How Ovation handles information

1. Information we handle

• account email, authentication state, legal consent, and creator profile settings;
• an encrypted verified phone number, a keyed phone fingerprint, last four digits, SMS consent, preferences, opt-out state, and delivery records when SMS is enabled;
• saved public Instagram, TikTok, and YouTube identifiers;
• encrypted X read-only credentials and public account identifier;
• subscription status and limited Stripe identifiers;
• derived reports, coverage, public supporting-post links, schedules, change alerts, report comparisons, and Action Log notes; and
• security, delivery, support, export, and deletion records.

2. Public audience sources

Instagram, TikTok, and YouTube are saved public sources. YouTube is accessed with a server-only Data API key; the user does not grant Ovation access to a Google account. X uses revocable read-only authorization to retrieve the creator’s public posts and replies.

Public YouTube comments are excluded unless Swaynexa has recorded the required provider approval and enabled the server-side gate. Ovation does not collect private messages, restricted posts, account passwords, or competitor/topic monitoring at launch.

Raw public comments are processed in bounded worker memory and may be sent to the disclosed analysis provider for the requested report. Ovation does not persist raw comments in its database, logs, cache, object storage, report history, or browser response.

3. Why we use information

We use information to authenticate users; verify plan and quota; collect eligible public signals; create, save, compare, email, text, and delete reports; verify phone ownership; process delivery preferences and opt-outs; detect meaningful change; maintain the Action Log; process payments; prevent abuse; provide support; and satisfy security, legal, and provider obligations.

Scores, classifications, alerts, and comparisons are model-assisted directional estimates. Ovation does not use them to make legal, employment, credit, housing, insurance, or similarly high-impact decisions.

4. Service providers

Ovation uses Supabase for authentication/database, Vercel for application hosting, Stripe for billing, Resend for transactional email, Twilio for phone verification and transactional SMS, Anthropic for structured analysis, Bright Data for supported public Instagram/TikTok collection, YouTube Data API v3 for public YouTube data, and X for authorized public posts/replies.

Stripe receives payment information through its hosted pages. Resend receives the current confirmed account email and escaped report content only when email delivery is enabled. Twilio receives the verified phone number, verification and opt-out events, SMS body, exact report link, and delivery metadata only when phone verification or SMS delivery is requested. Anthropic receives bounded source text needed for analysis, subject to the production organization’s configured data arrangement.

5. Retention

• Account settings, derived reports, actions, and schedules remain while the account is active or until deleted, subject to legal/security exceptions.
• X credentials remain until disconnect, revocation, expiry, or account deletion and are encrypted at rest.
• Email outbox records do not persist the recipient address; the confirmed address is resolved at send time.
• The verified phone number is encrypted at rest and decrypted only after a final delivery authorization. Removing the number or deleting the account removes the stored destination under the account-deletion workflow.
• SMS outbox records do not persist the plaintext destination. Provider status events are retained for up to two years for delivery, opt-out, abuse, and compliance records, subject to required legal exceptions.
• Raw comments are not retained by Ovation. Processor retention follows the current provider contract and must be reverified before launch.
• Billing, tax, fraud, consent, and security records can be retained for legally required periods.
• Residual backups expire under the documented backup schedule.

6. Choices and requests

Users can disable monitoring, report email, or either SMS category; remove a verified number; reply STOP to text delivery; disconnect X; delete individual reports; request an export; or delete the account. A bounce or complaint can suppress future email. A STOP request, invalid number, or provider delivery signal can suppress future SMS until the user completes the applicable recovery flow.

Privacy and support requests: help@swaynexa.com. Deleting Ovation data does not delete provider-controlled public posts or comments.

Provider references: YouTube Terms, Google Privacy Policy, and YouTube API developer policies.

7. Operator and privacy contact