Legal

Privacy Policy

Last updated 2 November 2026

Sinbad Studio is an AI-native video and media company operating the website sinbad.studio and the social accounts published under the handle @sinbadworks. This policy explains what data we handle, why, and what we do not do with it.

1. Who we are

Sinbad Studio, operating from Baghdad, Iraq. For any question about this policy or about data, write to hello@sinbad.studio.

2. This website

sinbad.studio is a static site. It contains no contact forms, no account system, and no e-commerce. Specifically, we do not use:

• cookies or any browser storage for tracking;
• analytics of any kind, first-party or third-party;
• advertising pixels, conversion trackers, or session recording;
• contact forms, newsletter sign-ups, or chat widgets.

The site is hosted on Amazon Web Services and delivered through its content delivery network. As with any website, AWS processes standard technical request data — such as IP address, user agent, requested file, and timestamp — in order to deliver pages and protect the service against abuse. We use this only for delivery and security. We do not use it to build profiles, and we do not combine it with any other data.

3. If you email us

If you contact us at hello@sinbad.studio, we hold your message and your email address so we can reply and keep a record of the conversation. We use it for that purpose only. We do not add you to a mailing list, and we do not share your details with anyone else. You can ask us to delete the correspondence at any time.

4. Our social accounts

We publish our work to social platforms — including Instagram, Facebook, TikTok, and YouTube — using those platforms' official APIs. Three points matter here:

We publish only to accounts we own

Every account we connect is owned and operated by Sinbad Studio. We do not publish to, manage, or request access to any third party's or customer's social accounts.

We request only the access needed to publish

When we connect one of our own accounts, we authorise only the permissions required to upload and schedule our own content. The resulting access tokens are stored on infrastructure we control and are used for nothing else. They are revoked when an account is disconnected.

We do not collect data about viewers

We do not collect, store, or process personal data belonging to the people who view, follow, like, or comment on our posts. The platforms show us aggregate performance figures — views, reach, engagement counts — and we read those inside the platforms' own tools to understand how a piece of work performed. We do not export, enrich, or cross-reference them, and we cannot identify individuals from them.

When you interact with us on a social platform, that platform's own privacy policy governs the data it collects about you. That relationship is between you and the platform; we are not a party to it.

5. YouTube API Services

Our publishing tool uses YouTube API Services to upload our own videos to our own YouTube channel, @sinbadworks. By using our services you are agreeing to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

What API data we access

When a Sinbad Studio staff member authorises our tool, it receives an access token for our own channel only. Using that token we upload videos and their titles, descriptions and thumbnails; read our channel's own name and id so the tool can show which account it is posting to; and read our channel's own performance figures through the YouTube Analytics API.

We do not access any other channel, and we do not collect, store or process personal data about the people who watch, subscribe to or comment on our videos.

How we use and share it

This data is used solely to publish and review our own work. It is visible only to Sinbad Studio staff inside our own self-hosted publishing tool. We do not sell it, share it with third parties, redistribute it, derive metrics for anyone else, or use it to train AI models. No third party serves content or advertising through our tool.

Revoking access

Access granted to our tool can be revoked at any time from Google's security settings page, security.google.com/settings/security/permissions. Revoking access immediately stops the tool from reaching the channel.

Storage and deletion

Access tokens are held on infrastructure we control for only as long as the channel is connected, and are destroyed when it is disconnected or access is revoked. Any YouTube API data held by the tool is deleted or refreshed within 30 days. A request to delete stored YouTube API data will be honoured within 7 days — write to hello@sinbad.studio.

6. What we never do

• We do not sell, rent, or trade personal data.
• We do not share data with data brokers or advertising networks.
• We do not use personal data to train AI models.
• We do not buy audience data or contact lists.

7. Service providers

We keep the list of third parties deliberately short. At present it is:

• Amazon Web Services — website hosting, content delivery, and the infrastructure that runs our publishing tools.
• The social platforms themselves — Meta (Instagram, Facebook), TikTok, and Google (YouTube), which receive the content we publish and the credentials for our own accounts.
• Our email provider — which handles messages sent to hello@sinbad.studio.

Because we operate from Iraq and use international providers, data we handle may be processed on servers outside your country.

8. How long we keep things

Email correspondence is kept while it is useful for the conversation it belongs to, and deleted on request. Access tokens for our own accounts are kept only while that account is connected. Technical request logs are retained for a short period by our hosting provider for security and diagnostics, then discarded.

9. Your rights

Because we hold so little, most requests are simple to honour. You may ask us to tell you what data we hold about you, correct it, delete it, or stop using it. Write to hello@sinbad.studio and we will respond within 30 days. If you are in a jurisdiction with specific statutory data rights, such as the GDPR, we will handle your request in line with those rights.

To remove data a platform holds about you, or to revoke a platform's permissions, use that platform's own settings — we cannot do it on your behalf.

10. Children

Our website and our work are not directed at children, and we do not knowingly collect data from anyone under 13. If you believe a child has sent us personal data, write to us and we will delete it.

11. Changes to this policy

If we change how we handle data, we will update this page and move the date at the top. Material changes will be summarised here so the difference is visible rather than silent.

12. Contact

Sinbad Studio — Baghdad, Iraq
hello@sinbad.studio