Privacy Policy

Last updated: 8 November 2026

This policy covers the Lince Studio website and web application. The operator's separate personal installation is outside this policy.

Operator and contact

Nanami Studio LLC operates Lince Studio. For privacy questions, complaints, or requests about your information, contact contact@nanami.studio. Do not send passwords or access tokens.

Information and purposes

We handle account names and email addresses, information about authentication and your configured security methods, optional avatars, invitations, preferences, channel ownership and permissions to provide and secure your account and collaboration. We store the drafts, dates, files, workspace comments, reactions, reports and report sources you provide or authorize, together with authorship, versions and activity needed to display work and recover interrupted operations. Workspace comments are separate from YouTube comments.

Notifications involve your choices, delivery records and, when you enable browser push, subscription details for that browser or device. Agent connections have their own credentials, permissions and activity records. Network requests also involve IP addresses and browser information; the application and infrastructure use request information for delivery, security and rate limits. Information you send by email is used to handle your enquiry.

Contact enquiries: if you submit the website form, we store your name, email, working setup, number of channels, language and optional message privately in Lince to respond to your enquiry. The active enquiry record is kept for up to 90 days. Acceptance means the message has been saved and an operational email notification to the team has been queued; it does not confirm email delivery. A new message can use the same email address. Submitting does not create an account or subscribe you to marketing. Rate limits help protect the form. With optional analytics consent, validated source labels can be attached to the enquiry or signup record; form contents and account identity are never sent to Google Analytics. Contact us to correct or remove an enquiry.

Signup campaign: if you reach the website through a campaign link, the signup link carries only its validated source, medium and campaign labels (utm_source, utm_medium and utm_campaign), and Lince stores them with the signup attempt to learn which campaigns bring signups. This uses no cookies or browser storage and does not depend on optional analytics. Lince does not send these labels to advertising or analytics services such as Google Analytics or the OpenAI pixel. The full address, advertising click identifiers and device identifiers are never stored. Designated administrators see the campaign in the signup list and in the operational notices about the signup, which reach them by Telegram or email. It is kept with the signup attempt and removed when the associated account is deleted.

Customers, billing and payments: we process the customer type (individual or business), billing name, address, email and applicable tax identifiers, together with Stripe customer, subscription and payment references, their status, invoices and payment-method summaries such as card brand, last four digits and expiry. These records support membership and billing management and payment follow-up. Card-number and security-code fields are provided through Stripe's interface; those details do not pass through Lince's API. Stripe processes information for payments, authentication and fraud prevention, and describes its other processing and your choices in the Stripe Privacy Policy.

Google and YouTube information

Lince Studio uses YouTube API Services. See the YouTube Terms of Service and the Google Privacy Policy. Google consent supplies authorization tokens and granted permissions; Lince stores tokens encrypted on its server and uses them there. Lince does not ask for your Google password or give external agents your Google tokens.

Authorized information can include channel and video identifiers, names, titles, descriptions, tags, thumbnails, publication and availability information, and channel/video Analytics such as views, watch time, subscriber changes and estimated revenue. Lince uses these for the catalog, planning context, Analytics and the reports you request. Results can be historical, delayed or incomplete.

Read access includes YouTube and Analytics, including monetary Analytics. Optional metadata editing requests a broader Google permission, but Lince exposes title, description and tag changes only after human review and confirmation of the specific change. Connecting a channel does not approve a metadata edit. Lince file uploads do not publish on YouTube, and local removal does not delete a YouTube video.

Lince Studio's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including Limited Use requirements. We use it to provide the features you choose, not for advertising, sale, credit decisions or training general-purpose AI models. Human review of Google data is limited to specific information you choose to share for support, necessary security investigations or applicable legal obligations. The application access limits described below still apply.

Data protection and security

Lince Studio uses HTTPS to protect information transmitted between your browser and our service and between our servers and Google APIs. Google authorization tokens are encrypted before being stored and are used by server-side services. They are not provided to collaborators or external AI agents.

Access to channel information, Analytics and workspace content is checked on the server according to the authenticated account and its channel permissions, separately from platform administration. Browser sessions use Secure, HttpOnly cookies, and state-changing browser requests are protected against cross-site request forgery. External agents use separate, revocable Lince credentials and remain subject to server-side permission checks. These measures help prevent unauthorized access, disclosure and modification of information, including sensitive Google user data.

Administration and support: separate access

The Superadmin role does not grant access to browse your private workspace, video catalog, files, comments, reports or channel and video Analytics, including estimated revenue. “View as user” has been removed, and old access links or sessions cannot restore it. Administrators cannot use account management to change a customer’s sign-in email or receive their Google tokens.

Designated administrators can manage account identity and status, memberships, channel ownership and permissions, service usage and limits, connection status and technical health. This operational information is separate from your channel performance and workspace content. Hosting, maintenance and security operations may require limited handling of stored information where necessary to operate and protect the service or comply with law; they are not permission for routine monitoring of your channels or financial results.

When a new public signup verifies its email address and starts its trial, designated administrators receive an operational email containing the name, verified email, selected plan and trial start and end dates. This notice supports account administration; it does not subscribe the customer to marketing.

Support staff can read messages, attachments, screenshots and context that you submit to Helpdesk. Conversations with the support assistant are recorded and can be reviewed by designated support staff even when they are not escalated to a person. If you use the assistant, the messages, selected screenshots and limited diagnostic context needed to answer are processed by its AI provider, OpenAI. The support assistant does not have general access to your workspace or Analytics. Do not include passwords, access tokens or information unnecessary for your request.

Using Lince Studio, accepting these terms, opening a ticket or linking a channel to it does not authorize support to enter your private workspace. An owner-approved, temporary access flow is not currently available. Any future support access to specific private resources would require a separate, explicit approval of its scope and duration. Support does not transfer ownership, authorize YouTube edits, or allow advertising, sale, unrelated reuse or combining independent creators into a shared YouTube performance total. You may withdraw Google access or request account/data deletion as described below.

Access and sharing

Collaborators: your account identity and workspace information are shown according to channel and page permissions. People you authorize may read or download information. Revoking access prevents subsequent access through Lince; it cannot retrieve copies someone already received.

Your external agents: connecting an agent is optional. A separate token, API or MCP connection limits the agent to the permissions you grant and those of its responsible human. Those grants can allow it to receive files, workspace content, reports or stored Analytics and perform permitted actions. No particular agent system or model is required. Review its provider's privacy practices before connecting it. You must not authorize use of Google data for advertising, sale or general-purpose model training. Revoking its Lince token stops future access but does not itself delete copies at that provider; include those copies in any deletion request.

Infrastructure: Cloudflare provides site/request delivery, the private file service and encrypted backup storage. The application and database run on Nanami's hosting infrastructure. ZeptoMail EU provides transactional mail; Google receives authorized API requests; browser push uses the relevant browser/device provider. Google-hosted thumbnails and links also involve Google when loaded. Providers process information needed for their service. Processing may occur outside your country; an EU endpoint does not mean all processing stays in the EU. Contact us for information about applicable arrangements and safeguards.

Team notices: designated administrators receive operational notices about each customer's journey by Telegram, or by email when Telegram is unavailable, so they learn in time and can help. The notices include details such as name and email, language, the state of the signup, account or payment, plan and trial dates, campaign of origin, names of linked channels, payment amounts and the category of support requests. Telegram processes these notices to deliver them. They never include passwords, codes, tokens or the text of support or contact messages.

AI-generated reports: when you ask Nanami to generate or schedule a report, OpenAI processes your selection and instructions together with an authorized snapshot of the selected channels' and videos' information and Analytics, including revenue where your permissions allow it, to write and review the report. This feature works with the snapshot supplied by Lince; it does not give the model your Google credentials or general access to your workspace.

Cookies and device storage

Lince Studio uses a Secure, HttpOnly session cookie. New sign-ins without “Keep me signed in” have an absolute limit of 12 hours and use a browser-session cookie; with “Keep me signed in”, the absolute limit is 30 days from sign-in. Activity does not extend these limits. Older sessions and anonymous application sessions may continue to renew with activity and expire after up to 30 days of inactivity. Logout, revocation or clearing browser data can end access sooner.

Cross-site request forgery (CSRF) protection uses a separate cookie and request checks. If you choose to remember a device for two-factor authentication, a separate Secure, HttpOnly cookie can remember that device for up to 30 days. This does not extend the sign-in session or replace identity checks for sensitive actions.

Chosen interface preferences, including language and colour theme, remain in browser storage until replaced or deleted. Temporary tab storage helps recover interrupted navigation and operations. Upload recovery uses the browser's local database for up to 200 records, with optional file copies limited to 16 MiB per file and 64 MiB in total. Records are eligible for recovery for seven days after their last update; cleanup takes place during later storage operations, so physical deletion exactly on day seven is not guaranteed. Clearing site data removes local records, not server information. Browser push is optional, requires browser permission and can be disabled in notification settings or browser controls.

The website uses local fonts and fictional product examples. It may ask the application whether your existing session is valid to display the appropriate app-access link; it receives only a yes/no result, not your identity, channels or session credentials. This check does not create a session cookie for anonymous visitors.

Optional analytics: only after you accept analytics, Google Analytics 4 loads on public pages and the signup entry to measure page views, button clicks, plan selection, accepted contact messages and completed signups. Google processes browser/device information and pseudonymous cookie identifiers; network requests also involve technical connection data. We send the public origin and path, without query strings or fragments, and never send form contents, names, email addresses, account/channel identifiers, private page paths or full referrers. Advertising storage, Google signals and advertising personalization remain disabled. Before acceptance and after rejection, no Google Analytics script or request is sent, including cookieless measurement requests.

Your analytics choice is stored for 180 days in a cookie shared by lincestudio.app and its subdomains. With consent, a separate cookie stores the first validated source, medium, campaign labels and referring domain for 30 days; it contains no full URL or advertising click identifier. These labels may accompany your visit to the signup entry and be retained with a signup or enquiry record under the corresponding retention rules. Analytics cookies are set for up to 180 days, and Google Analytics user/event-level retention is configured to 14 months; aggregated reports may remain longer. Use “Cookie preferences” in the footer to reject or withdraw at any time. Withdrawal stops future analytics and removes accessible analytics and source cookies; it does not automatically erase data already processed. You can contact us about deletion. Essential service storage continues to work independently of this choice.

Optional ChatGPT ad measurement: with your separate consent, we load the OpenAI pixel to attribute public page visits, completed registrations, started trials and confirmed new subscriptions to ChatGPT ads. OpenAI receives measurement events, attribution and cookie identifiers, browser and connection information and the selected plan. Supported customer data, such as email, is hashed in your browser before being sent for matching; hashing does not make it anonymous. We do not send passwords, raw form contents, YouTube data or private workspace content. Ad personalization remains disabled. Accepting Google Analytics or the service terms does not enable this measurement.

The separate ad choice is stored in lince_ads_consent_v1 for up to 180 days across lincestudio.app and its subdomains. After acceptance, the pixel may use __oppref for up to 30 days and __obref for up to 365 days for attribution. You can reject or withdraw this consent in Cookie preferences on the website, registration page or Billing. Withdrawal stops future measurement and removes accessible attribution cookies; it does not automatically delete information already received by OpenAI. Contact us to request deletion. Your choice does not affect registration, payment or use of Lince.

Cloudflare may use security cookies depending on the protection features or challenges applied; visiting the site does not mean that every Cloudflare cookie is installed.

When you open the form to add a payment method, the Stripe interface loads before you save the method. Stripe may process transaction, device and form-interaction data to provide and improve its services, authenticate, prevent fraud and analyse service performance. It may use cookies and similar technologies depending on the feature and region. Its current Privacy Policy and Cookie Policy explain the purposes and available choices; these technologies are not all treated as exempt from consent.

The form may offer Link, Stripe’s service for saving and reusing payment details, with its own controls. Depending on the selected country, the address field may offer Google Maps suggestions integrated by Stripe.

Retention, withdrawal and deletion

We retain active account and workspace information to provide the features you use. You can request account deletion in Settings → Profile and cancel it before the displayed 72-hour deadline. During this period your account and access remain available. Irreversible processing starts only after that period and may remain pending until subscription closure and the relevant cleanup are verified. For requests or questions about deletion, contact contact@nanami.studio.

Account deletion removes access and anonymizes the account identity after closing the associated subscription. Invoices and transaction receipts, shared authorship and certain security records are retained separately where applicable; we can explain continuing retention and its reason. Collaborators' own accounts and remote YouTube content are preserved. Completion confirms account closure and removal of local access, not immediate physical erasure of every stored copy.

A deletion request also starts a request to pause future subscription renewals; its status shows whether the pause has been confirmed. Cancelling deletion does not itself trigger a charge. If a renewal became due, recovering it requires your review and an explicit step in Stripe. Cancelling a membership alone does not delete the account or its data. Account deletion, membership cancellation and withdrawal of Google access are separate procedures.

A channel owner can choose Delete channel from the channel's actions to request removal of the channel from Lince and deletion of its imported YouTube data, without changing your Google account's permissions. This stops the affected local connection and creates a receipt with status and a deadline. YouTube work is paused while the operator checks the affected scope, including linked records and mixed reports. Files, workspace comments and other manual work unrelated to the request are preserved. Reconnecting creates a new workspace and does not restore the previous one. Requests received through Lince are handled within seven days, including affected recovery copies under our control. The status shows completion only after verification; it does not claim immediate erasure.

Withdraw Google access, also in the channel's actions, asks Google to revoke Lince's access and removes the channel from Lince under the same procedure and seven-day period as Delete channel. Google applies the revocation to the whole Google account, so other channels you authorized with that account stop syncing until you reconnect them. If Google does not confirm the revocation, the status says so and you can complete it in Google security settings.

Stop syncing disables synchronization and metadata editing through that local connection while keeping the channel and its stored history. To resume syncing, reconnect with Google. Your Google account's permissions remain unchanged. You may also revoke access in Google security settings. Revocation can affect other channels authorized under the same Google account and project. When Lince detects an external revocation, it stops use and opens a deletion case. For a request made outside the app, contact us so we can identify the account or channel promptly.

Recovery copies are encrypted. A YouTube-data deletion case replaces affected copies with a verified copy of the remaining data and removes the affected older copies. A separate minimal withdrawal record prevents an older restore from silently restoring access. Exports or copies already delivered to collaborators or external providers need their corresponding deletion process. A Lince deletion does not delete information held independently by YouTube.

Requests, rights and changes

Contact us to request access, correction, deletion or a copy of information associated with you, or to raise an objection or ask about restrictions and withdrawal of consent where applicable. Identify the relevant account without sending credentials. We may need to verify that a request is yours and respect other people's rights. You may also contact the relevant data-protection authority where applicable.

We process information to provide the service you request, follow your choices, protect the service and meet legal obligations as applicable. We publish policy changes here and bring material changes to participants' attention before new uses take effect. Additional consent is requested when required.