Privacy policy

This policy explains what personal data Shotread processes, why, and what you can do about it. It covers the website at shotread.com and the Shotread app at app.shotread.com. If anything here is unclear, email privacy@beyonditl.com.

Who we are

Shotread is operated by BeyondITL Inc., a Delaware corporation ("BeyondITL", "we", "us"). Postal address: 651 N Broad St, Suite 201, Middletown, Delaware 19709, United States. Contact for privacy questions: privacy@beyonditl.com, phone +1 (214) 487-8019.

Representative in the EU and the UK: [OWNER: lawyer to confirm whether an EU and a UK representative are required, and their details].

Two roles

• We decide (controller): for visitors to shotread.com, for people who email us, and for the accounts of people who sign in to Shotread (sign-in, billing, security and service messages).
• We act for the agency (processor): for what an agency puts into its workspace, such as its clients' material, comments, creators, guest reviewers, contacts and connected accounts. The agency decides what goes in and is responsible for it; we process it only to run Shotread for that agency. If your data is in an agency's workspace, contact that agency first; we help them answer you. Data processing agreement: [OWNER: link to the data processing agreement for agencies].

The website shotread.com

• The website sets no cookies and runs no analytics or advertising code. Its one form is on the request access page (see below).
• [OWNER: lawyer to word a line on first touches, needed before the switch agency_attribution_enabled is turned on: when a visit comes with campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) or from another site, a script copies those tags, the other site's domain name and whether an ad click id was present (never its value) onto the site's links into the app and into the request access form. Nothing is stored on the device and nothing is sent until the visitor asks for access or signs up.]
• Our web server records each request: IP address, time, the address requested, the referring page and the browser's description of itself. We use these logs to run and secure the site. They are kept for [OWNER: how long the web server keeps access logs on the box].
• The pages load their fonts from Google Fonts, so your browser sends your IP address and browser details to Google when a page loads. See Google's privacy policy.
• If you email us, we keep your message and address to answer you and for our records. Mail for shotread.com is hosted by DreamHost.

Requests for access

• When you ask for access, we keep your email address, the agency or company name if you give one, whether you asked about the design-partner pilot, when you asked and confirmed, and the words shown under the form. We do not store your IP address or browser details with the request.
• We use them to send you one email to confirm the address, to tell you when Shotread opens for new agencies, and, if you asked, to talk to you about the pilot. We do this because you asked us to (your consent).
• Every email from us has a link to remove your address. When you use it, we delete the agency name and keep the address only so we never email it again.
• [OWNER: lawyer to word, needed before agency_attribution_enabled is turned on: with a request we also keep how the visitor first found Shotread (the campaign tags, the referring site's domain name, and whether an ad click id was present, never its value), why (to learn which marketing brings agencies), the legal basis, and that it is deleted with the agency name when the address is removed.]

The Shotread app

What we process

• Account: your email address, name and picture from sign-in, and sign-in events. Sign-in runs on Auth0, which handles your password; we never see it.
• Workspace content: what you and your team add: clients, projects, scripts, comments, reviews, reports, files and the like.
• Connected accounts: when you connect an account such as a YouTube channel or a social profile, the access tokens (encrypted) and the data you ask Shotread to read, such as channel and video data, analytics, comments and messages.
• AI features: the text and images you send to an AI feature, and its answer. AI requests go to Google's Gemini API under terms where [OWNER: confirm a paid Gemini API tier, on which Google does not use prompts and answers to improve its products].
• Billing: the plan, payments and credit balance of the workspace, and the billing name and email of the person who pays. Card details are entered on Stripe's page and never reach us.
• Usage and logs: records of what was done in the workspace (an audit log), records of paid usage, and server logs of requests (routes, times, trace ids; no file contents).
• [OWNER: lawyer to word, needed before agency_attribution_enabled is turned on: for an account created while the switch is on, how the person first found Shotread (the campaign tags or the referring site's domain name the visit came with, and whether an ad click id was present, never its value), kept with the account and shown to Shotread staff only as counts and revenue per source; the legal basis and how long it is kept.]

Why, and on what legal basis

• To provide Shotread under our agreement with you or your agency (contract).
• To keep Shotread secure, prevent abuse and fix problems (legitimate interests).
• To keep billing and tax records (legal obligation).
• To send service messages, such as invitations, review requests and security notices (contract and legitimate interests). We do not send marketing email without your consent.

We do not sell personal data, and we do not use your workspace content to train AI models.

YouTube and Google data

Shotread uses YouTube API Services. If you connect a YouTube channel or use YouTube features, you also agree to the YouTube Terms of Service, and Google's privacy policy applies to Google's handling of that data. You can remove Shotread's access to your Google account at any time at Google's security settings; disconnecting the channel in Shotread deletes its access tokens too.

Shotread's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Shotread is not affiliated with or endorsed by YouTube or Google.

Who processes data for us

These services process data on our behalf, only to run Shotread:

An agency can also connect its own providers (for example a social network, an analytics service or its own storage bucket). Those are chosen by the agency and listed for the workspace owner in the app under Settings, Platform, Data and privacy.

Where data is processed

Shotread's server runs in Amazon Web Services' US East (N. Virginia) region in the United States, and some of the services above process data in the United States and other countries. Transfers out of the EU and the UK rely on [OWNER: lawyer: the transfer safeguard, for example the EU Standard Contractual Clauses and the UK addendum].

How long we keep data

• Accounts and workspaces: while the account or workspace exists. When an owner deletes a workspace, it is removed 14 days after the request: stored files first, then the records.
• Records an agency chooses: a workspace owner can set how long some kinds of records are kept, such as inbox text, ticket text, form answers, read notifications and webhook payloads.
• API call logs: 30 days.
• Audit log: at least 365 days, so changes can be checked later.
• Backups: daily database copies on the server are replaced after 14 days. Encrypted off-site copies, where switched on, are deleted after 8 days (daily), 35 days (weekly) and 100 days (monthly).
• Billing records: as long as tax law requires.
• Requests for access: until you remove your address, and no longer than [OWNER: how long requests are kept after Shotread opens, for example 12 months].
• [OWNER: how long the first touch kept with an account is kept, for example as long as the account; a request's first touch goes when the request does]

Cookies and browser storage

The website shotread.com sets no cookies. The app at app.shotread.com uses only what it needs to work:

Sign-in pages and Stripe's payment pages run on Auth0's and Stripe's own domains, which set their own cookies under their policies. Shotread uses no advertising or analytics cookies.

[OWNER: lawyer to confirm, before agency_attribution_enabled is turned on, whether this needs consent or a row in the table above: while a new visitor signs in, the app carries the campaign tags it opened with through the sign-in step inside the sign-in library's own record in the tab's session storage (removed when sign-in finishes), so they can be kept with the new account. Nothing else is stored in the browser for this, and shotread.com itself still sets no cookies.]

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, limit or object to how we use it, or move it to another service. Email privacy@beyonditl.com; we answer within one month. If your data is in an agency's workspace, the agency can find, export and erase it in Shotread; we will pass your request to them. You can also complain to your data protection authority.

Children

Shotread is a tool for businesses and is not meant for children. We do not knowingly process data of anyone under [OWNER: confirm the minimum age, for example 16].

Security

How we protect data is described on the security page.

Changes to this policy

When we change this policy, we change the date at the top. If a change is significant, we also tell workspace owners by email before it takes effect.