Privacy Policy

QUANT Software House Limited (company number 16902352) is the controller for this website and the central Sense CMS services it operates. Our registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Privacy enquiries and data-rights requests may be sent to info@SenseCMS.com. A customer operating an independent Sense CMS installation is normally the controller for information collected through that installation, while we act only in the role agreed with that customer.

This policy covers www.sensecms.com, licensing and package-distribution services, contact forms, live chat, and central connection services used by Sense CMS social-publishing integrations. It does not replace the privacy notice of an independently operated customer website or the privacy terms of a connected third-party platform.

Depending on how you use the services, we may process your name, business contact details, enquiry or chat content, account and licence records, canonical website domain, product and package identifiers, download and delivery records, and technical information such as the server-observed IP address, approximate country, request time, requested address, browser or device information and security events. Contact forms use a keyed one-way visitor hash for abuse prevention rather than storing the submitted IP address with the form entry.

We use contact-form and live-chat information to answer enquiries, provide support, route conversations, prevent abuse and maintain a reliable record of the exchange. Authorised operators can see the IP address observed by our server and an approximate country derived locally for a live-chat conversation; these details are not returned in public chat state and are erased when the conversation is deleted. Do not send passwords, licence keys, private encryption keys, access tokens or unnecessary sensitive information.

When a licence is verified or a protected package is requested, we process the licence and product identifiers, the canonical domain, validation result, time and limited security metadata needed to provide the service, enforce entitlement, prevent fraud and investigate failures. Licence keys are not placed in public URLs or intentionally written to public logs. Customer installations keep local licence information encrypted with an installation-specific key.

The available Sense CMS integrations include Facebook Pages, X, LinkedIn, Bluesky, Mastodon, Telegram Channels, TikTok and YouTube. If an authorised administrator connects one of these services, we or the customer installation may process an account, profile, Page, channel or board identifier and display name; granted permissions; encrypted access or refresh credentials; selected publication targets; reviewed text and media references; publication time; provider response identifiers; and delivery status. Depending on the provider, a central Sense CMS broker may also process short-lived authorisation state and a single-use connection claim. We never ask for a social-platform password.

For Facebook, Meta may provide an app-scoped account identifier, the identifiers and names of Pages the administrator can manage, Page permissions and a Page access token. The central broker validates the calling CMS licence, completes Meta authorisation and transfers the selected Page credential through a short-lived, single-use encrypted claim. Pending broker records expire after ten minutes and are removed after a successful claim. The reusable Page credential is then held encrypted by the customer installation until an authorised user disconnects the account. Publishing sends the reviewed content and necessary credential to Meta through its Graph API.

The YouTube Publisher requests youtube.upload to upload videos selected by an editor and youtube.readonly only to read the identifier and title of the currently authenticated channel so the editor can confirm the destination. After an administrator chooses to connect Google, Google provides that channel information, an access token, a refresh token and token expiry information. The central Sense CMS broker keeps the Google client secret in private storage, uses encrypted authorisation state and transfers the channel credential to the licensed installation through a short-lived, single-use claim. The installation stores that credential encrypted until the channel is disconnected, access is revoked or the credential is replaced. When an editor explicitly publishes, Sense CMS sends Google the selected MP4 file, title, description, privacy and audience settings, applicable synthetic-media disclosure and subscriber-notification choice. We store the returned YouTube video identifier, link and delivery result. The integration does not request email, contacts, comments, subscribers or analytics, and does not read, edit or delete existing videos. Google data is used and transferred only to provide and secure the user-requested connection and upload, consistently with the Google API Services User Data Policy, including its Limited Use requirements.

An authorised administrator can disconnect a YouTube channel in Sense CMS, which deletes the installation’s stored channel credential and prevents new uploads through that connection. The Google account holder can also revoke Sense CMS access from the security settings of their Google Account. A user may request deletion of related central support or security records by contacting info@SenseCMS.com, subject to legal or fraud-prevention retention requirements. Revocation or disconnection does not delete videos already uploaded to YouTube; those remain controlled through the connected YouTube account.

Instagram and Threads are awaiting Meta platform access. Pinterest account connection remains unavailable while Pinterest trial access is pending. We do not process connection credentials or publish through an integration merely because it is listed here: processing begins only when the feature is available and an authorised administrator actively connects the relevant account. This policy will be reviewed before a materially different integration goes live.

We process information to provide requested website, support, licensing, download and integration services; take steps before entering into a contract; administer contracts; secure systems; prevent abuse, fraud, replay and duplicate delivery; diagnose faults; improve reliability; and meet legal obligations. The applicable lawful bases are performance of a contract or pre-contractual steps, our legitimate interests in operating and protecting the services, compliance with legal obligations and, where required, consent. We do not sell personal information.

We share information only as needed with hosting, email, security and professional-service providers, with a connected platform chosen by the authorised user, with a customer that controls its own Sense CMS installation, or where law requires it. Connected providers such as Meta, X, LinkedIn, Google or other platform operators may process information outside the United Kingdom under their own terms. Where we make a restricted international transfer, we use an applicable adequacy regulation, contractual safeguards or another lawful transfer mechanism and can provide further information on request.

Current website settings retain stored contact-form submissions for up to 365 days and live-chat conversations for up to 30 days, unless they are deleted earlier or must be retained for a legal or security reason. Unclaimed central connection claims, including Google and YouTube claims, expire after ten minutes and are removed after successful use. Connected-platform credentials remain encrypted in the relevant installation until disconnection, revocation or replacement. YouTube delivery records retain the uploaded video identifier, link, requested settings and result for operational history, duplicate prevention and audit, but not a second copy of the Google credential. Consent choices for optional analytics are remembered for up to 180 days. Contract, licence, delivery and security records are kept only for the period reasonably required for service delivery, audit, dispute handling, duplicate prevention, legal compliance and the establishment, exercise or defence of claims.

We use access controls, HTTPS, encryption for sensitive stored credentials, private runtime storage, short-lived connection state, least-privilege permissions and logging designed to avoid secrets. No internet service can be guaranteed completely secure. Customers remain responsible for protecting their own Sense CMS accounts, server, database, backups and connected-platform permissions.

Subject to applicable law, you may ask for access, correction, erasure, restriction, portability or objection and may withdraw consent at any time without affecting earlier lawful processing. Rights depend on the processing context and lawful basis. Contact info@SenseCMS.com; we may verify identity and authority before acting. You may also complain to the UK Information Commissioner’s Office at ico.org.uk or to another competent supervisory authority.

We review this policy when services, integrations or legal requirements change. Material changes will be brought to users’ attention where required. Last updated: 20 September 2026.