Privacy Policy

Last updated: September 7, 2026 · PIPEDA & Québec Law 25

supo ("we", "us") respects your privacy. This policy explains what personal information we collect, why, how we use and protect it, and your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, Québec's Act respecting the protection of personal information in the private sector ("Law 25").

1. What we collect

Account: your email address and a securely hashed password.
Billing: we use a third-party payment processor; we do not store your full card number. We keep a record of your plan, credits, and transactions.
Content you submit: the videos you upload or stream URLs you provide, and the transcripts, clips, captions, and thumbnails generated from them.
Connected social accounts: if you connect an account on TikTok, X (Twitter), or YouTube, we store the access and refresh tokens that platform issues to us, plus the public profile details it returns (such as your open ID, username or display name, and avatar). We never receive or store your password on any of these platforms. Where you connect TikTok for analytics, we also store the public metrics TikTok returns for videos you posted through supo (views, likes, comments, shares).
Usage & technical: jobs, settings, IP address (for security and rate-limiting), and session cookies needed to keep you signed in.

2. Why we use it (purposes & consent)

We use your information to provide and operate the Service: to create your account, process your content into clips, run billing, send essential emails (verification, password reset), prevent abuse, and improve the Service. By using supo you consent to these uses; you can withdraw consent (see your rights below), though some uses are necessary to provide the Service.

3. Service providers & sharing

We do not sell your personal information. We share it only with providers who help us run the Service, under contract, including: an AI provider that processes transcripts and sampled video frames to select clip moments; a payment processor; an email-delivery provider; and, if you enable it, a social-posting provider. Each receives only what it needs.

If you choose to publish a clip, we send that clip and the caption you approved to the platform you selected — TikTok, X (Twitter), or YouTube — using that platform's official API, either directly or through a posting provider acting on our behalf. Nothing is sent to a platform unless you have connected that account and asked us to post.

4. Storage outside Canada

Some of our service providers (including our AI, payment, and email providers) are located in the United States, so your personal information may be stored or processed outside Canada and may be subject to the laws of those jurisdictions. We take reasonable steps to ensure it is protected to a comparable standard.

5. Connected social platforms (TikTok, X, YouTube)

Connecting a social account is entirely optional; supo works without it. When you connect one, we ask that platform only for the permissions we need to publish on your behalf and, where you enable it, to read back the public metrics of the videos supo posted.

TikTok. We use TikTok's Login Kit, Content Posting API, and Display API. We receive your open ID, display name, and avatar, and — only for videos you post through supo — their view, like, comment, and share counts. We use TikTok data solely to show you which account you are posting to, to publish the clip you approved with the privacy setting you select at the moment of posting, and to report the result back to you. We do not use TikTok data for advertising, we do not sell it, and we do not share it with any third party other than the posting provider that transmits the clip on our behalf. Your use of TikTok through supo is also governed by TikTok's own Privacy Policy and Terms of Service.
X (Twitter) and YouTube. We receive the account handle or channel name and the tokens needed to publish, and we use them only to post the clips you approve. Your use of those platforms through supo is also governed by their own terms and privacy policies. Information received from Google APIs is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting and deletion. You can disconnect any social account from your supo settings at any time. Doing so revokes and deletes the tokens we hold for it and stops all posting to that account. You can also revoke supo's access from inside the platform itself — on TikTok, under Settings and privacy → Security and permissions → Manage app permissions. Deleting your supo account deletes the connected-account records along with it. To request deletion of platform data we hold, contact our privacy officer below.

6. Retention

We keep your information for as long as your account is active and as needed to provide the Service and meet legal obligations. You can delete your clips at any time, and you can ask us to delete your account and associated personal information.

7. Your rights

Under PIPEDA and Law 25 you may, subject to legal limits:

access the personal information we hold about you and request a copy;
correct inaccurate information;
withdraw consent and request deletion of your account and data;
request portability of the computerized personal information you provided (Law 25);
make a complaint to us or to the relevant privacy regulator.

To exercise these rights, contact our privacy officer below.

8. Security

We use reasonable technical and organizational safeguards - including password hashing, access controls, and encrypted connections - to protect your information. No method of transmission or storage is perfectly secure, but we work to keep your data safe and will notify affected users and regulators of a confidentiality incident where the law requires.

9. Cookies

We use a small number of cookies that are strictly necessary to sign you in and keep your session secure. We do not use third-party advertising cookies.

10. Children

supo is not directed to children and is intended for users who are the age of majority in their province or territory.

11. Privacy officer & contact

Privacy Officer - supo
Sam Brulé
Email: privacy@supo.live

12. Changes

We may update this policy; material changes will be posted here with a new "last updated" date.

Provided for transparency; not legal advice. Law 25 requires a designated person responsible for the protection of personal information - complete the privacy-officer name above, and review with counsel before launch, especially regarding cross-border transfers and breach-notification obligations.