Privacy Policy
Last updated: November 5, 2026
This policy describes how Estratégia Live Manager (the “application”), maintained by Estratégia Educacional for internal use, handles information accessed through Google and YouTube APIs. The application uses YouTube API Services; by using it you are also bound by the YouTube Terms of Service and the Google Privacy Policy.
1. Who uses it and which accounts are connected
The application is for internal use and restricted to authorized employees. It has no public sign-up and is not offered to third parties. The connected YouTube accounts are Estratégia's own channels, authorized by each channel's administrator.
The same Google authorization (the same OAuth project) also serves sign-in for other internal Estratégia systems, all under estrategiann.cloud and bound by this same policy:
- Google sign-in for internal systems: identifies the employee by the name, email and photo of the corporate account (
openid,emailandprofilescopes).
2. Data accessed
With the scope https://www.googleapis.com/auth/youtube.force-ssl, the application:
- creates and updates scheduled live broadcasts (title, description, start time, privacy status);
- updates video data (tags, category, language) and sets the thumbnail;
- reads the channel's video and playlist inventory and basic channel data to validate the connection;
With the scope https://www.googleapis.com/auth/yt-analytics.readonly (read-only), the application reads aggregated reports for the channel itself, such as the search terms that brought viewers to its videos and views per video, to choose better titles and tags.
Google Drive (thumbnail import): when an employee pastes the link to a Drive folder or image, their browser asks Google for read permission, lists only the images in that folder and downloads the ones they select. The Drive token stays only in that employee's browser, for up to 1 hour, and is never sent to the server; the server receives only the selected image files.
The application does not access email, contacts, calendar, payment data or individual viewer data, and does not read comments.
3. How data is used
Data is used only to perform, on Estratégia's own channels, tasks requested by an authorized employee, and to record what was done (operational audit). It is not sold, not used for advertising, not used to train artificial intelligence models, and not transferred to third parties other than the service providers listed in section 4. The use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Service providers
- Hosting and database: a server contracted by Estratégia, where the application runs.
- No data obtained from Google APIs is sent to artificial intelligence services.
5. Storage and security
- Google access and refresh tokens are stored encrypted (AES-256-GCM), with the key kept outside the database.
- Traffic uses HTTPS, and access to the application requires an individual login with a permission profile.
- Operation logs are kept (video identifiers, applied text and the result of each call), without credentials.
- For internal auditing, every action taken by staff in the application is recorded with author, date and time, affected item, result and IP address. The record cannot be changed or deleted by the application, holds no passwords or credentials and is kept for up to 2 years.
6. Cookies and browser storage
The application uses only necessary cookies: a session cookie, to keep the employee signed in, and a temporary one during Google sign-in, to check that Google's response is legitimate. In the browser it also keeps the Drive token described in section 2 (session storage, up to 1 hour) and the collapsed-menu preference. There are no advertising cookies and no third-party tracking.
7. Retention, revocation and deletion
When a channel is disconnected in the application, that channel's Google tokens are deleted from the database. The administrator can also revoke access at any time at myaccount.google.com/permissions; after that, the application can no longer access the channel. Data obtained from YouTube and operation logs are kept for as long as operations and internal auditing require and can be deleted on request to the contact below, within 30 days.
8. Contact
Questions, deletion requests or privacy matters: admin.operacoesnn@estrategia.com