Privacy

POROS is used by agencies (“operators”) to manage their own clients. An operator’s workspace is theirs: the businesses they add, the plans they write, the files they upload. We hold that data on their behalf and do not use it to build products for anyone else.

• Account details for people who sign in — name, email, workspace and role.
• Business records an operator creates: company name, contact details, notes, proposals, invoices, shoot plans and content.
• Inquiries a client’s own website form sends us, including the page and campaign they came from, so an operator can tell which work produced which inquiry.
• Files uploaded to a project, and links to files hosted elsewhere.
• A log of emails sent through POROS, so an operator can see what went out and when.

An operator can connect a client’s Google Search Console. That connection is read-only: POROS requests only webmasters.readonly, which can list verified properties and read search performance data. It cannot submit sitemaps, request indexing, or change anything in anyone’s Search Console.

We read which search queries showed the business, how often, how often they were clicked, and the average position. It is used for one purpose: deciding which questions a video should answer. It is never used for advertising, never sold, and never combined across businesses.

POROS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Access can be withdrawn at any time — from inside POROS, or from the Google account’s own third-party access page. When it is withdrawn we stop reading, and the stored authorisation is deleted.

Only where the job requires it, and only what the job requires:

• Neon — the database, hosted in the United States.
• Vercel — hosting and delivery.
• Anthropic — the AI that drafts plans and scripts. Business context is sent; it is not used to train models.
• Resend — sending email.
• DataForSEO — public search volume for a trade and city. No client data is sent.
• Stripe — payments, where an operator enables them. Card details go to Stripe directly and never reach POROS.
• Cloudflare Turnstile — checking that a form submission is a person.

• Sell data, or share it with advertisers or data brokers.
• Use one operator’s client data on behalf of another.
• Use Google account data for anything except the purpose described above.
• Email a partner’s client without the partner asking us to.

Records are kept while the workspace is active. An operator can delete a record at any time, and can ask for their whole workspace to be deleted — we remove it, and backups age out within 30 days. Withdrawn Google authorisations are deleted immediately rather than kept.

For a copy of your data, a correction, or a deletion, write to info@stellarmediacollective.com. If you reached POROS through an agency, they are the first port of call — it is their workspace — but you can always come to us directly.