Privacy Policy

Maestro Media, operator of Framesite (the "Service"). Effective July 22, 2026.

This explains what we collect, why, and what we do with it. Plain language, no surprises. The Service is in beta and this policy may change as it matures.

1. What we collect

• Account and demo details you give us: your name, work email, company or agency name, website, and the workspace, brand, and client information you set up. We may collect these details while a free demo is still processing so we can save that work and begin the website read you requested.
• Your Content: the video, audio, transcripts, images, documents, and links you upload or import, and the pages you generate from them.
• Usage data: standard logs and necessary cookies used to run and secure the Service, plus optional Google Analytics information about how you use Framesite when you allow analytics.
• Billing details handled by our payment processor, Stripe, whose privacy policy governs the card data you enter. We do not store your full card number.

2. How we use it

We use your information to provide the Service: to transcribe, analyze, and build pages visible to AI from Your Content, to run your account and billing, to keep the Service secure, and to support you. We do not sell your personal information.

If you separately choose the optional product-updates checkbox, we may also email practical Framesite tips and product news. You can unsubscribe at any time. Service and security messages needed to run your demo or account are separate from that optional choice.

3. Your Content stays yours

You keep ownership of Your Content. We process it only to provide the Service to you. Pages you choose to publish are intentionally public and meant to be read by people, search engines, and AI agents; everything else in your workspace stays private to you and your team.

4. AI processing and subprocessors

To do its work, the Service sends parts of Your Content to trusted AI and infrastructure providers, for transcription, language, vision, video understanding, web research, email, and hosting. We use them on an API or business basis, share the minimum needed, and only to deliver the Service. Our current processing subprocessors include Anthropic, OpenAI, and Google (language and vision), AssemblyAI (transcription), TwelveLabs (video understanding), Firecrawl and Apify (web reading), and Resend (email). When the default-off localization service is enabled for a requested language, DeepL's paid API generates the candidate and our commercial Anthropic, OpenAI, or Google API accounts independently review it; a material tiebreak uses a provider different from both earlier passes. Consumer and free-model endpoints are not used for this work.

On training. We do not use Your Content to train, retrain, or fine-tune any general or shared machine-learning model. We record each provider's training terms in our subprocessor register. TwelveLabs' no-training business terms are not yet executed, so video sent to that lane remains subject to its current service terms until the agreement closes or we move the lane. Content you bring in through a connected service (for example Vimeo, Frame.io, Zoom, Dropbox, OneDrive, Wistia, or Google Drive) is never used to train any model, ours or a provider's, because the terms of those platforms prohibit it and we honor that. The Service does get smarter for you over time, but that is your own private workspace memory being built for your account, not a shared model learning from your content.

On accuracy. AI output can be wrong. The Service is built to stay tied to its source and to hold uncertain items for your confirmation, but you should independently verify anything important before relying on it.

5. Connected services

You can connect third-party accounts to your workspace, for example Zoom, Google (Drive, Search Console, Analytics), Vimeo, Frame.io, Dropbox, OneDrive, Wistia, HubSpot, GoHighLevel, and the platform your website runs on. When you connect one:

• You authorize it. Every connection starts with that provider's own sign-in and consent screen. We request read scopes limited to what the feature needs, for example listing your cloud recordings or video library.
• Tokens are protected. The access credentials the provider issues are stored encrypted, are used only on our servers, and are never exposed in your browser. We do not see or store your password for any connected service.
• Data moves at your direction. We read from a connected service to show you your own inventory, and we copy a file into your workspace only when you choose to import it. Where a connection supports publishing, we write drafts or pages only when you ask. We use data from a connected service only to provide the features you asked for, never to sell it, never for advertising, and never to train a model.
• You can disconnect any time, and we delete the credential. Disconnecting revokes the connection and deletes the stored access token from our systems, and stops all further access. You can also revoke our access from the provider's own security settings. For a Microsoft account you can review and revoke access at any time at account.live.com/consent/Manage or myapps.microsoft.com; for a Google account at myaccount.google.com/permissions.
• We delete on uninstall or request. If you uninstall the app from a provider's side, close your account, or ask us to, we delete the data we obtained through that connection. For Zoom specifically, when we receive a deauthorization we delete the associated data within ten days.

YouTube. The Service uses YouTube API Services to read public statistics (such as view, like, and comment counts) for YouTube videos you bring in, so we can attach that context to your pages. By using these features you agree to be bound by the YouTube Terms of Service, and your information is handled in accordance with the Google Privacy Policy. We store only these public statistics, we refresh or delete them within thirty days, and you can ask us to delete them sooner. You can revoke Google or YouTube access at any time through the Google security settings page. Questions or complaints about our use of YouTube data can go to the contact at the bottom of this policy.

6. Google user data

When you connect a Google account, the Service uses Google APIs under the Google API Services User Data Policy. This section describes exactly how we handle data received from Google APIs.

• What we access. With your consent we read Search Console performance data (queries, clicks, impressions, positions for your own site), Google Analytics reporting data for your own properties, and, if you connect Google Drive, the file listings you browse and only the specific video files you choose to import. All Google scopes we request are read-only.
• How we use it. Search Console and Analytics data power the ranking, visibility, and opportunity features inside your own workspace, for example deciding which of your pages already rank and which are worth improving. Drive access exists only to copy a video you pick into your workspace. We use Google user data solely to provide these user-facing features to you. We do not use it for advertising, we do not sell it, and humans do not read it except with your permission, for security, to comply with law, or as part of aggregated anonymous internal operations.
• Sharing and transfer. We do not transfer Google user data to third parties except subprocessors acting on our behalf to provide the features above, when required by law, or as part of a merger or acquisition with prior notice to you. To power features you request, limited Search Console query text may be processed by our AI subprocessors under API terms that prohibit them from training their models on your data. We do not use Google user data to train, or improve the training of, any machine learning or artificial intelligence model, whether ours or a third party's, and we do not transfer it to any third-party AI tool for that purpose.
• Protection. Google access tokens are stored encrypted, used only on our servers, never exposed to your browser, and scoped to your own workspace.
• Retention and deletion. We keep Google-derived data only while the connection is active and it is needed for the features above. Disconnecting a Google connection deactivates and deletes the stored tokens and stops all further access. You can also revoke access at myaccount.google.com/permissions, and you can ask us to delete stored Google-derived data at any time via the contact below.

Framesite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Retention and deletion

We keep Your Content while your account is active so the Service and its memory keep working for you. You can delete videos, pages, and other content from your workspace, and you can ask us to delete your account and its data. Some records may be retained where required for legal, security, or billing reasons. An unclaimed demo and the contact details attached to it expire after seven days under the current demo retention window.

8. Security

We take reasonable measures to protect your information, including access controls that scope every read and write to your own company, and encrypted storage of the credentials for any service you connect. No system is perfectly secure, and the Service is in beta; do not upload content you are not permitted to process. If we ever become aware of a breach affecting your data or a connected service, we will notify you and the affected provider without undue delay.

9. Your choices

You can access and update your account information, export or delete your content, and close your account. To make a privacy request, email us at the address below.

10. Cookies and similar storage

Framesite uses necessary cookies and browser storage to provide the page or feature you request, protect sign-in and connector flows, and remember your privacy choice. Necessary storage remains active when you reject analytics. Optional Google Analytics stays off unless you choose Allow analytics.

When you allow analytics, Google may receive pseudonymous identifiers, page activity, session information, approximate location, and browser or device information. Framesite disables Google advertising signals and ad personalization in this implementation. Read Google's GA4 cookie information and Google's Privacy Policy.

You can change your choice at any time with Cookie settings. Rejecting analytics stops future measurement and removes visible Google Analytics cookies without deleting the necessary cookies listed above.

11. Changes and contact

We may update this policy; continued use after an update means you accept the change. Questions or requests: help@framesite.ai.