Privacy Policy
Last updated: 31 July 2026
This Privacy Policy explains what information AccordMix collects, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to the AccordMix marketing site, the AccordMix studio, our API, and the AccordMix listener mobile app. If you connect a Google account to AccordMix, section 5 and section 6 describe exactly what Google user data we access and how we use it.
1. Who we are and what this policy covers
AccordMix is an audio-first live broadcasting and multistreaming platform for churches and organizations. It is operated by Accord Ltd ("AccordMix", "we", "us", "our"), registered in Nigeria at 13, Primewater Views, Off Freedom Way, Lekki, Lagos.
This policy covers:
- the marketing website at accordmix.com;
- the AccordMix studio web application at studio.accordmix.com;
- the AccordMix API that powers both; and
- the AccordMix listener mobile app for iOS and Android (
com.accordmix.listener).
Together we call these the "Service". For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") and the EU and UK General Data Protection Regulation ("GDPR"), Accord Ltd is the data controller for the personal data described in this policy.
Where an organization uses AccordMix to broadcast to its own congregation or audience, that organization is the controller of the content it broadcasts and of any personal data contained in it; AccordMix acts as its processor for that content.
2. Definitions
| Term | Meaning |
|---|---|
| Operator | A person with an AccordMix account who produces broadcasts — the account type created at studio.accordmix.com. |
| Listener | A person who follows a station, listens to broadcasts, or takes part in live chat, via the web or the mobile app. |
| Organization | The workspace an Operator belongs to. Members hold one of four roles: Owner, Admin, Operator, or Viewer. |
| Broadcast | A single live session produced through AccordMix, together with its status, health, and relay history. |
| Destination | A third-party platform a Broadcast is relayed to — a connected YouTube channel, or a custom RTMP/RTMPS endpoint. |
| Content | The audio, video, titles, descriptions, artwork, and chat messages you send through the Service. |
| Google user data | Data we obtain from Google APIs after you grant consent, as described in section 5. |
3. Information we collect
We collect only what the Service needs in order to work. We group it as follows.
3.1 Information you give us
- Account details — your name, email address, and a cryptographic hash of your password. We never store your password itself.
- Organization details — the organization name and URL slug you choose, and your role within it.
- Profile details — an optional display name and avatar image shown to listeners.
- Broadcast metadata — titles, descriptions, scheduled times, and stream settings you enter.
- Support correspondence — the contents of emails you send us and any information you volunteer in them.
3.2 Information we collect automatically
- Session records — when you register, sign in, request a password reset, or verify your email, we record the IP address and browser user-agent string associated with that request, together with the time it was last used. This is used to secure your account, let you review and revoke active sessions, and detect abuse.
- Broadcast operational data — stream status, duration, bitrate and connection health, which destinations were used, and any relay errors or incidents. This is technical telemetry about the stream, not an analysis of its content.
- Mobile push tokens — if you enable notifications in the listener app, we store the Expo push token and the platform (iOS or Android) so we can tell you when a station you follow goes live.
- Recordings — if you enable recording for a broadcast, we store the resulting audio or video file so you and your listeners can replay it.
3.3 Information from connected third-party accounts
If you connect a YouTube channel, we receive data from Google. This is described in full in section 5. If you add a custom RTMP or RTMPS destination, we store the endpoint URL and its stream key, encrypted at rest.
3.4 Payment information
Paid plans are processed by Paystack. Card numbers, CVVs, and bank credentials are entered directly with Paystack and never reach AccordMix servers. We store only the identifiers Paystack returns to us — a customer code, subscription code, plan code, and email token — plus your plan, billing currency, billing interval, and subscription status.
3.5 Community and chat data
If you follow a station or post in live chat, we store the follow relationship and your chat messages, along with moderation state (whether a message was deleted, by whom, and whether an account is banned from chat). Chat messages are public — see section 10.
3.6 What we do not collect
- We do not use third-party advertising networks, advertising identifiers, or cross-site tracking pixels.
- We do not use third-party product-analytics or session-replay services.
- We do not buy personal data from data brokers.
- We do not collect special-category data (health, biometrics, religion, political opinion) as a product feature. Note that Content you choose to broadcast may itself reveal such information; you control what you broadcast.
4. Cookies and local storage
We use a small number of strictly necessary cookies and local storage entries. We do not use advertising or tracking cookies, so we do not show a consent banner for them.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| Session cookie | HTTP cookie (httpOnly, Secure, SameSite=Lax) | Keeps you signed in to the studio. Holds an opaque token; the server stores only its hash. | Until it expires or you sign out |
| accord_yt_oauth_state | HTTP cookie (httpOnly, Secure, SameSite=Lax) | Cross-site request forgery protection for the YouTube connection flow. Holds a signed, single-use value. | 10 minutes |
| Currency preference | Browser local storage (marketing site) | Remembers whether you are viewing prices in NGN or USD. | Until you clear site data |
| Secure storage token | Device secure storage (mobile app) | Keeps you signed in to the listener app. | Until you sign out or uninstall |
Our marketing site loads web fonts from Google Fonts. Google may receive your IP address when a font is fetched; see the Google Privacy Policy.
5. Google user data: what we access, why, and what we store
AccordMix uses YouTube API Services so that you can broadcast to your own YouTube channel without copying stream keys by hand. Connecting a channel is entirely optional — AccordMix works without it. This section describes the integration in full.
5.1 The permissions we request
When you choose Connect YouTube in the studio, Google shows you a consent screen listing the following scopes. We request no others.
| Scope | What it lets us do | Why AccordMix needs it |
|---|---|---|
openid | Receive a signed token identifying the Google account that granted access. | So we can tie the connection to a stable account identifier and detect when a different account is reconnected. |
email | Read the email address of the Google account. | So the studio can show which Google account a channel connection belongs to, and so we can warn the right person when a connection breaks. |
profile | Read basic profile information for the Google account. | So the connection is shown with a recognisable name in your list of destinations. |
https://www.googleapis.com/auth/youtube | Manage your YouTube account: read your channel, and create, bind, update, and end live broadcasts and live streams on it. | This is the core of the feature. AccordMix creates the YouTube live stream and live broadcast for you, binds them together, keeps the title in sync, and ends the broadcast cleanly when you stop. None of this is possible with a read-only scope. |
The authorization request is made with offline access so that AccordMix can refresh its access token and start your broadcast at the scheduled time without you having to be at your computer, and with a consent prompt so that you always see the permission screen rather than having access granted silently.
5.2 The exact YouTube Data API operations we perform
These are the only calls AccordMix makes against your channel. Each one is triggered by an action you take in the studio.
| API operation | When it runs | What it does |
|---|---|---|
youtube.channels.list (mine) | Immediately after you grant access. | Reads your channel ID, channel title, and channel thumbnail so we can confirm which channel was connected and show it in your destinations list. |
youtube.liveStreams.insert | When you start or schedule a broadcast to YouTube. | Creates the ingest endpoint on YouTube that AccordMix will push your stream to. |
youtube.liveBroadcasts.insert | When you start or schedule a broadcast to YouTube. | Creates the YouTube live broadcast, using the title, description, and privacy setting (public, unlisted, or private) you chose in AccordMix. |
youtube.liveBroadcasts.bind | Immediately after the two calls above. | Attaches the ingest endpoint to the broadcast so your audio and video appear on the right YouTube event. |
youtube.liveBroadcasts.list | When you rename a live broadcast. | Reads the current title so we can update it without discarding your other YouTube settings. |
youtube.liveBroadcasts.update | When you rename a live broadcast. | Applies the new title to the YouTube broadcast. |
youtube.liveBroadcasts.transition | When you end a broadcast. | Marks the YouTube broadcast complete so it stops cleanly and the replay is published. |
We do not read your videos, playlists, comments, subscribers, watch history, analytics, or any other YouTube data. We do not act on your channel except in response to a broadcast action you take in AccordMix.
5.3 What we store, and how it is protected
| Stored item | Protection |
|---|---|
| OAuth access token | Encrypted at rest with AES-256-GCM before it is written to the database. |
| OAuth refresh token | Encrypted at rest with AES-256-GCM before it is written to the database. |
| Access token expiry timestamp | Stored in plain form; contains no secret. |
Google account identifier (the sub claim) | Stored so we can detect when a different Google account reconnects a channel. |
| YouTube channel ID, channel title, channel thumbnail URL | Stored so the studio can display the connected channel. |
| The list of scopes you granted | Stored so we can tell you if a required permission is missing and prompt you to reconnect. |
| The AccordMix user who connected the channel, and the most recent connection error | Stored for troubleshooting. Error text is truncated and is not used for any other purpose. |
Google user data is sensitive data. Encryption keys are held outside the database and are not accessible to the application database user, and access tokens are re-encrypted each time they are refreshed. The full set of data protection mechanisms we apply to it — encryption in transit and at rest, key management, access control, and secure deletion — is set out in section 12.
5.4 What we never do with Google user data
- We never sell, rent, or trade it.
- We never use it for advertising, ad targeting, ad measurement, or to build advertising profiles.
- We never use it to determine creditworthiness or for lending purposes.
- We never use it to train, fine-tune, or evaluate artificial intelligence or machine learning models — generalised or otherwise.
- We never allow humans to read it, except with your explicit consent, to investigate a specific security incident or abuse report, to comply with applicable law, or where the data has been aggregated and de-identified for internal operations.
- We never transfer it to third parties except as strictly necessary to provide the feature you asked for, to comply with applicable law, or as part of a merger or acquisition in which we give you advance notice.
6. Google API Services Limited Use disclosure
AccordMix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AccordMix uses YouTube API Services. By connecting a YouTube channel to AccordMix you are also agreeing to the YouTube Terms of Service. Google's handling of your data is governed by the Google Privacy Policy. AccordMix's own use of the YouTube API is governed by the YouTube API Services Terms of Service.
7. Reviewing and revoking access to your Google account
You can withdraw AccordMix's access to your YouTube channel at any time, in two ways.
From inside AccordMix. Open Destinations, find the connected channel, and choose Disconnect. This does three things immediately: AccordMix asks Google to revoke the token, deletes the encrypted access and refresh tokens and the stored channel details from our database, and removes the YouTube destination from your organization. Only an Owner or Admin of the organization can disconnect a channel.
From your Google Account. Visit Google's third-party access settings and remove AccordMix. Access stops at once. Any stored tokens on our side become unusable, and we delete them the next time the connection is checked or when you delete your account, whichever comes first.
Deleting your account or your organization also revokes access, immediately. Account deletion has a 30-day window in which you can restore the account, but Google tokens are never held through that window — they are revoked at Google and deleted at the moment you make the request. If you restore the account, your YouTube connections are not restored with it and must be granted again.
Revoking access does not delete broadcasts that were already published to YouTube. Those live on your channel and are managed by you through YouTube.
8. How we use information, and our legal bases
| Purpose | Data used | Legal basis (NDPA / GDPR) |
|---|---|---|
| Create and administer your account and organization | Account details, organization details, role | Performance of a contract |
| Produce, relay, and optionally record your broadcasts | Broadcast metadata, Content, destination credentials | Performance of a contract |
| Publish your broadcast to a connected YouTube channel | Google user data (section 5) | Consent, given on the Google consent screen; withdrawable at any time (section 7) |
| Keep your account and our platform secure; detect and investigate abuse | Session IP and user-agent, sign-in events, moderation state | Legitimate interests in securing the Service |
| Bill paid plans and handle refunds and disputes | Paystack identifiers, plan and subscription status | Performance of a contract; legal obligation for tax records |
| Send transactional email (verification, password reset, billing notices) | Email address, account details | Performance of a contract |
| Send push notifications when a station you follow goes live | Push token, follow relationships | Consent, given when you enable notifications; withdrawable in device settings |
| Provide support and respond to your requests | Support correspondence, account details | Legitimate interests in supporting our users |
| Maintain reliability and diagnose faults | Broadcast telemetry, incident logs | Legitimate interests in operating a reliable Service |
| Comply with legal obligations and respond to lawful requests | Whatever the obligation requires | Legal obligation |
Where we rely on legitimate interests, we have considered the impact on you and concluded that the processing is necessary and proportionate. You may object at any time — see section 13.
9. Who we share information with
We do not sell personal data, and we have not sold or shared personal data for cross-context behavioural advertising in the preceding twelve months. We share data only with the service providers below, each bound to process it solely on our instructions.
| Provider | What it does for us | What it receives |
|---|---|---|
| Google / YouTube | Publishes your broadcast to your connected channel | Google user data covered by your consent, plus the broadcast title, description, privacy setting, and the stream itself |
| Paystack | Processes subscription payments | Your email address and billing details you enter directly with Paystack |
| Mailtrap (SMTP) | Delivers transactional email | Your email address and the contents of the message |
| Expo | Delivers push notifications to the mobile app | Your device push token and the notification text |
| Livepeer | Optional managed transcoding for some broadcasts | The broadcast media stream |
| Hosting and infrastructure (Render, Oracle Cloud Infrastructure, Hetzner, Cloudflare) | Runs our application, database, media servers, and DNS/CDN | Data at rest and in transit, as needed to run the Service |
| Object storage (Cloudflare R2) | Stores broadcast recordings until their retention period ends | Recorded broadcast audio and video |
We may also disclose information:
- to comply with applicable law, a court order, or a valid request from a public authority, where we are satisfied the request is lawful and proportionate;
- to establish, exercise, or defend legal claims;
- to protect the rights, safety, or property of AccordMix, our users, or the public; and
- to a successor entity in connection with a merger, acquisition, or sale of assets — in which case we will give you notice before your data becomes subject to a different privacy policy.
10. Information that is visible to others
Some information is public by design. Please keep this in mind before you share it.
- Your organization's public station page — its name, slug, and any live or archived broadcasts you have made public.
- Broadcast titles, descriptions, and artwork — shown to anyone who can reach the broadcast.
- Your listener display name and avatar — shown alongside your live chat messages.
- Live chat messages — visible to everyone watching that broadcast. Moderators can delete messages and ban accounts from chat.
- Follower counts — the number of followers a station has is shown publicly; the identities of individual followers are not.
Anything you publish to a Destination leaves AccordMix. Once a broadcast is on YouTube or another platform, that platform's own terms and privacy policy govern it.
11. How long we keep information
| Data | Retention |
|---|---|
| Google OAuth access and refresh tokens, and connected channel details | Kept only while the connection is active. Deleted immediately when you disconnect the channel, delete your account, or delete your organization, and the token is revoked at Google at the same time. The 30-day restore window described below does not apply to Google tokens — they are never retained past your request. |
| Account and organization records | Kept for as long as your account is open. When you delete an account or an organization it is immediately withdrawn from public and signed-in view, held for 30 days so you can restore it if you change your mind, and then permanently deleted. Everything attached to it — broadcasts, recordings, destinations, chat messages, and memberships — is deleted at the same time. |
| Session records (including IP and user-agent) | Deleted when the session expires or is revoked; expired sessions are purged within 90 days. |
| Password reset and email verification tokens | Single use; expire within hours of being issued and are purged thereafter. |
| Recordings and archives | Every broadcast is recorded automatically and kept for the retention period shown for your published plan. When that period ends the recording is permanently deleted from storage, and the broadcast's history entry says so rather than disappearing. Retention is fixed when the recording is made, so moving to a lower plan never shortens a recording you already have; moving to a higher plan extends recordings that are still stored. Recordings are also deleted immediately when you delete the broadcast, your organization, or your account. |
| Broadcast records, telemetry, and incident logs | Kept for up to 24 months for reliability analysis, then deleted or aggregated. |
| Live chat messages | Kept with the broadcast they belong to; deleted when that broadcast is deleted. |
| Mobile push tokens | Kept until you disable notifications, sign out, or the token becomes invalid. |
| Billing and tax records | Kept for the period required by Nigerian tax law, typically six years, even after account closure. |
| Support correspondence | Kept for up to 24 months after the matter is resolved. |
Backups are retained on a rolling basis and are overwritten within 35 days. Data deleted from the live system may persist in a backup until that backup rotates out.
12. How we protect your data, including sensitive data
We treat the following as sensitive data and apply the heightened protections described in this section to all of it: Google user data obtained through the https://www.googleapis.com/auth/youtube scope (OAuth access tokens, OAuth refresh tokens, and connected channel details); RTMP and RTMPS stream keys and ingest keys; account credentials and session tokens; and the audio and video content of your broadcasts.
12.1 Data protection mechanisms applied to sensitive data
| Mechanism | How we apply it to sensitive data |
|---|---|
| Encryption in transit | All traffic to our websites, API, and media endpoints is encrypted with TLS 1.2 or higher. All calls to Google APIs are made over HTTPS. We do not accept unencrypted connections for authenticated traffic. |
| Encryption at rest | Google OAuth access tokens and refresh tokens, RTMP/RTMPS stream keys, and ingest keys are each encrypted with AES-256-GCM — an authenticated cipher — before they are written to the database. Ciphertext is stored with a unique per-record initialisation vector and an authentication tag, so tampering is detectable. Refreshed access tokens are re-encrypted every time they are renewed. Database storage volumes and backups are additionally encrypted at rest by our infrastructure providers. |
| Key management | The encryption key is derived from a secret held in the application's runtime environment, outside the database and outside the source repository. The database user that stores the ciphertext has no access to the key, so a database-only disclosure does not yield usable Google tokens. |
| Irreversible hashing | Passwords are never stored — only a salted scrypt hash. Session tokens and password-reset and email-verification tokens are never stored — only their hashes. A disclosure of our database therefore yields no usable password or session. |
| Access control and least privilege | Every record is scoped to the organization that owns it, and queries are constrained by that scope. Only Owners and Admins can connect or disconnect a YouTube channel or view destination settings. Administrative access to production systems is limited to named personnel who require it, is individually authenticated, and is granted on a least-privilege basis. |
| No human access to Google user data | Decrypted Google tokens are used only by automated processes acting on your instruction. No member of staff reads Google user data except with your explicit consent, to investigate a specific security incident or abuse report, or where we are legally compelled — as stated in section 5.4. |
| Secure authentication and session handling | Session cookies are httpOnly, Secure in production, and SameSite=Lax, so they cannot be read by page scripts and are resistant to cross-site request forgery. You can review and revoke your active sessions at any time. |
| Protection of the OAuth flow | The YouTube connection flow is protected by an HMAC-signed, single-use, time-limited state value validated against a matching httpOnly cookie, so a third party cannot induce you to connect a channel without your knowledge. |
| Data minimisation | We request only the scopes we call, store only the fields listed in section 5.3, and do not inspect the substance of your broadcasts beyond what is technically required to relay and, where you enable it, record them. |
| Secure deletion | When you disconnect a channel or delete your account, the token is revoked at Google and the encrypted records are deleted, on the schedule in section 11. Deleted data is removed from backups as those backups rotate. |
| Secure development | Changes are peer-reviewed before release, secrets are supplied through environment configuration and never committed to source control, and dependencies are kept current with security advisories. |
12.2 Incident response
No system is perfectly secure. We monitor for unauthorised access and investigate credible reports. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and, where the risk is high, notify affected users without undue delay, together with the steps we have taken and what you should do. If a breach affects Google user data, we will additionally notify Google.
To report a suspected vulnerability or a security incident, email hello@accordmix.com with "Security" in the subject line. We acknowledge reports within three business days.
13. Your rights and how to exercise them
Subject to the conditions in the applicable law, you have the right to access your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to receive your data in a portable format; to withdraw consent at any time without affecting processing already carried out; and not to be subject to decisions based solely on automated processing — we do not make such decisions.
How to exercise them:
- Withdraw Google access — disconnect the channel in AccordMix, or remove AccordMix at Google's third-party access settings. See section 7.
- Turn off push notifications — in your device settings or in the listener app.
- Delete a listener account — from the profile screen in the listener app or on the web; this removes your sessions, follows, chat messages, and push tokens.
- Delete an operator account — open Profile in the AccordMix studio and use the danger zone. You confirm with your password. Your sessions end at once and the account is permanently deleted after 30 days; sign in during that window to restore it. If you are the only owner of an organization, delete the organization first, or make another member an owner.
- Delete an entire organization — an owner can delete it from the same danger zone, confirming with their password and the organization's name. Every member loses access, the Paystack subscription is cancelled, and connected YouTube channels are revoked at Google immediately. The organization and all its broadcasts, recordings, and chat messages are permanently deleted after 30 days, and an owner can restore it before then — though YouTube channels must be reconnected.
- Access, correction, portability, restriction, or objection — email hello@accordmix.com. We respond within 30 days and will tell you if we need longer.
We will not discriminate against you for exercising any of these rights. If you are in Nigeria you may complain to the Nigeria Data Protection Commission; if you are in the EU or the UK you may complain to your local supervisory authority; if you are a California resident, the CCPA rights to know, delete, correct, and opt out of sale or sharing are covered by the above — and, as stated in section 9, we do not sell or share personal data.
14. International data transfers
AccordMix is operated from Nigeria, and our infrastructure and service providers are located in Nigeria, the European Union, the United Kingdom, and the United States. Using the Service therefore involves transferring your data across borders.
Where we transfer personal data out of Nigeria, we rely on the mechanisms permitted by the NDPA, including transfers to countries with adequate protection and contractual safeguards with our processors. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional technical measures such as the encryption described in section 12.
15. Children's privacy
AccordMix is not directed to children. You must be at least 13 years old to use the Service, or older where your country sets a higher age for consent to data processing — 16 in much of the EEA and 18 in Nigeria for an account that enters into a paid contract. Broadcasts AccordMix creates on YouTube are marked as not made for kids.
We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us with personal data, email hello@accordmix.com and we will delete it.
16. Changes to this policy
We may update this policy as the Service changes or the law does. The date at the top of this page always reflects the current version. If a change materially affects how we handle your personal data — in particular any change to how we use Google user data — we will notify you by email or in the studio before it takes effect, and where the law requires it we will ask for your consent again.
17. Contact us
For any privacy question, request, or complaint, contact the data controller: Accord Ltd, 13, Primewater Views, Off Freedom Way, Lekki, Lagos, Nigeria — hello@accordmix.com.
Please put "Privacy request" in the subject line so it reaches the right person quickly.