Privacy Policy

Pantaloon Backstage ("Backstage") is a private internal tool operated by Pantaloon (pantaloon.io). This policy explains what information Backstage holds, why, and the choices people have. It covers the Backstage web app at backstage.pantaloon.io.

Who uses Backstage

Backstage is used only by Pantaloon team members and a small number of invited partners (such as investors and accountants). Nobody can create an account themselves — people can only sign in if the team has added their email address.

Information we hold

• Account details — the name and email address of each person who has been given access, and their role.
• Work content — the things the team enters into Backstage: tasks and boards, calendar entries, holiday records for team members, and the draft social media posts, captions, images and videos prepared in the Content Control Room, together with review comments.
• Business data — sales, wishlist and revenue figures for the games Pantaloon publishes, and internal forecasts.
• Connected-account tokens — when an authorised team member connects one of Pantaloon's own social accounts, the access tokens needed to post to it (see below), stored encrypted.

Google user data (YouTube)

If an authorised Pantaloon team member connects the Pantaloon YouTube channel, Backstage asks Google for these permissions:

• youtube.upload — to upload videos, which the team has reviewed and approved, to the Pantaloon channel.
• youtube.readonly — to read the channel's name and identifier, only to confirm Backstage is connected to the right channel.

What we store from Google: the channel's name and identifier, and the OAuth access and refresh tokens, which are encrypted before being saved. We do not read, collect or store any information about people who watch, comment on or subscribe to the channel, and we do not access any other Google data.

How we use it: only to upload approved videos to Pantaloon's own channel and to show whether the connection is working. We do not sell Google user data, do not use it for advertising, do not transfer it to others except as needed to run Backstage (our hosting and storage providers, who process it on our behalf), and no person reads it except as needed for security or to comply with law.

Backstage's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Instagram

If an authorised team member connects the Pantaloon Instagram account (a Professional account), Backstage uses Instagram Login and asks for these permissions: instagram_business_basic (the account's username, follower and post counts, and its recent posts with their like and comment counts), instagram_business_content_publish (to publish posts, carousels and Reels the team has reviewed and approved, to that account) and instagram_business_manage_comments (to show the comments on Pantaloon's own posts so the team can see how they are received). Posts and comments are read live and shown only to signed-in team members inside Backstage; they are not stored or shared, and Backstage does not reply to, hide or delete comments. What we store from Instagram is the account's username and identifier and the encrypted access token. We do not collect information about the people who follow, like or comment on the account, beyond showing their public comment text and username to the team while it is on screen.

TikTok and Bluesky

If an authorised team member connects the Pantaloon TikTok account, Backstage uses TikTok Login to connect it and asks for these permissions: user.info.basic (to show which account is connected), video.publish (to post approved videos to that account, using the options a team member chooses for each post), user.info.profile (the account's bio, verified status and profile link), user.info.stats (its follower, following, like and video counts) and video.list (its recent public videos and their view, like, comment and share counts). The profile, statistics and video information is read live and shown only to signed-in team members inside Backstage; it is not stored or shared. What we store from TikTok is the account's display name and identifier and the encrypted access tokens. We do not collect information about the people who watch or comment on the account's videos. For Bluesky, the Pantaloon account's handle and an app password are stored encrypted and used only to publish approved posts.

Removing a connection

A connection can be removed at any time. In Backstage, Disconnect on the connection's card in the Content Control Room deletes the stored tokens straight away. You can also revoke access from the other side: for Google at myaccount.google.com/permissions, for TikTok in the app's Security and permissions settings, for Instagram under Apps and websites in the account's settings, and for Bluesky by revoking the app password.

Where information is kept and who processes it

Backstage runs on a small set of service providers that process information on our behalf: Vercel (hosting), Supabase (database, sign-in and file storage), Cloudflare (storage for larger video files) and Resend (sign-in and notification emails). Our database is hosted in the EU (Ireland). We do not sell personal information.

How long we keep it

Account details are kept while a person has access and removed when access ends. Work content is kept for as long as it is useful to the business, and can be deleted by the team. Stored tokens are deleted when a connection is removed.

Your choices and contact

If you have access to Backstage and want to see, correct or delete information about you, or have any question about this policy, email jamin@pantaloon.io. We may update this policy; the date at the top shows when it last changed. See also our Terms of Service.