Privacy Policy

YTCMS Creator Center ("YTCMS", "we", "us") is an independent YouTube creator operations platform operated at ytcmscreatorcenter.com and ytcms.app. For the personal data described in this policy we act as the data controller within the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

YTCMS is an independent product. We are not affiliated with, endorsed by, sponsored by, or an official product of Google LLC or YouTube. "YouTube" and related marks are trademarks of Google LLC.

Important scope note: YTCMS accesses YouTube data only through official, publicly documented Google and YouTube APIs under the OAuth scopes you approve. YouTube CMS, Multi-Channel Network (MCN), Content Manager and Content ID capabilities are not active in YTCMS unless and until they are officially approved and granted to us by YouTube. Nothing in this policy or in the product implies that such partner-only access exists today.

Contact us any time at support@ytcms.app. This address is also the point of contact for all data subject requests and for any data protection enquiries, including from supervisory authorities.

• Account data: your email address, display name, authentication identifiers and sign-in method (email/password or a social provider such as Google, GitHub or Microsoft).
• Workspace data: workspaces, teams, roles, projects, scripts, thumbnails, notes, cases and any content you create inside the product.
• Google / YouTube data: when you authorize a channel, we receive your Google account identity (email, profile name) and the YouTube data covered by the scopes you approve — channel profile and branding, Brand Account associations, channel and video metadata, statistics, and analytics and reporting data.
• Billing data: transaction records, plan and subscription status handled by our payment processor (Paddle, acting as merchant of record). We do not store full payment card numbers.
• Operational data: logs, audit records, sync history, security events and error diagnostics needed to run the service securely.
• Support data: messages, attachments and evidence you send us when you contact support or open a recovery or appeal case.

YTCMS Creator Center uses YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service and the Google Privacy Policy. Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• We request the minimum OAuth scopes required for the features you activate, using incremental authorization: optional capabilities ask for additional scopes only when you enable them, and you can decline any individual scope. Core sign-in keeps working even when optional scopes are declined.
• Channel and analytics data — channel profile, video metadata, statistics and analytics are used only to display and manage your own channels inside your workspace: dashboards, analytics views, publishing workflows, metadata management and rights/recovery workflows you initiate.
• Brand Accounts — where your Google identity manages Brand Accounts, we synchronize those channel identities so you can switch between the channels you are authorized to manage. We only access channels that your Google account is permitted to administer.
• We never sell YouTube data, never use it for advertising or cross-site profiling, and never transfer it to third parties except infrastructure providers acting on our documented instructions.
• We do not use Google or YouTube data to train generative AI or machine-learning models.
• We do not use YouTube data to build independent audience profiles, to monitor content we do not administer on your behalf, or for any surveillance purpose.

You can revoke our access at any time from your Google security settings or by disconnecting the channel inside YTCMS. Revoking access stops all future syncing and triggers deletion of the stored tokens for that connection as described in Section 7.

• Providing the service — operating your account, workspaces, connected channels and the features you use. Lawful basis: performance of a contract (Art. 6(1)(b) GDPR).
• Google OAuth connections — requesting only the scopes needed for features you activate. Lawful basis: your consent (Art. 6(1)(a)), given on Google's own consent screen and withdrawable at any time.
• Security and abuse prevention — audit logs, access control, anomaly detection. Lawful basis: legitimate interests (Art. 6(1)(f)).
• Billing, tax and accounting records — lawful basis: legal obligation (Art. 6(1)(c)).
• Product communications — service and security notices are sent as part of the contract; optional marketing communications rely on your consent, which you can withdraw at any time.

• OAuth access and refresh tokens are encrypted with AES-256-GCM before storage, are accessible only to server-side components, and are never exposed to the browser, to other users, or to client-side code.
• Provider secrets and API keys are held in server-side encrypted secret storage.
• Row-level security isolates every workspace; staff access is least-privilege and audit-logged.
• All traffic is served over TLS; administrative actions are recorded in audit logs.
• Tokens are refreshed automatically while a connection is active; when a connection is revoked or a channel is disconnected, the stored tokens are deleted.

We use strictly necessary storage for authentication and security. Optional preference and analytics storage is used only with your consent, which you can give, change or withdraw at any time: Cookie preferences. Details of every category are in our Cookie Policy.

Cached YouTube channel and analytics data is retained no longer than 30 days unless you keep the channel connected, in which case it is continuously refreshed from the API.

• Disconnecting a channel deletes its stored OAuth tokens immediately and its cached channel data within 30 days.
• Deleting your account removes your workspace data within 30 days, except records we must keep for legal, billing or security reasons (Art. 6(1)(c) and 6(1)(f) GDPR), which are kept only for the period required by law.
• Audit and security logs are retained for a limited period necessary to investigate abuse and meet legal obligations, then deleted or anonymized.

You can request a copy of your personal data in a structured, commonly used, machine-readable format, or request deletion of your account and data, at any time by emailing support@ytcms.app. You can also disconnect individual channels yourself inside the product, which removes the associated tokens and cached data as described above. We respond to verified requests within one month.

We rely on a small number of infrastructure providers to operate the service: cloud hosting and database (Lovable Cloud / Supabase infrastructure), email delivery, payment processing (Paddle, as merchant of record), and optional AI features (through the Lovable AI Gateway). Google acts as an independent controller for the data it processes when you use its consent screens and APIs.

Processors handle personal data only on our documented instructions and under data processing agreements that include the confidentiality and security obligations required by Article 28 GDPR. We maintain an up-to-date list of sub-processors and will provide it on request.

Some of our infrastructure providers process data outside the European Economic Area. Where personal data is transferred to a third country, we rely on an adequacy decision under Article 45 GDPR or on appropriate safeguards under Article 46 — in particular the European Commission's Standard Contractual Clauses — together with supplementary technical measures such as encryption in transit and at rest.

If you are in the EEA, UK or another jurisdiction with equivalent protections, you have the right to:

• Access a copy of your personal data (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure ("right to be forgotten") (Art. 17).
• Restriction of processing in certain circumstances (Art. 18).
• Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20).
• Object to processing based on legitimate interests, including profiling (Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
• Not be subject to solely automated decisions with legal or similarly significant effect (Art. 22). We do not make such decisions about you.

To exercise any of these rights, email support@ytcms.app. We respond to verified requests within one month (extendable by two further months for complex requests, as permitted by Art. 12(3)).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

The service is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children.

We will update this page when our practices change and revise the "last updated" date above. Material changes are announced inside the product before they take effect.

For any privacy question, data subject request or security concern, contact us at support@ytcms.app or via our contact page.