Your data and your choices

Privacy Policy

Effective and last updated: 28 August 2026

This policy explains how CampaignDone collects, uses, stores, shares and deletes personal data, including information accessed through YouTube API Services.

1. Who we are

CampaignDone is operated by CloudVigil AB, a Swedish limited company with registration number 559588-0393 and registered office in Kista, Stockholm, Sweden ("CampaignDone", "CloudVigil", "we", "us"). CloudVigil AB is the data controller for the processing described in this policy unless a separate agreement says otherwise.

2. Scope

This policy applies when you visit campaigndone.com, use the CampaignDone application or Frame Zero video workflow, contact us, or connect a third-party platform account such as YouTube.

3. Information we collect

Information you provide

• Account and organisation information, including your name, email address, role and company.
• Brand information, website addresses, campaign goals, prompts, instructions and approvals.
• Content and assets you upload, create, edit, schedule or publish, including text, images, audio and video.
• Support messages and any information you choose to include in them.

Information from connected platforms

When you connect a social-media account, authentication takes place on the platform's own service using OAuth. We do not receive or store your platform password. Depending on the platform and permissions you approve, we may receive:

• Account or channel identifiers, names, profile images and the scopes you granted.
• Access and refresh tokens needed to provide connected features.
• Content metadata, publication status, platform identifiers and performance statistics for content managed through the service.
• Other owner-authorised information needed for a feature you have chosen to use.

Technical information

We collect limited technical information needed to operate and secure the service, such as IP address, browser and device information, requested pages, timestamps, session identifiers and error logs. The public marketing site does not use advertising or cross-site tracking cookies. The application uses essential session and security cookies required for sign-in and account protection.

4. YouTube API Services

CampaignDone uses YouTube API Services in its Frame Zero research and publishing workflow. The following disclosures apply specifically when you search public YouTube content or connect and authorise a YouTube channel.

YouTube data we access and store

We may access and store YouTube channel identifiers and names, OAuth access and refresh tokens and granted scopes, public video and channel metadata and statistics, publication identifiers and status, and owner-authorised channel or video statistics. Frame Zero may also store the topical query, market, language, sample boundary and observation date associated with a user-directed public YouTube search. CampaignDone never receives or stores your Google or YouTube password.

How we use YouTube data

We use this information only to verify the channel you authorised, show clearly labelled YouTube evidence, upload a final video after your express approval, display publication status and show relevant results for your channel. We do not sell YouTube API Data, use it for unrelated advertising, aggregate authorised data across content owners, or use it to create substitute monetisation, revenue, watch-time, demand or "viral" scores.

Sharing, retention, deletion and revocation

Authorised YouTube data is visible only within the authorising organisation to people that organisation has permitted. We share it only with service providers needed to operate the requested feature and with YouTube when performing an action you approved. OAuth tokens are encrypted and retained only while the connection is active. Non-authorised YouTube API Data is refreshed or deleted within 30 days.

You can revoke CampaignDone's access at any time from Google's security permissions page. To request deletion, email [email protected] with the subject "Data Deletion Request". YouTube user data covered by a valid request will be deleted as soon as possible and within seven calendar days, unless the law requires us to retain it.

5. How and why we use information

We process personal data to:

• provide accounts, campaign and video workflows, connected-platform features, publishing, analytics and support;
• generate requested content and operate human review, safety, rights and approval controls;
• protect accounts, prevent abuse, troubleshoot problems and maintain audit records;
• improve reliability and usability using appropriately limited operational information; and
• comply with legal obligations.

Under the GDPR, our principal legal bases are performance of a contract (Article 6(1)(b)), our legitimate interests in operating and securing the service (Article 6(1)(f)), consent where required (Article 6(1)(a)), and compliance with legal obligations (Article 6(1)(c)).

6. How we share information

We share information only as needed with:

• the social platforms you connect, when carrying out an action you requested;
• hosting, storage, security, monitoring and other service providers acting under contract for us;
• AI and media-processing providers when you request a generation or production feature; and
• authorities or professional advisers when required by law or necessary to protect legal rights.

Authorised YouTube data is visible only within the authorising organisation to people whom that organisation has permitted. We do not share it with other customers or use it to train a general-purpose AI model. We do not sell personal data.

7. Storage, international transfers and security

We store data primarily within the EU/EEA. Where a provider processes information outside the EU/EEA, we use an applicable adequacy decision, the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

We use safeguards designed to protect information, including TLS in transit, encryption of connected-account tokens, tenant separation, least-privilege access controls, logging and operational monitoring. No system can be guaranteed completely secure.

8. Retention

• OAuth tokens are retained while the connection remains active and are removed when the connection or related account is deleted.
• Non-authorised YouTube API Data is refreshed or deleted within 30 days.
• Where YouTube policy permits authorised statistics to be kept for longer, we revalidate authorisation and source availability at least every 30 days.
• Campaigns, creative versions, uploaded assets and publication records are kept while the account is active and as needed to provide the service.
• Support correspondence is generally kept for up to 24 months. Records required by Swedish law, such as accounting records, are kept for the legally required period.

9. Your choices and deletion

You can revoke CampaignDone's access to your Google or YouTube account at any time from Google's security permissions page. You can also disconnect a platform account within CampaignDone where that control is available.

To request access, correction, export or deletion, email [email protected] with the subject "Data Deletion Request" and identify the CampaignDone account or connected channel. We may verify your identity before acting. YouTube user data covered by a valid request will be deleted as soon as possible and within seven calendar days, unless retention is required by law.

Revoking CampaignDone's access or deleting data held by CampaignDone does not delete content or data held by YouTube. To delete information from YouTube itself, use YouTube or another authorised client that supports deletion.

10. Your GDPR rights

Where the GDPR applies, you may have rights to access, rectify, erase, restrict or object to processing, and receive a portable copy of your personal data. You may withdraw consent where processing relies on consent. You may also complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

11. Children

CampaignDone is a business service for adults and is not directed to children. You must be at least 18 years old to hold an account.

12. Changes

We may update this policy as the service, law or platform requirements change. We will update the date above and provide additional notice when a change materially affects how we use personal data.

13. Contact