Privacy Policy

Viewlio (“Viewlio”, “we”, “us”) provides a web application for YouTube creators. It connects to a creator’s own YouTube channel, reads video, caption and analytics data, accepts creator-uploaded source files and thumbnail options, and produces analysis, comparisons, channel trends, saved tips and video plans. This policy explains what personal data and creator content we collect, why we collect it, and the choices you have.

Questions about this policy or your data: maxwinterleinweber@gmail.com.

• Account and authentication data. When you sign in with Google through Supabase authentication, we receive account details such as your email address, name, profile image, user ID, session state and authentication metadata.
• Google authorisation data. If you grant YouTube access, we store the Google OAuth refresh token and granted scope string needed to request short-lived access tokens server side. The refresh token is not exposed to the browser.
• YouTube channel and video data. With your permission, we read data for channels and videos you own or are authorised to manage. This can include channel title, description, avatar, subscriber count, view count and video count; video IDs, titles, descriptions, thumbnails, publish dates, duration, privacy status, view and comment counts; captions or transcripts; audience retention curves; watch time, average view duration, average view percentage, likes, comments, shares, impressions, click-through rate, traffic-source data and subscriber gains or losses where the YouTube APIs return them.
• Uploaded creator content. If you use upload-based features, we collect source video files, filenames, MIME types, file sizes, measured duration, upload and validation status, generated proxy files, extracted clips, frames and audio, and thumbnails you upload for video plans.
• Drafts and inputs. We store data you enter into the product, including video URLs, video-plan titles, packaging test choices, thumbnail slots, checklist items, saved tips, feedback, ratings, cancellation reasons and support context you choose to provide.
• Analysis output and derived data. We store reports, scores, recommendations, classifications, taxonomies, retention windows, scene cues, OCR text, audio observations, pacing analysis, packaging analysis, script analysis, comparison reports, channel trends, video-plan reports, processing jobs and progress states.
• Billing and usage data. We store plan, entitlement, subscription, usage-counter, credit-consumption, invoice summary, customer, payment-method summary and billing status data. Stripe handles full payment-card details; they do not pass through our servers.
• Administrative and technical data. We store service notifications, admin support records, prompt-version history, model and processing cost logs, daily activity counters, cookies used to keep you signed in or remember interface preferences, and standard hosting, database, security and error logs.

• To create your account, keep you signed in and secure it.
• To connect to your YouTube channel and fetch the video, caption and analytics data needed for the analyses you request.
• To analyse published videos, identify drop-offs, holds and gains, and generate hook, pacing, packaging, script and retention recommendations.
• To run deep-analysis features over uploaded source files, including extracting media, transcribing audio, reading on-screen text and linking observations to retention windows.
• To build your private cross-video library, channel trends, saved tips, checklists, video comparisons and pre-publication video plans.
• To validate uploads, enforce file-size and plan limits, meter credits, process subscriptions, show invoices and handle plan changes, cancellations, refunds or grants.
• To send service notifications, recover failed or abandoned processing jobs, provide support, debug faults, prevent misuse, secure the service, measure processing cost and improve the product.

We do not sell your personal data or creator content. We do not use it for advertising or cross-site tracking. We do not use your content to train our own general-purpose AI models, and we do not permit our AI providers to train their general-purpose models on it.

Where UK or EU data protection law applies, we rely on: performance of our contract with you to provide the service, manage your account, process uploads and handle billing; consent for Google and YouTube API access granted through Google’s permission screens; legitimate interests for security, support, fault diagnosis, abuse prevention, cost monitoring and product improvement; and legal obligation for tax, accounting and compliance records.

Viewlio uses YouTube API Services. By using YouTube-connected features, you also agree to the YouTube Terms of Service. Google’s handling of your data is described in the Google Privacy Policy.

We request YouTube read, YouTube Analytics read and caption access only so Viewlio can read data from channels and videos you own or are authorised to manage. We do not post, edit or delete anything on YouTube, and we do not access other users’ channels through your account.

Our use and transfer of Google user data is limited to providing and improving user-facing Viewlio features, maintaining security, troubleshooting, complying with law, and other purposes permitted by the Google API Services User Data Policy.

You can revoke Viewlio’s Google and YouTube access at any time from Google security settings. Revocation stops future API access but does not automatically delete data already stored in Viewlio. To delete stored data, use the deletion controls available in the app or contact us.

Viewlio produces reports by sending relevant material to third-party AI and media-processing providers. Depending on the feature, that material can include video metadata, YouTube analytics, transcripts, uploaded footage, thumbnails, extracted frames, extracted audio, OCR text, scene data and previous analysis from your private library. We send only what the requested feature needs.

Uploaded source files may be stored in private object storage, transcoded into smaller proxy files, processed with ffmpeg-style media extraction, OCR and transcription, and analysed by AI models. Temporary signed URLs may be created so our processors can read or write the relevant files for a limited time.

We share data with service providers that operate Viewlio on our behalf:

• Google / YouTube, for sign-in and the YouTube Data, Analytics and caption APIs.
• Supabase, for authentication, database services and storage.
• S3-compatible object storage, when configured for upload storage, multipart uploads and private signed-file access.
• Vercel, for application hosting, serverless execution, scheduled jobs and deployment logs.
• OpenAI, for AI analysis, transcription and report-generation features.
• Qencode, for optional source-video transcoding and proxy generation.
• Stripe, for checkout, subscriptions, invoices, billing portal access and payment-method handling.

We may also disclose data where required by law, to protect rights and security, to investigate abuse, or as part of a merger, acquisition, financing, reorganisation or sale of the business, subject to this policy or a policy that provides materially similar protection.

Viewlio and its providers may process data outside the UK or EEA, including in the United States. Where required, we rely on appropriate transfer safeguards such as standard contractual clauses or provider commitments that support lawful international transfers.

We keep account data while your account exists. We keep YouTube API data, analyses, uploaded files, thumbnails, proxy files, extracted media, derived reports, saved tips, comparisons, channel trends and video plans while they are needed to provide the service to you, until you delete the relevant item where deletion is available, close your account, or ask us to delete them.

Some records are kept longer where necessary for legitimate business or legal reasons, including invoices, tax and accounting records, fraud-prevention records, security logs, backup copies that expire on their normal cycle, and minimal records needed to honour deletion, refund, chargeback or legal requests.

You can revoke Google access from Google security settings, reconnect your channel, manage billing in settings, delete video-plan drafts and saved checklist items where the app provides controls, and contact us to close your account or request deletion of stored data.

Subject to local law, you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or receive it in a portable format. Email maxwinterleinweber@gmail.com. If you are in the UK, you can complain to the Information Commissioner’s Office. If you are in the EEA, you can complain to your local supervisory authority.

We use technical and organisational safeguards designed to protect your data, including encrypted transport, server-side token handling, private storage buckets, short-lived signed URLs, scoped object paths, row-level security, service-role access limited to server routes and admin workflows, and upload validation. No online service is perfectly secure, but we treat security as an active product requirement and adjust controls as Viewlio changes.

We use cookies and local browser storage to keep you signed in, complete OAuth flows, remember interface preferences such as theme and sidebar state, and maintain ordinary security and session controls. We do not use advertising or cross-site tracking cookies.

Viewlio is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will take appropriate steps to delete it.

We may update this policy as the product, providers or legal requirements change. The date at the top shows the current version, and material changes will be notified in the app, by email or through another reasonable method.