legal

Privacy policy

Last updated 27 September 2026

Statonic (“we”, “us”) is a Brisbane, Australia based short-form video production business operated by its founder as a sole trader (not an incorporated company). This policy covers our website, our internal publishing system (section 10), and our editing portal at edit.statonic.com (section 11). We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth), whether or not we are legally required to.

1. What this policy covers

• The editing portal: Google Drive connections, selected footage, AI editing and saved results (section 11).
• The website: contact and creator application forms (sections 2 to 9).
• The publishing system: OAuth tokens, video data and comment-reply events for the Instagram, YouTube and TikTok accounts we operate (section 10).

2. What we collect on statonic.com

Contact form (homepage). Your name, email, company and message.

Creator application form (/apply). Your name, email, optional phone or Telegram handle, a video of you talking to camera (uploaded to us, or a link to where it's hosted), optional Instagram/TikTok handles, and, if someone referred you, their name and email.

Technical. When you submit a form, our hosting provider passes us your IP address, which we use only for rate limiting and abuse prevention. We do not run analytics or advertising trackers and do not set tracking cookies.

Referrer details. If you name someone who referred you, we hold their name and email in your application record so we can pay the referral bonus. Only give us their details if they know and agree.

3. Why we collect it

• To reply to enquiries and discuss work with brands.
• To assess creator applications and contact you about filming.
• To administer the referral bonus (matching a referrer to a completed first shoot).
• To keep a record of who applied and when, including for resolving referral disputes.
• To prevent spam and abuse of our forms.

We do not sell personal information and we do not use it for marketing lists.

4. Where it goes

Your data is processed by a small number of service providers on our behalf:

• Vercel hosts statonic.com and runs the form handlers (servers may be outside Australia).
• Formspree receives contact-form submissions and emails them to us.
• Telegram delivers an instant notification of new applications to us.
• Cloudflare R2 stores uploaded audition videos in a private bucket; only we can generate links to view them.
• Our own server (hosted with DigitalOcean) stores creator applications so we can review them later.

If you become a creator with us, we may share your name and video with the brand a shoot is for, since they approve the people who appear in their content. We won't share your contact details with them without asking you first. Other disclosures for our publishing system and editing portal are described in sections 10 and 11. We do not otherwise disclose personal information to third parties unless required by law.

5. How long we keep it

• Contact-form enquiries: until the conversation ends, then deleted within 12 months.
• Creator applications: up to 24 months from submission, so we can come back to earlier applicants as brand work lands and settle any referral claims. Sooner on request.
• Instant Telegram notifications: cleared periodically; the stored application is the record.

6. Security

Form submissions travel over HTTPS. Stored applications sit behind authentication on a server only we can access, and secrets used to move data between services are kept out of our public code. No system is perfectly secure; if we become aware of a breach that is likely to cause you serious harm we will tell you and, where required, the OAIC.

7. Your choices

• Access or correction: ask us and we'll show you what we hold about you and fix anything wrong.
• Deletion: ask us and we'll delete your application or enquiry, unless we need to keep a minimal record to settle a referral payment or meet a legal obligation.
• Withdrawing: applying does not commit you to anything; you can withdraw at any time.

8. Children

Our creator program is for people 18 and over. If you are under 18, please don't apply; if we learn we have collected an application from someone under 18 we will delete it.

9. Changes

We'll update this page if our practices change and revise the date at the top. Material changes to how we handle applications will be noted on the apply page.

10. Platform integrations (Instagram, YouTube and TikTok)

Statonic runs an internal publishing system that renders short-form videos and uploads them to social accounts we operate. It connects to Instagram through Meta's Instagram API (Instagram Login), to YouTube through YouTube API Services and to TikTok through the TikTok Content Posting API. This section is the privacy notice for that system. It is not a public product; the only people who authorise it are Statonic's operator and creators who work with Statonic and choose to connect an account they own.

What it accesses. When an account is connected through the platform's own sign-in screen (Instagram Login, Google OAuth 2.0 or TikTok Login Kit), the system receives an access token and a refresh token for that account, plus basic profile details returned by the platform: the channel or account id, display name, handle, avatar, follower and subscriber counts. For Instagram it uses instagram_business_basic (identify the connected account), instagram_business_content_publish (publish reels to it), instagram_business_manage_comments (read comments on that account's own posts) and instagram_business_manage_messages (send a direct message to someone who has commented a keyword, and receive their reply). For YouTube it uses the scopes youtube.upload (upload videos) and youtube.readonly (read the connected channel and view counts of its videos). For TikTok it uses user.info.basic (identify the connected account), video.upload and video.publish (upload and publish videos to that account).

What it does with it. Uploads videos we produced, with the title, description, caption, privacy setting and interaction settings chosen by the person publishing; reads back the id, publish time, status and view counts of those videos so we can track how they perform and bill for the work. On connected Instagram accounts it additionally runs a comment-to-message feature: when someone comments an agreed keyword (for example “biology”) on one of that account's posts, the system sends them one private reply offering the study resources the post mentioned, and, if they tap the button in that reply, a second message with the links. For this it receives from Meta the comment's id, text, the commenter's Instagram id and username, and any button tap or message they send back to the account. It stores those events and the link clicks that follow so we can see how many people asked for the resources. It never messages anyone who has not commented a keyword, sends at most one reply per comment, does not read other conversations, does not read anyone's follower lists or private data, does not post anything the account holder has not approved, and never reads or stores account passwords.

Where it is stored. Tokens are stored as files readable only by the system's own user account on a server we control (hosted with DigitalOcean) and on the operator's computer. They are never committed to source code, printed to logs or shared with anyone. Video metadata and view counts are stored in the same place. Nothing from these integrations is shared with third parties or used for advertising.

How long. Tokens are kept while the account stays connected and deleted within 7 days of disconnection. Comment-to-message events (comment ids, commenter usernames, taps and clicks) are kept for 90 days, then deleted. View counts and other platform data are refreshed on each sync and any copy older than 30 days is replaced or deleted; the record of which of our own videos were posted, and when, is kept as our business record.

Revoking access. Instagram: remove Statonic under Settings, Website permissions, Apps and websites in the Instagram app. YouTube: remove Statonic at any time from your Google account security settings. TikTok: remove it under Settings and privacy, Security and permissions, Apps and services in the TikTok app. Either revocation stops the system immediately; we then delete the stored token within 7 days. You can also ask us to disconnect and delete everything held for your account through the contact form.

Anyone whose data reached us through these integrations, including people who commented on a connected Instagram account, can ask us to delete it: see the data deletion instructions. By connecting an Instagram account you also agree to the Instagram Terms of Use, and Meta's handling of your data is described in the Meta Privacy Policy. This system uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. By connecting a TikTok account you also agree to the TikTok Terms of Service and TikTok Privacy Policy. Our own terms for the system are on the terms page.

The editing portal creates video drafts from footage you select. This section applies to people using the portal and to personal information about people appearing or speaking in that footage.

Access and information collected. Connecting Google Drive gives us your Google account identifier and email address, plus access and refresh tokens. We request per-file access through Google's drive.file permission. We access files you select or otherwise grant to this app, rather than requesting access to your whole Drive. For an edit we download the selected video and read its file identifier, name, size and media metadata. We process the picture and audio, produce transcripts, word timings and framing information, and create captions and an edited video. We also store job status, diagnostic and review information, and feedback you choose to save. We do not receive your Google password.

Purpose and providers. We use this information to make and deliver your requested edit, maintain access to your workspace, and investigate processing errors. DigitalOcean hosts the portal and saved results. Runpod provides GPU processing for the selected footage and speech models. Anthropic's API receives transcript text, editing instructions and relevant review text to make editing and caption decisions. Google provides sign-in and file selection. These services can process data outside Australia; our current GPU processing is in the European Union. Provider processing and retention are also subject to their applicable service terms.

We do not sell portal data, use it for advertising, or use Google Drive data to train general-purpose AI models. We do not publish selected footage or outputs to social accounts through this portal. Statonic's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access to your selected content is limited to support or review you authorise, security investigations and legal requirements.

Storage and retention. Google connection credentials are encrypted on our portal server. Login and connection flows use essential security cookies; browser storage remembers the onboarding state. Temporary worker copies of footage and intermediate editing files are removed when a job exits normally, including handled failures. An interrupted worker or provider records may outlast that cleanup. To support requested re-edits, we also retain a separate workspace-specific copy of the selected source video, transcript, framing data and edit decisions on Runpod storage. Re-edits reuse that original copy rather than downloading later changes to the Drive file. This cache is eligible for reuse for 30 days from the initial edit, subject to workspace access and compatibility; that reuse limit does not automatically delete the files. Saved source caches, outputs, version history, feedback and retained diagnostic records do not currently have an automatic deletion schedule: they remain until we delete them, including following a deletion request. Workspace access expiry and disconnecting Google do not automatically erase existing results. Keep your own copy of any output you need.

Disconnecting and deletion. Disconnecting in the portal removes its locally stored Google connection credentials and requests revocation at Google. You can also revoke access from your Google account settings. To delete saved videos, transcripts, feedback, diagnostics or other workspace data, use the contact form below and identify the workspace or edit. We will verify the request, delete data we control unless a legal obligation requires retention, and explain any provider or backup limitations. People appearing in footage can also contact us about their information. Removing portal data does not delete the original file in your Google Drive.

12. Contact

Privacy questions, access, correction or deletion requests: use the contact form and put “privacy” in the message. If you're not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).