Privacy Policy

Effective date: 27 July 2026 · Last updated: 27 July 2026

This Privacy Policy explains what personal data is processed in connection with the Dear Humans Publisher application and the website at dearhumansk7.com, why it is processed, how long it is kept, and what rights you have. It is written to comply with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is responsible for your data

The data controller is Gerard Sala Ripoll, an individual established in Spain, operating the Dear Humans channel and the Dear Humans Publisher application.

• Contact for all privacy matters: salageri84@hotmail.com
• Jurisdiction: Spain (European Union)

A postal address is available on request to any person exercising the rights described in section 8.

2. What the application does

Dear Humans Publisher is a single-operator automation tool. It assembles short-form videos that are the original work of the operator and publishes them to the operator's own Dear Humans accounts on TikTok, YouTube and Instagram.

The application is not offered as a service to the public. It has no sign-up, no user accounts, no dashboard for third parties, and it never connects to, reads from, or posts to any account other than the operator's own. The only person who authorises it, and the only person whose account data it can reach, is the operator.

3. What data is processed, and where it comes from

3.1 Data received from the TikTok API

When the operator authorises the application through TikTok Login (OAuth), TikTok returns and the application stores:

• the account identifier (open_id) of the operator's own TikTok account;
• an OAuth access token (valid 24 hours) and a refresh token (valid up to 365 days);
• for each upload, the publish_id returned by the Content Posting API and the resulting publication status.

No follower data, no viewer data, no comments, no messages and no analytics are requested, received or stored. The application requests only the scopes strictly required to publish the operator's own videos.

3.2 Data held for the other platforms

API credentials for YouTube (Google OAuth token) and Instagram (Meta Graph API long-lived token), belonging to the operator's own accounts, held for the same purpose.

3.3 Content processed to build the videos

Publicly available news headlines and article metadata, stock footage licensed from Pexels, a script generated with Anthropic's Claude API, and synthetic narration generated with ElevenLabs. None of this involves personal data of visitors or of the audience.

3.4 Visitors to this website

This website has no account system, no forms, no analytics and no tracking cookies of its own. It does not build profiles of visitors. It embeds videos hosted by YouTube and Instagram; when those embeds load, Google and Meta may set their own cookies and receive your IP address under their own privacy policies (see section 10).

3.5 What is never collected

No personal data of viewers, followers, commenters or any other third party is collected, stored, sold, rented or shared by the operator. There is no advertising network, no data broker and no profiling of any kind.

4. Purposes and legal bases

• Publishing the operator's own content to the operator's own accounts — legal basis: performance of a contract to which the operator is party, namely the developer terms of each platform (GDPR Art. 6(1)(b)), and the operator's legitimate interest in operating their own channel (Art. 6(1)(f)).
• Keeping API credentials valid (token refresh) — same basis; it is technically necessary for the above.
• Operational notifications sent to the operator's own private Telegram channel when a video is published — legitimate interest (Art. 6(1)(f)).

No processing is carried out for marketing, profiling or automated decision-making with legal effects.

5. Storage, retention and security

• Where: access and refresh tokens are stored in a configuration file on a private server controlled solely by the operator. They are never committed to source control, never transmitted to third parties and never exposed on this website.
• Rotation: the TikTok access token is exchanged for a fresh one on every run and expires after 24 hours; a rotated refresh token replaces the previous one immediately.
• Retention: tokens are kept only for as long as the application remains authorised. When authorisation is revoked (section 9), the stored tokens are deleted within 30 days and cannot be reused.
• Video files: a rendered MP4 is uploaded to temporary object storage (Cloudflare R2) only so that Instagram can fetch it by URL, and is deleted immediately after the post is published.
• Publication records: the local history database stores only the title, the source-article hash and the published URL of each video. It contains no personal data.
• Security measures: credentials restricted to the operator's server, transport over HTTPS only, least-privilege API scopes, and no third-party access to the machine.

6. Third-party services involved

The following providers process data on the operator's behalf or receive data as independent controllers. Each is governed by its own privacy policy:

• TikTok — publication of the operator's videos (policy)
• Google / YouTube — publication and video embeds (policy)
• Meta / Instagram — publication and video embeds (policy)
• Anthropic — script generation (policy)
• ElevenLabs — speech synthesis (policy)
• Pexels — licensed stock footage (policy)
• Cloudflare — temporary hosting of the video file (policy)
• Telegram — operational notifications to the operator (policy)

No personal data is sold or shared with anyone for advertising or any other commercial purpose.

7. International transfers

Several of the providers listed above are established outside the European Economic Area, principally in the United States. Where data is transferred outside the EEA, it takes place under the safeguards those providers make available, typically the European Commission's Standard Contractual Clauses or an equivalent adequacy mechanism. The data involved is limited to the operator's own credentials and the video content itself.

8. Your rights

Any individual whose personal data may be processed has the right to:

• access the data held about them;
• have inaccurate data rectified;
• have their data erased;
• restrict or object to processing;
• receive their data in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, write to salageri84@hotmail.com. A reply will be sent within 30 days. There is no charge.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), www.aepd.es, or with the supervisory authority of your country of residence.

9. Revoking access and deleting your data

Authorisation granted to Dear Humans Publisher can be withdrawn at any moment, with immediate effect:

• TikTok: in the TikTok app, go to Profile → Menu → Settings and privacy → Security & permissions → Manage app permissions, select "Dear Humans Publisher" and remove it.
• YouTube / Google: at myaccount.google.com/permissions, select the application and choose "Remove access".
• Instagram / Meta: in Instagram, go to Settings → Website permissions → Apps and websites, and remove the application.

Once access is revoked, the stored tokens stop working immediately. To request that all remaining stored data be deleted, write to salageri84@hotmail.com with the subject "Data deletion request". Deletion is carried out and confirmed in writing within 30 days.

10. Cookies

This website sets no cookies of its own and runs no analytics, no tag managers and no advertising scripts. The only cookies that may appear are those set by the embedded YouTube and Instagram players when you load a page containing them, under the policies of Google and Meta linked in section 6. You can block them through your browser settings without losing access to any other part of this site.

11. Children

Neither the application nor this website is directed at children under 13, and no data of children is knowingly processed. If you believe a child has provided personal data, write to the contact address above and it will be deleted.

12. Changes to this policy

This policy may be updated to reflect changes in the application or in applicable law. The effective date at the top of this page is always updated when that happens, and the current version is always published at this URL. Material changes will be summarised at the top of the page for at least 30 days.

13. Contact

Gerard Sala Ripoll — Dear Humans
salageri84@hotmail.com
Spain