Privacy Policy
Last updated: June 18, 2026
Contents
1. Introduction
Treeada ("the Platform," "the Service") is operated by Naviram Global Tech ("we," "us," "our"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our platform.
By creating an account or using any part of the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with these practices, please do not use the Service.
This policy applies to all users, including Maestros (content creators) and Students (content consumers), as well as visitors who browse the Platform without an account.
2. Data We Collect
Information You Provide
| Category | Data | Who |
|---|---|---|
| Account Registration | First name, last name, display name, email address, password | All users |
| Profile Information | Profile picture, cover photo, bio, country, phone number, preferred language | All users |
| Social Accounts | Instagram username, connected YouTube channel, connected TikTok account | Maestros |
| Payment Information | PayPal email and payment processing account identifiers | Maestros |
| Content | Videos, sheet music (MusicXML), lesson text, course metadata, blog posts | Maestros |
Treeada does not store full credit/debit card numbers. All card processing is handled directly by our payment providers (Stripe, PayPal, Tilopay).
Information Collected Automatically
| Category | Data | Purpose |
|---|---|---|
| Usage & Progress | Lessons viewed, completion status, video playback position, timestamps | Track learning progress, show completion to Maestros |
| Account Activity | Last sign-in time, last activity time, password change history | Account security, fraud prevention |
| Transaction Records | Purchase amount, currency, payment provider, transaction ID, date | Billing records, invoices, earnings reporting |
| Session Data | Session tokens, authentication cookies | Keep you signed in, maintain session state |
Information from Third Parties
When you connect external accounts, we may receive:
- YouTube / Google: Channel name, channel URL, channel thumbnail, and public video information (titles, descriptions, thumbnails). See the dedicated Google/YouTube section below for full details.
- TikTok: Username, display name, profile picture, bio, and public video information (titles, thumbnails, share URLs). See the dedicated TikTok section below for full details.
- Instagram: Public post URLs for profile display
- Payment providers: Transaction confirmations, subscription status updates, webhook notifications
We store authentication credentials necessary to maintain these connections. We do not access your private messages, unpublished content, follower lists, or analytics data from any third-party platform.
Google / YouTube API Data — Full Disclosure
Treeada uses the YouTube Data API v3 to allow Maestros to connect their YouTube channel. In compliance with the Google API Services User Data Policy, we provide the following full disclosure of how we access, use, store, and share Google user data.
Permission Requested:
- Read-only access to the Maestro's YouTube account to retrieve associated channels and their public video information.
Data Accessed & Collected:
- Channel ID, title, description, URL, custom URL, and thumbnail image URL
- Channel video listing to retrieve the Maestro's public and unlisted videos
- Video metadata: titles, descriptions, and thumbnail URLs of public and unlisted videos (private videos are excluded)
- Authentication credentials (stored encrypted) to maintain the connection
Data NOT Accessed:
- Private videos, comments, likes, subscriptions, community posts, messages
- Channel analytics, revenue, or audience data
- Any other Google account data beyond what is listed above
Purpose / How We Use This Data:
- Channel verification: Confirm the Maestro owns or manages the channel linked to their profile.
- Profile display: Show the linked channel name and thumbnail on the Maestro's public profile.
- Video embedding: Allow the Maestro to embed their public or unlisted YouTube videos in course lessons. Unlisted video URLs are stored only when explicitly selected by the Maestro for embedding.
- Connection maintenance: Maintain the API connection without requiring repeated re-authorization.
Google user data is used only for these purposes. It is never used for advertising, profiling, or any purpose not described here.
Storage & Security: Authentication credentials are encrypted at rest using industry-standard encryption before being stored in our database. All database connections are encrypted via TLS. Channel metadata is cached and periodically refreshed from YouTube. No Google user data is stored beyond what is listed above. See the Security section for full details on our data protection measures.
Sharing: Google user data is not sold or shared with third parties. The Maestro's publicly visible channel name and thumbnail are displayed on their Treeada profile (consistent with that data already being public on YouTube).
Deletion: Upon disconnecting the YouTube integration (in Treeada settings) or revoking access via Google Account Security Settings, Treeada immediately deletes your stored authentication credentials. Cached channel metadata is removed upon manual profile update or account deletion.
Limited Use: Treeada's use of Google user data complies with the Google API Services User Data Policy Limited Use requirements. We do not use Google user data to serve ads, allow human access beyond what is strictly necessary for security or legal compliance, or transfer it to third parties except as required to provide the integration.
TikTok API Data — Full Disclosure
Treeada uses TikTok's official APIs to allow Maestros to connect their TikTok account and display their TikTok content on Treeada. This section discloses how we access, use, store, and share TikTok user data.
Permissions Requested:
- Basic profile information: TikTok username, display name, profile picture, and bio.
- Public video listing: video titles/captions, cover images, share URLs, and view/like counts.
Data NOT Accessed:
- Private or draft videos, comments, messages, follower/following lists
- Any ability to post, edit, or delete content on your TikTok account
- Analytics, advertising, or payment data
Purpose / How We Use This Data:
- Profile display: Show the Maestro's TikTok username, display name, and avatar on their public Treeada profile.
- Video embedding: Allow the Maestro to embed their public TikTok videos on their profile or in course content.
- Connection maintenance: Maintain the connection without repeated re-authorization.
TikTok user data is used only for these purposes and is never sold, shared with third parties, or used for advertising.
Storage: Authentication credentials are stored encrypted. Profile and video metadata are cached and periodically refreshed from TikTok.
Deletion: Disconnecting the TikTok integration in Treeada settings, or revoking access via your TikTok account's connected apps settings, immediately deletes your stored authentication credentials. Cached profile/video data is removed upon manual profile update or account deletion.
3. How We Use Your Data
We use the information we collect to:
Provide & Operate the Service
- Create and manage your account
- Display your profile to other users (Maestro profiles are public)
- Process course purchases and subscription payments
- Track and display your learning progress within courses
- Generate purchase invoices and receipts
- Deliver email notifications (account confirmations, purchase receipts, password resets)
Improve & Protect the Platform
- Monitor content for copyright compliance (automated keyword flagging and audio fingerprinting)
- Detect and prevent fraud, abuse, and unauthorized access
- Provide aggregated, anonymized analytics to Maestros (student counts, completion rates, country breakdown)
- Debug technical issues and improve platform performance
Communicate with You
- Send transactional emails (purchase confirmations, subscription updates, security alerts)
- Notify Maestros about content review results, sale seasons, and platform updates
- Respond to support requests
We do not send unsolicited marketing emails. All communications are related to your account activity or features you have opted into.
4. Legal Basis for Processing
We process your personal data based on the following legal grounds:
- Contract performance: Processing necessary to provide the Service you signed up for (account management, payment processing, content delivery).
- Consent: Where you have given explicit consent, such as connecting third-party accounts (YouTube, TikTok, Instagram) or agreeing to these terms at registration.
- Legitimate interests: Fraud prevention, platform security, content moderation, and service improvement, where these interests do not override your rights.
- Legal obligation: Where we are required to retain or disclose data by applicable law (e.g., tax records, legal proceedings).
6. Data Retention
We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy:
- Active accounts: Data is retained for the lifetime of your account.
- Deleted accounts: Upon account deletion, we remove your profile and content from the Platform. Some data may be retained for up to 90 days in backups. Certain records (transaction history, invoices) may be retained longer as required by tax and accounting laws.
- Transaction records: Purchase and payment records are retained for a minimum of 7 years to comply with financial reporting and tax obligations.
- Security logs: Account activity logs (sign-ins, password changes) are retained for up to 12 months for security and fraud prevention purposes.
7. Security
Security procedures are in place to protect the confidentiality, integrity, and availability of your data, including any data received from third-party services such as Google. We use encryption and multiple layers of security controls to protect your information both in transit and at rest.
Encryption
- Data in transit: All connections to and from Treeada are encrypted using TLS/HTTPS. HTTP Strict Transport Security (HSTS) is enforced to prevent downgrade attacks.
- Data at rest: Sensitive credentials, including authentication tokens from third-party services (Google/YouTube, TikTok), are encrypted at rest using industry-standard encryption before being stored in our database.
- Database connections: All connections between our application and database servers are encrypted via TLS.
- Passwords: User passwords are cryptographically hashed using industry-standard algorithms and are never stored in plain text.
Access Controls & Authentication
- Two-factor authentication (2FA) is available for all accounts via authenticator apps
- Account lockout is enforced after repeated failed login attempts to prevent brute-force attacks
- Strong password requirements are enforced (minimum length, complexity, unique characters)
- Authentication cookies are configured with industry-standard security flags to prevent unauthorized access
- Authenticated pages use cache-control headers to prevent sensitive data from being stored in browser caches
- Role-based access control restricts data access to authorized users only
Application Security
- Rate limiting: Login, API, and sensitive endpoints are rate-limited to prevent abuse
- CSRF protection: Cross-site request forgery protection on all forms
- Security headers: Industry-standard security headers are applied to protect against common web vulnerabilities
- Input sanitization: User-generated HTML content is sanitized to prevent cross-site scripting
- Payment card data: Card numbers are never stored on our servers. All card processing is handled exclusively by PCI-compliant payment providers (Stripe, PayPal, Tilopay)
- Payout security: Payout email changes require identity verification and are subject to a security cooldown period
Google User Data Protection
In addition to the general measures above, the following safeguards apply specifically to data received from Google APIs:
- Google authentication credentials are encrypted at rest before database storage and are decrypted only at the moment of use
- Google user data is accessible only to the authenticated Maestro who initiated the connection — no other user or role can access another user's Google data
- Access to Google data is limited to the minimum permission required (read-only) and is used only for the purposes described in this policy
- Upon disconnection or access revocation, all stored Google credentials are immediately deleted
- Google user data is never transferred to or accessible by third parties, advertising systems, or analytics tools
While we take reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at support@treeada.com.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete personal data. You can update most information directly through your account settings.
- Deletion: Request deletion of your personal data. You can delete your account through your account settings. Some data may be retained as described in the Data Retention section.
- Data portability: Request a machine-readable copy of data you have provided to us.
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time. For third-party integrations, you can disconnect accounts through your profile settings or revoke access directly through the third-party provider.
- Objection: Object to processing based on legitimate interests.
To exercise any of these rights, contact us at support@treeada.com. We will respond to requests within 30 days. We may request identity verification before processing your request.
Revoking Third-Party Access
You can revoke Treeada's access to connected accounts at any time:
- YouTube / Google: Google Security Settings
- TikTok: Manage connected apps in your TikTok account settings
- Instagram: Manage connected apps in your Instagram account settings
Revoking access will disconnect the integration from your Treeada profile. Previously imported public data (e.g., featured video URLs) may remain visible until you update your profile.
9. Children's Privacy
Treeada is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information.
Users between 13 and 18 may use the Service with the consent of a parent or legal guardian. Payment features require users to be at least 18 years of age or have parental/guardian authorization.
If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@treeada.com.
10. Cookies & Similar Technologies
Treeada uses cookies and similar technologies for the following purposes:
- Essential cookies: Required for authentication, session management, and security. These cannot be disabled without breaking core functionality.
- Functional cookies: Remember your preferences (language, theme).
We do not use third-party advertising or tracking cookies. We do not participate in ad networks or cross-site tracking.
Embedded content from third-party services (YouTube, TikTok, Instagram) may set their own cookies when loaded. These are governed by the respective third party's cookie policies.
11. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence. Our service providers (Stripe, PayPal, Mux, etc.) operate globally. By using the Service, you consent to the transfer of your data to these jurisdictions.
We ensure that any international transfers are subject to appropriate safeguards, including the use of standard contractual clauses and provider certifications where applicable.
12. Changes to This Policy & Contact
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws. We will post the updated policy on this page and update the "Last updated" date. For material changes, we may notify you by email.
Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.
Contact Us
If you have questions, concerns, or requests regarding your privacy or this policy, contact us:
- Privacy & Support: support@treeada.com
- Legal & Data Requests: legal@treeada.com
By using Treeada, you acknowledge that you have read and understood this Privacy Policy.