DuoCast

Privacy Policy

Last updated: 20 September 2026.

Who we are

DuoCast is operated by CO2Zero Technologies LLC, 111 North Orange Avenue, Suite 800, Orlando, Florida 32801, United States. Privacy and data questions can be sent to info@co2zerotechnologies.com.

What we collect

  • Account data — name, email, hashed password, plan slug, terms-accepted timestamp.
  • Show / episode content — what you create on the platform, including topics, scripts, voice / avatar IDs, and generated media.
  • Provider call metadata — for cost meters: provider name, stage, estimated cost. We do not log raw provider responses.
  • YouTube API data — when you connect a YouTube channel, we receive its channel ID, display name, profile image, granted scopes, encrypted OAuth access and refresh tokens, and the identifiers, visibility and processing status of videos that you ask DuoCast to upload. We never receive or store your Google password.
  • Meta Platform Data — when you connect Facebook or Instagram, we receive the identifiers, display names and profile images of the Page or professional account you authorize, the permissions granted, encrypted access tokens, and the identifiers and processing status of content that you ask DuoCast to publish.
  • WhatsApp customer-service data — when you contact our business number, we receive your phone number, message text, message identifier and media that you choose to send. Message content and the sender number are encrypted at rest and are used to answer your request, prepare an order, provide status updates and deliver the requested content.
  • TikTok connection data — account identifiers, display name and profile image, granted permissions, encrypted authorization tokens, available posting settings, and the identifiers and processing status of submissions you request. DuoCast does not receive your TikTok password.
  • Billing — handled by Stripe; we receive customer/subscription IDs but never your full card number.
  • Cookies — required session cookies for auth, plus a locale preference cookie. No third-party tracking by default.

How DuoCast uses YouTube API Services

DuoCast uses YouTube API Services only to identify the channel you selected, upload videos and metadata you explicitly approve, show the upload status, and maintain the connection needed for scheduled publishing. Before an upload, you can choose whether a video is public, unlisted, or private and whether it is made for kids.

By connecting or using YouTube through DuoCast, you also agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

How DuoCast uses Meta Platform Data

DuoCast uses Meta Platform Data only to identify a Facebook Page or professional Instagram account that you administer, publish organic videos and captions that you explicitly approve, display publication status, and maintain the connection needed for scheduled publishing. Our WhatsApp assistant uses customer-initiated messages to collect a production brief, answer questions, provide payment or status links, request human help when needed, and deliver the result. We do not sell Meta Platform Data or use it for third-party advertising.

TikTok connection and publishing

DuoCast uses this data to identify your connected account, obtain its current posting options, and send the video, caption and settings you review and approve. We query TikTok for the resulting processing status. TikTok handles the data it receives under its own Privacy Policy.

Disconnecting TikTok in publishing settings deletes the locally stored connection, encrypted tokens and associated publishing job records. You can also remove DuoCast access in TikTok's app permissions. Local disconnection does not delete videos already held by TikTok or recall a submission already sent there. Your source episodes and media remain separate from the connection. For access, correction or deletion requests, contact the privacy email above.

Subprocessors

We share the minimum necessary data with these subprocessors to operate the service:

  • Neon (Postgres hosting)
  • Cloudflare R2 (asset storage)
  • Vercel (hosting)
  • OpenAI (conversation and script generation, when configured)
  • AIMLAPI (music generation, when configured)
  • ElevenLabs (voice synthesis)
  • Replicate / RunPod / D-ID / HeyGen / Tavus / Hedra (media generation, when configured)
  • Shotstack (video assembly)
  • Stripe (payments)
  • Resend (transactional email)
  • Sentry (error monitoring)
  • Postiz (social scheduling and publishing, when configured)
  • Google / YouTube (channel authorization and publishing, when connected)
  • TikTok (account authorization and publishing, when connected)

Why we process data

  • To provide the service (legal basis: contract).
  • To send transactional + safety emails (legal basis: legitimate interest).
  • To bill you (legal basis: contract).
  • To comply with our legal obligations.

Your rights (LGPD / GDPR)

You have the right to access, correct, delete, port, or restrict processing of your data. Email info@co2zerotechnologies.com. You may also lodge a complaint with your local data protection authority.

YouTube connection, revocation, and deletion

You can disconnect a YouTube channel at any time from DuoCast publishing settings. DuoCast then asks Google to revoke the token and deletes the locally stored authorization and channel data. Deleting your DuoCast account performs the same cleanup for every connected channel. You can also revoke access directly in your Google security settings. If authorization can no longer be refreshed, we remove the related YouTube API data. A verified deletion request is completed as soon as possible and no later than seven calendar days.

Retention

We keep account data while the account is active and for up to 30 days after deletion (legal/accounting holds may extend retention for billing records up to 5 years per Brazilian tax law).

YouTube authorization tokens are retained only while your connection is active. Other authorized YouTube API data is deleted or refreshed within 30 days, unless a shorter deletion period above applies. Deleting data from DuoCast does not delete videos stored by YouTube; manage those videos in YouTube Studio.

Meta connection, revocation, and deletion

You can disconnect a Facebook Page or Instagram account at any time from DuoCast publishing settings. DuoCast then deletes the locally stored authorization, encrypted token and connected-account metadata. Deleting your DuoCast account performs the same local cleanup for every connected Meta destination. You can also remove DuoCast directly from your Facebook or Instagram business integrations. A WhatsApp customer may request access, correction or deletion by contacting the privacy email above; verified requests are completed as soon as possible and no later than 30 days, unless a legal or financial record must be retained.

Children

DuoCast is not intended for users under 13. Content created on DuoCast targeting children must use child-safe scenes and styles configured in the show settings.

International transfers

Some subprocessors are based outside Brazil/EU; we use the providers' Standard Contractual Clauses where applicable.