to protect rights and safety, or as part of a merger or sale of our business (with notice to you).

We do not sell your personal data, and we do not use it for targeted advertising.

7. Cookies and browser storage

We use one cookie, and it is essential: sid, which keeps you signed in. It is first-party, cannot be read by page scripts (HttpOnly), is not sent to other sites (SameSite=Strict), is only sent over HTTPS, and expires after 8 hours or when you sign out.

Your browser's local storage also remembers a few preferences on your device only: light/dark theme, display density, your dashboard layout, and the last video you opened. These are never sent to us or anyone else.

We use no analytics, advertising pixels or tracking tools. Our fonts are hosted on our own server.

Third-party video and images: some screens show YouTube videos (through YouTube's privacy-enhanced youtube-nocookie.com player), Instagram embeds and thumbnails loaded from those platforms. When they load, YouTube, Instagram and their image servers receive your IP address and may set their own cookies or storage under their own privacy policies.

8. How long we keep it

Sessions last 8 hours, unused temporary passwords expire after 7 days, and A1 AI keeps at most 20 conversations per person and client. For everything else we are setting retention periods now. [TODO decide: summarize the final schedule from the Data Retention Policy, e.g. raw footage 90 days after upload; account data deleted within 30–90 days after your contract ends.] When your contract ends you can ask for an export of your deliverables before deletion.

9. Security

We use HTTPS, hashed passwords, strict browser security headers, protection against forged requests, sign-in rate limits, and server-side checks so each client can see only its own account. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

10. Your choices and rights

You can ask us to:

• confirm whether we process your personal data and give you access to it;
• correct it;
• delete it;
• give you a copy in a portable format.

Email [TODO: privacy email]. We will verify the request comes from you (usually by replying to the email on your account) and answer within 45 days; if we need more time we will tell you, and may extend once by up to 45 more days. If we decline, you can appeal by replying to our answer with "Appeal" in the subject; we will answer the appeal within 60 days. If you are not satisfied, you can contact the Texas Attorney General. [verify: TDPSA timelines and whether TDPSA applies to A1 — offered voluntarily if it does not]

If our records about you came from one of our clients (for example, you appear in a client's video or GoHighLevel account), we handle your request together with that client, who decides how the data is used.

California residents: based on our size and activities, the California Consumer Privacy Act does not currently apply to us. [verify with counsel]

11. Children

A1MEDIA OS is for businesses and adults. It is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child's information has been uploaded, contact us and we will delete it.

12. Where data is stored

Our server is in the United States [verify region]. Some providers may process data in other countries under their own safeguards.

13. Changes

If we change this policy in a meaningful way, we will tell clients by email or in the dashboard before the change takes effect, and update the date above.

14. Contact

A1Media Marketing LLC · [TODO: address] · [TODO: privacy email]

DRAFT — NOT LEGAL ADVICE — ATTORNEY REVIEW REQUIRED BEFORE PUBLISHING. Prepared 2026-10-05 by A1Media Marketing LLC from facts available at drafting; unverified items marked [TODO].