Privacy policy

Winlab is operated by AwesomeApps, 2 bis avenue Paul Vaillant Couturier, 94800 Villejuif, France — SIREN 881 883 979, SIRET 881 883 979 00026. AwesomeApps is the data controller for the processing described on this page. Contact: hello@winlab.app.

When you sign up we keep your email address, the name you give if any, and your password — stored only as a bcrypt hash, never in clear. We also keep your language preference and the date of your last activity. Purpose: to create and secure your account and to send the emails the service needs (address confirmation, password reset). Legal basis: performance of our contract with you.

If you subscribe, payment runs through Stripe: your card details are entered on a Stripe page and never reach our servers. While your account exists, we keep your Stripe customer and subscription identifiers and the status of your plan. When you delete your account, those identifiers and your invoices remain with Stripe, our payment provider; our internal credit history is deleted with the account. Legal basis: performance of our contract with you, and our legal obligation to keep accounting records.

Your documents and scripts, your messages in the Studio and your voice settings are stored in your workspace, which only its members can open — and Winlab administrators, who can view an account in read-only mode, for support and security, one hour at a time and with each access logged. Purpose: to provide the service. Legal basis: performance of our contract with you. Deleting a document erases it. Deleting a Studio conversation removes it from your view, but its text is currently kept. A request you type while a video is still being analysed is kept on our servers until it is sent; its text is erased once it has been sent, cancelled or has expired, and at the latest 24 hours after that.

Connecting an account is optional. A member of your workspace starts it in Winlab, and nothing is read until you approve it on Instagram, TikTok or Google (YouTube).

Instagram (Business or Creator accounts only). Permissions requested: instagram_business_basic and instagram_business_manage_insights. We read your username, account type, profile picture, follower and post counts; for each of your posts from the last 36 months (up to 500), its caption, type, link, date, like and comment counts and its insights — views, reach, saves, shares, interactions, average watch time, follows gained and skip rate; and, for the account, the daily follower count and the hours when your followers are online.

TikTok. Permissions requested: user.info.basic, user.info.profile, user.info.stats and video.list. We read your display name, username, profile picture, follower and video counts; for each of your videos from the last 36 months (up to 500), its title, description, date, cover, link, duration and its view, like, comment and share counts. When you allow sending from Publishing, we also request video.upload and, where Winlab can post for you, video.publish: we send only the videos you schedule, at their time — to your TikTok app’s inbox, where you finish the post yourself, or directly to your profile with the caption and the settings you chose for that post (who can watch, comments, Duet, Stitch, commercial content). Winlab posts nothing you haven’t scheduled. The video files are sent, at your request, to TikTok, which processes them under its own privacy policy. You can remove this permission at any time from your TikTok settings or by disconnecting the account.

YouTube (Publishing). Winlab uses YouTube API Services. Permission requested: youtube.force-ssl, only when you allow Winlab to post. We read your channel’s name, handle and subscriber count, and we upload only the Shorts you schedule, as private videos: for now they stay private, and only you can see them on YouTube. The videos, their titles and descriptions are sent, at your request, to Google LLC (YouTube, United States), which processes them under the Google Privacy Policy (google.com/policies/privacy). By posting on YouTube through Winlab, you agree to be bound by the YouTube Terms of Service (youtube.com/t/terms). The permission is checked with Google every day. You can remove it at any time by disconnecting the channel in Winlab, or from the Google security settings page (security.google.com/settings/security/permissions); its tokens are then erased within 7 days. Winlab’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we keep: the access token (and, for TikTok, the refresh token), its expiry date and the permissions granted; your username, account type, follower count and post count; for Instagram, the daily follower curve and the online hours; and, for each of your posts read from the API (all formats — Reels, carousels and photos), its link, date, type, the first 200 characters of its caption, a reduced copy of its cover image (400 px wide) stored under a non-guessable key, and its private statistics (for TikTok: views and shares), plus a daily view count while it is under 14 days old. We never store the video or image files themselves. The file URL of an Instagram video is requested again each time it is needed — to play it in My content, or to transcribe it for an account report — and is never stored; neither is the transcript made from it. Only a short summary of each video, with its opening line, is kept inside that account report; it is deleted 30 days after you disconnect, or at once on a data deletion request.

Tokens are encrypted at rest with AES-256-GCM, using a key held in our server configuration and never in the database. Only our servers use them, to call the platform’s API for your account; they are never sent to your browser. An Instagram token lasts 60 days and a TikTok refresh token 365 days; our servers renew them automatically while the account stays connected.

Purpose: to show you — and the members of your workspace — your own statistics in My content, to enrich the account report of this account when one is produced, and, when you allow it, to post what your workspace schedules on this account. Legal basis: your consent, which you can withdraw at any time by disconnecting.

Kept while the account is connected. When you disconnect in Winlab, or remove Winlab from your Instagram settings, we immediately delete the connection, its tokens, the follower curve and the online hours; your posts, their statistics, the reduced cover images and the account reports built with them are kept for 30 days so that you find them again if you reconnect, then deleted. To delete everything at once, use Instagram's data deletion request, delete your account, or write to us. For TikTok, we also ask TikTok to revoke Winlab's access. If access stops working for another reason, everything is deleted 90 days later. Connecting also adds your public profile to our public index, like any public creator (see below); that public data stays after you disconnect. While the account is connected, the daily history of its statistics is kept for 13 months; older readings are deleted.

When an agency using Winlab asks its client to approve posts, the agency enters the client’s e-mail addresses (up to 3). We use them only to send, on the agency’s behalf, approval requests, reminders and a notice when a video reaches the client’s TikTok app. Brevo sends these e-mails (see Service providers).

The approval page needs no account. A client may leave a first name with a decision; it and any note stay with the post and are erased 30 days after the post’s last change, once it is no longer on its way out (posted, cancelled, stopped or back to draft).

Every such e-mail carries a link to stop them: it removes the address at once from every workspace of that agency’s organisation, and the agency can no longer add it back there, nor these variants of it: a “+” label, or dots in a Gmail address. To enforce this we keep only a fingerprint of the address, erased with the agency’s organisation. The agency can remove the address too.

To tell the agency whether each e-mail went out, we keep, for each address, a fingerprint computed with a secret key (never the address itself) and its delivery status for 90 days, then delete them — whether or not the address has stopped the e-mails.

An agency can also invite its client to connect their own Instagram account to its workspace, without a Winlab account. The access goes to that workspace only: Winlab posts what the agency schedules there and, for the agency, reads the account’s statistics and transcribes what is said in its public videos (see Connected accounts). To withdraw it: Instagram › Settings › Apps and websites › Winlab › Remove, or ask the agency to disconnect the account.

Your videos go to the platform you chose and, when you ask your client to approve them, are shown to your client on their approval page. They are deleted 30 days after their last posting — or, when an account’s access is cut (disconnected, expired access or removed permission), 30 days after the cut or after your last change if it is later. For YouTube, the permission to post is erased 7 days after we detect its removal.

• Videos and covers waiting to be posted: until 30 days after posting, or 30 days after their last change for a video that is never posted. After a disconnection, the videos of your scheduled posts are kept 30 days after the disconnection, or after your last change if it is later, so they can go out if you reconnect the account, then deleted. The same rule applies when an account’s access expires or its permission to post is removed: 30 days after the cut.
• Immediately if you ask Instagram to delete your Winlab data — except a video still used by another post of the workspace.
• When an Instagram or TikTok account’s access stops working, its scheduled posts don’t go out and its data is deleted 90 days later; their videos follow the first rule. For YouTube, the permission to post is erased 7 days after we detect its removal.
• As soon as the workspace is deleted. If you delete your Winlab account, your videos stay with the workspace when its organisation has other members and follow the rules above; if you are the only member of its organisation, the workspace is deleted with them.

Winlab collects public information from the Meta Ad Library. For each ad we keep its identifier, its Page’s identifier and name, all the ad texts it was published with (up to ten) and its link title, its creation, start and end dates, the platforms it runs on, its languages, the audience its advertiser declared (age range, gender, locations), its estimated reach in the European Union and, when Meta publishes it, how that reach splits by age and gender — aggregated shares only, never anything about an individual person —, the niches we file it under — decided from its text, its link title and its Page name by an AI classification provider, with the probabilities it returned and a fingerprint of that text —, and a reduced copy of its visual (about 400 pixels), shown with its source and a link to the ad. For each advertiser, we also keep a reduced copy of its Page picture (160 pixels), shown next to its name. We store no video: when you open an ad’s sheet or press play, your browser may load its video straight from Meta’s servers, which then receive your IP address. We never collect who paid for an ad.

Purpose: to analyse ads and help subscribers remix them — show which ads keep running in their niche and which are among the most widely shown compared with ads the same age, compare the versions an advertiser launched together, so subscribers can understand advertising trends and write their own original content. To file each ad under the niche its product or service belongs to, we send its text, its link title and its Page name to an AI classification provider, in the United States, which returns a probability per niche; samples of those filings are checked by a second AI provider, in the United States. When a subscriber chooses to remix an ad in the Studio, its texts, declared audience and these comparisons are sent to the AI provider of the tier they pick. Legal basis: our legitimate interest in offering this analysis of public advertising data.

An ad, everything we collected about it (texts, dates, declared audience, reach and its aggregated breakdown, rankings, the niche probabilities our AI classification provider returned from its text, link title and Page name, and the fingerprint of that text), and its Page picture once the advertiser has no ad left, is deleted 120 days after it stopped running or was last seen in the library (our 90-day reading window plus a 30-day margin). An advertiser can object by writing to hello@winlab.app: its Page is excluded from future collection, and the ad texts, link titles, declared audiences, reach breakdowns, rankings, the niches we filed them under, niche probabilities and text fingerprint, Page name and Page picture we stored are erased, including their copies in Studio conversations. We keep only the Page identifier, so that it is not collected again.

To show what works in each niche, Winlab indexes public YouTube, TikTok and Instagram accounts and their public videos, collected from the platforms’ public pages through a third-party data collection provider and, for YouTube, through the official YouTube API: handle, name, profile picture, public description and counters, video captions and transcripts. Legal basis: our legitimate interest. A creator can object by writing to hello@winlab.app: we stop collecting the account and hide it from the product, erase the competitive-monitoring data and the raw collected data we hold about it, and keep a minimal record so that the objection lasts.

Visitors who have signed up but not subscribed see a short selection of these public creators for their niche — at most four per organisation — with their public name, profile picture and public counters.

How long: the profile, public videos, captions and transcripts stay in our index for as long as the account is indexed, unless the creator objects. The raw data returned by the collection provider is deleted after 90 days, and the history of public view counters after 13 months.

Your email address, the language you used the page in, the referring URL, and a share code. Purpose: to email you once, when Winlab launches.

Legal basis: your consent, given when you submitted the form. The list is never sold or rented.

The waiting list is kept for up to 2 years, then deleted automatically. Every email we send carries a one-click removal link that deletes your row immediately. This duration covers the waiting list only — it says nothing about what you type inside the product.

We measure how the site and the product are used with PostHog and Google Analytics: pages viewed and product events and, with PostHog, session recordings in which every input field is masked. Recording is turned off on the pages that show your writing or your statistics. Legal basis: our legitimate interest in improving the product.

Brevo (Sendinblue) delivers our emails. Hosting and the database are on Render, in Frankfurt (EU). Analytics run through PostHog and Google Analytics — both process data in the United States. Several AI providers process your requests, and none of them processes data in the European Union: Anthropic (Claude) and xAI (Grok) in the United States, Moonshot AI (Kimi) and Z.ai (GLM) in Singapore, a country without an EU adequacy decision. Anthropic (Claude) generates scripts; Z.ai (GLM) analyses videos. TypeSafe (Jev), in the United States, classifies each video into a niche: it receives the channel’s title and description and the video’s title, caption and theme — public data about the creator, never your account or your documents. An AI classification provider, in the United States, also files each sponsored ad we collect from the Meta Ad Library under a niche: it receives the ad’s text, its link title and the name of its advertiser’s Page — public data about the advertiser, never your account or your documents. To check those filings, we send samples of the same three elements to a second AI provider, in the United States. When a creator is discovered automatically, Anthropic (Claude), in the United States, also receives the channel’s public title and bio and the captions of its most-viewed videos, to classify its niche. In a document, every AI gesture sends your text to Anthropic, in the United States: rewriting a passage transmits the selected passage (up to 2,000 characters), up to 6,000 characters of the document around it, and your instruction (up to 300); “keep writing” transmits up to 4,000 characters of the document that precedes your cursor. Nothing is sent when you open a document, nor while you type — only when you ask. In the Studio, you talk to a model: nothing is sent when you open a video, but every paid message you send transmits what you typed, the previous turns of that conversation, the transcript of the source video, the name of its channel and what the analysis drew from it (hook, angle, structure, call to action) — most often not your video, but a third-party creator's — as well as the script you are writing, and the elements of your voice that feed the writing. Which provider receives it depends on the tier you pick: Moonshot AI (Kimi) and Z.ai (GLM) on the two entry tiers, Anthropic (Claude) on the careful and top tiers; a block bought on the fast tier, which has been retired, still goes to xAI (Grok) until it is used up. This transfer only happens when you send a message. Analysing a video sends its full transcript, its title and the name of its channel to Z.ai (GLM), in Singapore — a country without an EU adequacy decision. That video is most often not yours, but one from a third-party creator, identified by their channel. Breaking a long video into shorts from the Studio sends that same transcript to Z.ai (GLM) again, whatever tier you picked. Hook-category classification runs on xAI (Grok), in the United States. Groq, in the United States, transcribes TikTok and Instagram videos: it receives the video file or its audio track — most often a third-party creator’s video and, when an account report covers an Instagram account you connected, your own videos, fetched through the Instagram API. Source videos are collected from the platforms’ public pages through a third-party data collection provider, files are stored on Cloudflare R2 (Cloudflare, Inc., United States), on servers located in Western Europe, payments are handled by Stripe. Opening a video card loads that video’s player straight from Google (YouTube), TikTok or Meta (Instagram): the platform, its CDNs and its own measurement services receive your IP address, set their own cookies and may ask you for their own consent inside the frame. No click on play is needed, and only the platform of the video you opened is contacted. Thumbnails work the same way — when we could not re-host an image ourselves, the list you are browsing loads it straight from the platform’s CDN, before you click anything. The sheet of a sponsored ad works the same way: its video is loaded straight from Meta’s servers (Facebook, Instagram), which receive your IP address and may set their own cookies. We never copy it onto our servers. Write to us for the current list.

Your account, your workspaces and what you write: for as long as your account exists. Nothing is deleted automatically; the Data deletion page explains how to have it erased.

Connected accounts: tokens until you disconnect or remove Winlab from Instagram, TikTok or your Google account (for YouTube, erased within 7 days of removal); posts, statistics, reduced cover images and the account reports built with them 30 days after that, or 90 days after access stops working for another reason; immediately on an Instagram data deletion request or when you delete your account.

Ads from the Meta Ad Library: 120 days after they stop running or are last seen.

Public creators we index: for as long as the account is indexed, unless they object; raw collected data 90 days; view-counter history 13 months.

The waiting list: up to 2 years.

Payment and accounting records: for the period required by law.

The data we obtain through the Instagram API is used for two purposes only: to show the creator who connected the account, and the members of the workspace they connected it to, analytics about their own content in Winlab, including in account reports about that account; and, when the creator allows posting, to publish the videos they schedule, at the time they choose, on that account. We do not use it for any other purpose.

We do not sell it and we do not use it for advertising. Inside Winlab, it is visible only to the members of the workspace where the account was connected and, read-only and for support and security, to Winlab administrators. Outside Winlab, only the service providers that process it on our behalf receive it: Render hosts it (Frankfurt, EU), Cloudflare R2 (Cloudflare, Inc., United States) stores the reduced cover images of your posts, on servers located in Western Europe, and, when an account report is produced, Groq transcribes the videos and Anthropic writes the report — both in the United States. No other AI provider listed on this page receives Instagram data. Cloudflare R2 also keeps, in a private storage space, the videos and cover images waiting to be posted, until 30 days after posting — or 30 days after their last change for a video that is never posted.

You can have it deleted at any time. Disconnecting the account in Winlab, or removing Winlab from your Instagram settings, deletes the connection, its tokens and the account's follower curve immediately, and your posts' statistics 30 days later. A data deletion request sent through Instagram, or deleting your Winlab account, deletes everything immediately, cover images included. You can also write to hello@winlab.app. The Data deletion page gives the details. After a disconnection, the videos of your scheduled posts are kept 30 days after the disconnection, or after your last change if it is later, so they can go out if you reconnect the account, then deleted.

Data from the Meta Ad Library API is public ad data, covered in “Ads from the Meta Ad Library” above. It is never combined with data from connected Instagram accounts.

You have the right to access, correct and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. Write to hello@winlab.app; we answer within one month. If you think your rights are not respected, you can lodge a complaint with the CNIL (cnil.fr).

We update this page when our processing changes; the date at the top gives the latest version.