Privacy policy

Influencing Studio · last updated 28 September 2026

How Influencing Studio handles information: the owner's connected accounts, and the comments and messages people send to them.

The short version

Influencing Studio is a private tool used only by its owner, Dhiren Appalraju, for his own accounts.
Influencing Studio uses YouTube API Services: see the YouTube Terms of Service and the Google Privacy Policy.
YouTube comment text and other non-statistical YouTube data are deleted or refreshed within 30 days.
Deletion requests are carried out within 7 days. Remove access any time at the Google security settings page.
No advertising, no selling of data, no cookies on these pages.

Who we are

Influencing Studio (“the Studio”) is a private publishing tool. It's run, and used only, by its owner.

Data controller: Dhiren Appalraju, a sole trader in the United Kingdom, trading as [To fill: trading name (hollis)], [To fill: trading name (nana)] and [To fill: trading name (dotty)]. “We” and “us” in this policy mean Dhiren Appalraju.
Contact: privacy@studio.hollishotkey.com
Postal address: [To fill: business postal address]
ICO registration: [To fill: ICO registration number]

A private tool with one user

The Studio has no public sign-up and no other users. Only its owner can sign in, through Cloudflare Access. It connects only the social media accounts he owns and manages, and it never asks anyone else to sign in or to connect an account.

These public pages (this policy, the terms, the data deletion instructions and the home page) collect nothing and set no cookies.

YouTube API Services

Influencing Studio uses YouTube API Services. By using YouTube features through Influencing Studio you're also bound by the YouTube Terms of Service, and Google's handling of information is described in the Google Privacy Policy.

What it accesses: Only the YouTube channels its owner connects (his own persona channels): each channel's name, avatar and ID; its videos and their details; the channel's statistics and YouTube Analytics reports; and comments on its videos (the commenter's public display name and channel, the comment text and when it was posted).
Permissions it asks for: Upload videos (youtube.upload); read the channel and its videos (youtube.readonly); read the channel's analytics (yt-analytics.readonly); and manage comments and captions on its own videos (youtube.force-ssl).
How it's used: To upload the videos the owner approves, with the title, description, privacy setting, made-for-kids setting and the “altered or synthetic content” disclosure set; to show each channel's own statistics (never added together across channels); and to show comments so the owner can reply or moderate.
Where it's kept: The access token is stored only in Microsoft Azure Key Vault. The Studio keeps the channel's name and avatar, its statistics, and (when the inbox is built) comments, in Microsoft Azure storage in the UK.
How long: Comment text and all other non-statistical YouTube data are deleted or refreshed within 30 days. Statistics are kept while the channel stays connected; the Studio re-checks its authorisation every day (so at least every 30 days) and deletes the channel's data if access has been withdrawn.
Removing access: You can remove Influencing Studio's access to a Google account at any time on the Google security settings page. The Studio notices at its next daily check and deletes the data it got through that access, within 7 days.

Instagram, Facebook, TikTok and Pinterest

Posts to these platforms currently go out through Zernio, a publishing service that uses its own approved apps and acts for us as a processor (Zernio's privacy policy); Upload-Post is the standby service on the same terms. When the Studio connects Instagram, Facebook or Pinterest directly, it will use each platform's official sign-in and read only the owner's own accounts: their profile, posts, statistics, and the comments and messages people send them. TikTok isn't connected directly.

If you comment on or message our accounts

What we collect: Your public username or display name and what you wrote, with when and on which post. Nothing else: no email address, phone number, followers or profile details.
Why: To read it, reply to it (replies are drafted with AI and approved by a person), hide spam and abuse, and see which topics people care about.
Legal basis: Legitimate interests: running our accounts and keeping them safe.
How long: YouTube comments: no more than 30 days. Comments and messages from other platforms: up to 90 days. Then deleted.

The platform keeps its own copy of what you post. To remove it there, delete it on the platform.

How the information is used

Publishing the posts the owner approves, to his own accounts.
Analytics: showing each account's own statistics, labelled with their source. Figures the Studio works out itself are labelled “Calculated by Influencing Studio”.
Drafting replies to comments and messages, with AI (Anthropic's Claude), under terms that don't let it train on them. A person approves every reply.

There's no third-party advertising in Influencing Studio. We don't sell personal information, share it for advertising, or use it to train AI models.

Services that handle information for us, or alongside us
Who	What for	Their role
Microsoft (Azure, UK South)	Hosting the Studio's servers and storage, and Key Vault for access tokens	Processor
Cloudflare	Hosting these pages and the Studio's web app, access control (the owner's sign-in), and email routing	Processor
Anthropic	Drafting replies and sorting comments and messages	Processor
Zernio, and Upload-Post as standby	Publishing posts to the platforms	Processors
ntfy	Push notifications to the owner's phone (the Studio's own item names only)	Processor
Google (YouTube), Meta, TikTok, Pinterest	Running the platforms the Studio publishes to	Separate controllers
Our accountant, lawyer or insurer; police, regulators or courts	Professional advice, or where the law requires it	Separate controllers

Some of these services store or access information outside the UK, mainly in the United States and the European Union. Transfers to the EU and EEA rely on the UK's adequacy regulations; for the US we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified, or on the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

How long we keep it

Retention periods
Information	How long
YouTube comment text and other non-statistical YouTube data	Deleted or refreshed within 30 days
A connected channel's statistics	While the channel stays connected and authorised (re-checked daily)
Comments and messages from other platforms	Up to 90 days
Access tokens	Until the account is disconnected or access is withdrawn, then deleted
The Studio's server log (its own ids only, tokens masked)	30 days
Emails to hello@ and privacy@	Up to 2 years after our last message

Cookies

These public pages set no cookies and use no analytics, trackers or scripts.
The private Studio uses only the sign-in cookie that Cloudflare Access sets (CF_Authorization) when its owner signs in, and remembers his light or dark theme choice in his own browser.
Cloudflare may set a strictly necessary security cookie (such as __cf_bm) if it needs to check that a visitor isn't a bot.

How to remove access

Google and YouTube: the Google security settings page (third-party apps with account access).
Facebook and Instagram: in your account's settings, look for “Business integrations” or “Apps and websites” and remove the app.
Pinterest: Settings, then Security, then the apps with access to your account; remove the app.

In the Studio, its owner can also press Disconnect on the connected-accounts screen: that revokes access at the platform and deletes the stored data straight away.

Deleting your data

Email privacy@studio.hollishotkey.com with the subject “Delete my data”, or (for the owner's accounts) press Disconnect in the Studio. We delete the stored data within 7 days, usually the same day, and confirm by email. If access is removed at Google's security settings page instead, the Studio notices at its daily check and deletes within the same 7 days. Step-by-step instructions are on the data deletion page.

Your rights under UK GDPR

Under the UK GDPR and the Data Protection Act 2018 you have the right to get a copy of your information, to have it corrected or deleted, to limit or object to how we use it (we rely on legitimate interests, so you can object at any time), to take it with you in a common format, and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. To use any of them, email privacy@studio.hollishotkey.com. It's free, and we reply within one month.

Complaints

If you're unhappy with how we've handled your information, please tell us first at privacy@studio.hollishotkey.com; we acknowledge complaints within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

Keeping it safe

Only the owner can sign in (Cloudflare Access, one-time codes to his email). Access tokens are kept only in Azure Key Vault, never in the browser or in logs; the Studio's log masks any token before it's stored or shown. Connections are encrypted, and the Studio asks each platform only for the access it needs.

Changes to this policy

We'll update this policy when the Studio changes, and change the date at the top.