Privacy, without ambiguity.

This policy explains what we collect, why we collect it, and how you can request access or deletion. If you have questions, contact us and we'll answer clearly.

• Account data: email, name, and basic billing info (if applicable).
• Product usage: actions you take inside the app (for reliability, support, and product improvement).
• Content you provide: brand inputs, notes, uploads, and campaign drafts you create.

We aim to minimize collection. If something isn't needed to run the product safely and reliably, we avoid it.

• To provide the service and generate requested outputs.
• To secure accounts, prevent abuse, and keep the product stable.
• To support you (respond to issues and requests).
• To improve reliability and usability (measuring what's working, what's failing).

We do not use your private content for unrelated advertising. We don't sell your data.

OceanDrive can store structured brand context (your "Brand Brain") to keep outputs consistent. You control what you provide, what you save, and what you publish.

OceanDrive uses YouTube API Services to allow you to connect your YouTube channel, upload scheduled videos, and view analytics inside the app. By connecting your Google account, you also agree to Google's Privacy Policy.

• youtube.upload: Used to upload videos you schedule in OceanDrive directly to your YouTube channel on your behalf.
• youtube.readonly: Used to read your connected channel information (channel ID, title) to verify the connection.
• yt-analytics.readonly: Used to display your YouTube video performance data (views, watch time, subscribers) inside the OceanDrive analytics dashboard.

You can revoke OceanDrive's access to your Google account at any time via Google Account Permissions. Revoking access will disconnect your YouTube channel from OceanDrive.

OceanDrive's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, OceanDrive:

• Only uses access to read, write, modify, or control Gmail, Drive, Calendar, and other Google data to provide or improve user-facing features that are prominent in OceanDrive's user interface.
• Does not transfer Google user data to others unless doing so is necessary to provide and improve these features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• Does not use Google user data for serving ads, including retargeting, personalized, or interest-based advertising.
• Does not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, it is necessary to comply with applicable law, or our use is limited to internal operations and the data (including derivations) have been aggregated and anonymized.

OceanDrive integrates with Meta's Graph API to allow you to connect your Instagram Business and Facebook Page accounts. We request the following permissions:

• instagram_content_publish: Used to publish scheduled posts and Reels to your Instagram Business account on your behalf.
• instagram_basic / pages_read_engagement: Used to read your connected account information and verify the integration.
• instagram_manage_insights: Used to display post performance data (impressions, reach, engagement) in your analytics dashboard.
• pages_manage_posts: Used to publish content to your connected Facebook Page.

Your use of Meta's services is subject to Meta's Privacy Policy. You can revoke access at any time via your Facebook Business Integrations settings.

When you connect your TikTok account, OceanDrive uses the TikTok Content Posting API to publish scheduled videos on your behalf. We do not access your TikTok inbox, followers list, or any data beyond what is required to post content and read basic account information.

Your use of TikTok's services is subject to TikTok's Privacy Policy.

When you connect your LinkedIn account, OceanDrive uses the LinkedIn Marketing API to publish scheduled posts to your profile or Company Page on your behalf. We request only the minimum permissions required to post content and read basic profile information.

Your use of LinkedIn's services is subject to LinkedIn's Privacy Policy. You can revoke access via your LinkedIn account settings.

OceanDrive may process data about your customers (leads, contacts, funnel visitors) as part of operating the service. This data is processed on your behalf — you are the data controller and OceanDrive acts as a data processor.

• What we collect: Names, email addresses, and behavioral data (page visits, funnel interactions) that your customers provide or that are captured by OceanDrive's tracking tools you choose to enable.
• How it's used: Solely to provide you with the CRM, funnel, and analytics features of the service. We do not use your customers' data for our own marketing or sell it to third parties.
• Your responsibility: You are responsible for ensuring you have a lawful basis to collect and process your customers' data and for maintaining your own privacy notice that covers this collection.
• Deletion: When you delete your OceanDrive account, customer data associated with your workspace is deleted within 30 days, except where retention is required by law.

We may share data with trusted processors to operate the service, such as:

• Hosting and infrastructure providers
• Email delivery providers (for product emails you request)
• Payment processors (for billing)

We may also disclose information if required by law or to protect safety and prevent fraud.

We retain data for as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion; some records may be retained when legally required (for example, billing records).

We use industry-standard measures designed to protect your information. No system is perfect, but we aim for strong defaults: encryption in transit, access controls, and monitoring.

• Request access to your data.
• Request correction of inaccurate data.
• Request deletion (subject to legal retention needs).
• Request export where applicable.

EU/EEA users (GDPR): You have the right to object to processing, request restriction, and lodge a complaint with your local data protection authority. Our lawful basis for processing is contractual necessity (to provide the service you signed up for).

California residents (CCPA): We do not sell your personal information. You have the right to know what personal information we collect, request deletion, and opt out of any future sale (we do not sell data). To exercise these rights, email support@getoceandrive.com.

OceanDrive is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it. This complies with the Children's Online Privacy Protection Act (COPPA) and the EU GDPR Article 8.

In compliance with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), effective August 2026, OceanDrive discloses the following:

• AI-generated content: Content produced by OceanDrive's AI features is machine-generated. It is always subject to your review and approval before publication.
• Human oversight: OceanDrive does not autonomously publish content without user initiation or scheduled authorization. You remain in control of what is published.
• No high-risk AI use: OceanDrive does not use AI for purposes classified as high-risk under Annex III of the EU AI Act (e.g., biometric identification, employment decisions, credit scoring).
• Bias and accuracy: AI outputs may contain errors, bias, or inaccuracies. We recommend reviewing all outputs before use.

Where OceanDrive acts as a data processor on your behalf (processing your customers' data), we commit to the following as required by GDPR Article 28:

• We process personal data only on your documented instructions.
• We ensure persons authorized to process the data are bound by confidentiality.
• We implement appropriate technical and organizational measures as required by GDPR Article 32.
• We do not engage sub-processors without your prior written authorization (general authorization is granted by accepting these terms; a list of current sub-processors is available on request).
• We assist you in responding to data subject rights requests to the extent reasonably possible.
• We delete or return all personal data upon termination of the service, at your choice, unless retention is required by law.

For enterprise customers requiring a signed Data Processing Agreement (DPA), contact support@getoceandrive.com.

Email us at support@getoceandrive.com

If you're already using OceanDrive, include your workspace/brand name and a short description of what you're trying to do.