Privacy Policy

01Owner portal and shared access

If your organization enables its owner portal, HYPNOS matches your verified email to the contact email saved on an owner record. Email-code, Google and YouTube sign-in are separate from staff authentication. Google sign-in supplies a verified identity and basic profile; it does not request access to your YouTube channels. The separate YouTube button checks your channel and then requires a code sent to the saved owner email, as described below. A person whose email matches several owner records can switch between them.

We store protected portal identities, access grants, sign-in challenges, payment-change confirmations, support requests and replies, and personal notification state. The necessary host-only __Host-hypnos_owner_session cookie lasts up to 30 days after sign-in; guest sessions last 20 minutes. At most seven signed-in sessions are retained per identity. A fresh email code is required before changing payment instructions. Access/security messages use your organization's configured email service; ordinary payment, fine and support updates remain in the portal.

Owners can invite view-only colleagues to their channels, analytics, published statements, fines and contracts. Colleagues cannot view bank/PayPal instructions or private support conversations. Your organization can correct the access email or disable access; these changes revoke prior sessions and colleague grants. A newly assigned owner can see saved channel analytics history, but not a previous owner's private statements or support messages.

02Final Payments providers

When your organization connects PayPal or Mercury, HYPNOS stores encrypted provider credentials and payment instructions, approved amounts, recipient references, transfer statuses and an activity history. For approved payouts, it sends the provider the required recipient, amount, currency and payment reference. Bank recipient matching reads the provider’s account and routing details. The provider processes payments under its own terms and privacy policy. Manual CSV exports leave HYPNOS under your control. The demonstration uses fictional recipients and does not contact payment providers.

03Who is responsible

HYPNOS is operated by AcidSpain LLC, with offices at 6303 Waterford District Dr STE 400, Miami, Florida 33126, United States of America (EIN 36-5089721). Contact [email protected] for privacy questions or requests.

We are responsible for account administration, security and operating HYPNOS. When an organization supplies or connects business data, it also determines who may access it and the purposes of its channel and payment reviews. We handle that data within its authorized service instructions. This HYPNOS policy is specific to this product; AcidSpain’s general website policy describes its other activities.

04Information we handle

• Account and profile: your name, email, optional profile picture, language, access assignments and account status; password hashes, passkey public credentials, protected authenticator information and recovery-code hashes.
• Connected YouTube data: channel and content identifiers, names, pictures, channel statistics, available monetization and membership status, revenue, views, watch time, and available audience, content and performance reports. Authorized imports can add dated status or copyright-strike information.
• Network and payment records: owner and network attribution, business contacts, channel earnings, dated revenue shares and fees, original payment reports, published amounts, and manually recorded adjustments, explanations and fine history. Authorized administrators may import or enter payee instructions, including PayPal addresses, recipient contact and address details, bank-account or IBAN details, routing numbers and SWIFT/BIC codes. These contact and payment instructions are encrypted in the application database and require explicit permissions to view or edit. HYPNOS prepares payout instructions; it does not execute transfers or collect payment-card details. Optional channel-contract PDFs are stored in the connected private Google Drive folder. HYPNOS keeps document references, integrity hashes and access history, without retaining the PDF bytes on its application server.
• Your work in HYPNOS: notes, review decisions, whitelist choices, reminders, saved reports, notifications and your personal read/dismiss state, exports requested, and action history.
• Connections and security: authorization tokens for connected services, session and API-key records, and request information such as IP address, browser details, time, route and error/security events processed by the application or its delivery infrastructure.

Data comes from you, your organization’s administrators, authorized Google/YouTube APIs, connected directory and payment-report services, and files an authorized user imports. We do not receive your Google password or the biometric templates used by Face ID, Touch ID or a device passkey.

05How and why we use it

We use this information to authenticate users, enforce permissions, synchronize authorized sources, display analytics, preserve dated evidence, prepare reports, support channel reviews and payment calculations, deliver service emails, respond to support requests, and protect the service.

Where European data-protection law applies, processing relies on performing the service agreement, legitimate interests in operating and securing the service and maintaining appropriate business records, legal obligations, or consent where required. Optional service connections use the permissions you or your organization grant. Withdrawing consent does not affect earlier lawful processing.

Review signals and suggested fines support a person’s decision. HYPNOS does not automatically unlink channels, change YouTube monetization or transfer money. We do not sell personal data, use it for targeted advertising, or use connected Google data to train general-purpose AI models.

06Google and YouTube connections

Owner portal sign-in offers Google identity verification or a YouTube channel check. With YouTube sign-in, we request read-only permission to identify the channel you select and match it to its current owner record in HYPNOS. We send a verification code to that owner’s saved email and require it before access. The channel token is used for this one check, is not stored, and does not enable ongoing channel monitoring. A short-lived encrypted channel-match record expires with the sign-in attempt.

HYPNOS uses YouTube API Services. Google handles information under the Google Privacy Policy. An authorized administrator connects the CMS accounts and can stop the connection in Settings → YouTube API. You can also revoke HYPNOS’s access through your Google Account permissions.

Connected data is used for the visible channel-management, analytics and reporting features described here. Access is limited to authorized people and integrations. Google data is not used for advertising or unrelated profiling. Where applicable, use and transfer of information received from Google APIs must follow the Google API Services User Data Policy, including its Limited Use requirements.

Revoking access stops further authorized collection. Disconnecting a source or unlinking a channel is different from deleting saved HYPNOS records. To request deletion of previously collected data, follow Your rights and deletion requests below; applicable Google/YouTube deletion requirements still apply.

07Who can receive information

Information is available to authorized members of your organization according to their CMS, network and feature permissions. Administrators manage access and may use a logged, view-only preview of a user’s permitted view. Reports you download and integrations you authorize can contain the data included in their permitted scope; protect those copies and choose their recipients carefully.

Providers support specific functions: Google/YouTube supplies connected data and may serve channel images; Google Drive stores optional channel contracts in the selected private folder; when APIVerve routing lookup is configured, it receives only the public routing number entered or displayed in payment details; separately configured API Ninjas identification receives the SWIFT/BIC or IBAN, but neither provider receives recipient names, contact information or balances; when the corresponding provider is not configured or is unavailable, bankrouting.io and GLEIF receive only public routing numbers or BICs; IBAN checks stay local when no provider is configured, and IBANs are never sent to these public directories; Cloudflare provides delivery and security; transactional email services, including Resend, process recipient details and transactional email content; and your organization’s connected directory and payment-report provider supplies business records. Hosting and backup systems store the service’s records. We limit service-provider access to what is needed for their function and require appropriate protection under applicable arrangements.

We may disclose information where required by law, to respond to a valid legal request, protect rights and security, or in a business transfer subject to applicable data-protection safeguards. We do not make your private dashboard data public through these legal pages.

When you type a recipient address, the street query is sent to CartoCiudad (IGN/CNIG) for Spanish addresses, or to Photon, a service based on OpenStreetMap, with the selected country and supported language elsewhere, to suggest addresses. We do not include the owner ID, recipient name, email, phone or bank details. Opening saved instructions alone does not send an address query. Suggestions are kept only in a short in-memory cache for up to five minutes; they are not a delivery or account verification. You can enter or correct the address manually.

08Cookies and device storage

The website uses necessary sign-in and security storage and remembers your preferences:

• Sign-in: the HttpOnly wmnnsl_session cookie identifies a server-side session. A fully verified login lasts up to 30 days unless revoked earlier; guest and unfinished sign-in sessions expire sooner. The account can have up to seven verified sessions.
• Preferences: hypnos-appearance and hypnos-language cookies last up to one year and have matching browser-storage preferences. Browser storage also remembers the selected CMS and coordinates account changes between tabs.
• Delivery security: our infrastructure provider may process connection information and use security mechanisms to prevent abuse.

HYPNOS does not install advertising cookies or third-party marketing analytics. You can change appearance and language in Settings, clear browser storage, or block cookies in your browser. Blocking necessary cookies prevents sign-in; signing out ends the current server session. Device security controls apply to passkeys. Uploading a profile picture provides that chosen image, not general access to your photo library.

09Retention and security

We retain account data while needed to provide access and support. Channel history, archived membership, saved analyses, reports and payment/audit records can remain after a channel leaves a CMS so authorized teams can review past activity, resolve disputes and meet record-keeping obligations. Retention is limited by those purposes, applicable law and source-provider requirements; unlinking does not itself erase history.

API access logs are bounded to 14 days or 10,000 records. Preferences and verified sessions have the lifetimes described above. Backup copies support recovery and are access-restricted; they are handled as part of a deletion request and must not be used to reintroduce deleted data. Some records may need restricted retention for legal obligations or claims, which we will explain when relevant.

Safeguards include HTTPS, role and network access controls, mandatory two-step verification or passkeys, hashed passwords and API keys, encrypted connection credentials, and restricted backups. No storage or transmission method can guarantee absolute security.

10International processing

AcidSpain LLC is a United States company. Service providers and authorized team members may process information in other countries, whose laws can differ from your own. Where a transfer requires safeguards under applicable data-protection law, we must use an appropriate lawful mechanism, such as an applicable adequacy decision or approved contractual safeguards. Contact [email protected] for information about the safeguards relevant to your data.

11Your rights and deletion requests

Owner app users can delete their personal account in More → Delete account, or on the web in My account → Security → Delete account. This removes their HYPNOS sign-in and personal account data and signs out every device. Owner-controlled portal access closes, including colleagues’ access; colleagues deleting their own account remove only their own access. The network retains contracts, statements, payments, channels and support conversations as business records, with erased personal attribution replaced by a neutral label. Shared-login deletion runs across linked companies and retries temporarily unavailable companies automatically.

Email [email protected] with the subject HYPNOS privacy request to request access, correction, an export, account deletion or deletion of connected channel data. Tell us the account email and, where relevant, the channel or organization involved. Never send passwords, recovery codes or API tokens. We may ask for proportionate proof of identity or authority before acting.

Depending on the law that applies, you may also request restriction, object to processing, withdraw consent, or complain to your local data-protection authority. You can update your name and picture in Profile and preferences in Settings. Your administrator can help with organization access; removing an account’s access is not the same as erasing all records.

We respond within the periods required by applicable law and follow the relevant provider deletion rules for connected data. We will explain any lawful reason to retain particular records, the limits of a request affecting other people or an organization, and how it is resolved. You can use this email route without logging in, including for an iOS account.

12iOS and feature availability

This policy also applies when you access HYPNOS through its iOS application once available. The notification backend is available for integration; this does not mean an iOS client has been released. Saving or sharing an exported file places that copy under your chosen device or destination’s controls.

If you enable iOS notifications, HYPNOS stores your APNs device token, a random installation identifier, Apple environment, language and association with your verified account session. Device tokens are encrypted at rest. We send Apple the delivery token, a generic HYPNOS notice and CMS/event identifiers needed to open it; the lock-screen message excludes channel names and financial details. Apple processes delivery information under its Privacy Policy. Protected details are retrieved only after a new authorization check.

You can disable notifications in iOS Settings and remove the app’s server registration. Closing or losing the associated verified session stops future sends; invalid registrations and queued delivery records are removed on the next server check. Apple may already have an in-flight notice. Terminal delivery diagnostics are retained for up to 30 days; personal bell history and protected backup copies follow the retention and deletion-request rules above. New device permissions or data practices must also be reflected in the app’s explanations and App Store privacy information.

13Intended users

HYPNOS is a business tool for authorized team members, not a service directed to children. Channel audience reports may include aggregate audience information supplied by YouTube; this does not create HYPNOS accounts for those viewers. Contact us if you believe a child has provided personal information directly through HYPNOS.

14Changes and contact

We may update this policy as the service or applicable requirements change. The date above identifies the current version. Material changes will be communicated through the service or an appropriate account contact, with additional consent requested where required. Contact [email protected], or write to AcidSpain LLC at the address above.