Privacy Policy

2. Scope, Definitions, and Processing Principles

This Policy applies to all visitors, users, and correspondents of the Services, irrespective of jurisdiction. “Personal Data” means any information relating to an identified or identifiable natural person as defined under Article 4(1) GDPR. “Processing” means any operation performed on Personal Data, including collection, storage, transmission, and erasure. We process Personal Data strictly in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. The Services are intentionally engineered to operate without user accounts, behavioural profiling, or persistent identifiers, and we do not knowingly infer sensitive characteristics about any individual.

3. Categories of Data We Collect

We collect only the minimum information necessary to operate, secure, and improve the Services:

• Information you voluntarily provide. Channel URLs, video links, search queries, and calculator inputs you enter for analysis. These inputs are transmitted to our server-side proxy solely to retrieve public YouTube metadata and to compute the requested result. They are processed in volatile memory, are not associated with your identity, and are not retained beyond the time required to fulfil the request, except in aggregated, anonymised form for capacity planning.
• Correspondence data. When you contact us by email or through the contact page, we process your email address, the contents of your message, and any attachments strictly for the purpose of responding to and resolving your inquiry, in accordance with Article 6(1)(b) and 6(1)(f) GDPR.
• Technical and security data. IP address, user-agent string, request timestamps, and coarse diagnostic logs required for load balancing, rate limiting, prevention of abuse, and network security. This data is pseudonymised wherever technically feasible.
• Locally stored preferences. Your interface theme selection (light/dark) is stored exclusively in your browser’s localStorage on your own device and is never transmitted to or stored on our servers.

We do not operate user registration, do not issue persistent user identifiers, do not conduct cross-site tracking, and do not create marketing profiles.

4. Purposes and Legal Bases for Processing

Each processing activity is grounded in a lawful basis under Article 6 GDPR: (a) Performance of a contract / pre-contractual measures — executing your analysis requests and responding to correspondence; (b) Legitimate interests — ensuring the security, integrity, availability, and proper functioning of the Services, preventing fraud and abuse, and defending legal claims, balanced against your fundamental rights; (c) Consent — storing non-essential cookies and serving personalised advertising where required by law, obtained via consent mechanisms and revocable at any time; and (d) Legal obligation — compliance with tax, accounting, and law-enforcement obligations where applicable. Where we rely on legitimate interests, you retain an absolute right to object as described in Section 11.

5. Cookies and Similar Technologies

We employ a strictly limited set of cookies and comparable storage technologies. Strictly necessary cookies for security, load distribution, and rate enforcement are indispensable for the operation of the Services and cannot be disabled without impairing functionality. Functional storage is limited to the theme preference held locally in your browser. No first-party analytics fingerprinting is conducted. You may control or delete cookies at any time through your browser settings; however, blocking strictly necessary technologies may degrade performance. Where the law of your jurisdiction requires prior consent (including the EEA and the United Kingdom), non-essential storage technologies are activated only after affirmative, freely given, specific, and informed consent, which may be withdrawn with equivalent ease at any time.

6. Advertising and Measurement

To keep the Services free without subscription fees, we currently do not display any third-party advertising on the site and do not use advertising cookies. If that ever changes, we will update this Policy and request consent where required by law before any non-essential advertising storage is activated. We do not sell personal data and receive only aggregated, non-identifying reports from infrastructure providers.

7. Third-Party Services and Disclosure of Data

8. Data Retention and Minimisation

Consistent with the principle of storage limitation, we retain Personal Data only for as long as strictly necessary to fulfil the purposes set forth herein. Transient analysis inputs are discarded immediately after the response is generated. Correspondence is retained only for the period required to resolve the matter and to demonstrate compliance, and is thereafter securely deleted or anonymised. Security logs are retained for a short, rolling period (generally not exceeding 90 days) unless extended retention is necessary to investigate an active incident. Aggregated statistical information from which no individual can be identified may be retained indefinitely.

9. Data Security and Confidentiality

We implement appropriate technical and organisational measures, including encrypted transport (TLS), hardened hosting configurations, least-privilege access controls, systematic software maintenance, and continuous monitoring for anomalous activity. All personnel with potential access to Personal Data are bound by strict confidentiality obligations. While no method of transmission or storage is entirely infallible, we regularly review and enhance our safeguards. In the event of a personal data breach presenting a risk to your rights, we shall notify the competent supervisory authority without undue delay and, where required, inform affected individuals in accordance with Articles 33 and 34 GDPR.

10. International Data Transfers

The Services are accessible globally, and technical data may be processed on infrastructure located outside your country of residence, including jurisdictions not deemed adequate by the European Commission. Where such transfers occur, we ensure an appropriate safeguard within the meaning of Chapter V GDPR, including Standard Contractual Clauses, supplementary technical measures such as encryption, and rigorous vendor assessment. By using the Services, you understand that your information may be transferred as described in this Section and processed in accordance with this Policy.

11. Your Rights: GDPR, CCPA/CPRA, and Other Jurisdictions

Depending on your place of residence, you enjoy some or all of the following rights: access to and a copy of your Personal Data; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interests, including a right to opt out of any “sale” or “sharing” (we engage in neither); withdrawal of consent at any time without affecting prior lawful processing; and the right not to be subjected to automated decision-making with legal or similarly significant effects (we conduct no such decision-making). California residents may additionally exercise rights to know, delete, correct, limit the use of sensitive personal information, and non-discrimination for exercising privacy rights, including through an authorised agent with proper authorisation. Because our holdings are deliberately minimal, many requests will lawfully result in confirmation that we hold no Personal Data relating to you, which we shall certify in writing.

To exercise any right, to lodge a privacy inquiry, or to report a concern, please contact our data protection contact point at support@creatorkit.xyz or through the contact page (topic: Privacy). We verify identity to a degree proportionate to the sensitivity of the request, and we respond substantively within one month, extendable in complex cases as permitted by law, and within the time limits prescribed by the CCPA/CPRA. You further retain the right to lodge a complaint with your competent supervisory authority (for example, your national Data Protection Authority in the EU/EEA or the UK Information Commissioner’s Office).

12. Children’s Privacy, Policy Changes, and Contact

The Services are general-audience tools and are not directed to children under the age of 13 (or the higher minimum age prescribed by local law, including 16 in certain EU Member States). We do not knowingly collect Personal Data from children; should we learn that such data has been inadvertently provided, we shall delete it expeditiously upon notice to support@creatorkit.xyz. We may amend this Policy to reflect legal, technical, or operational developments. Material amendments shall be announced by revising the “Last updated” date above and, for significant changes, by displaying a conspicuous notice on the homepage for a minimum of fourteen (14) days prior to effectiveness. Continued use of the Services following the effective date constitutes acceptance of the revised Policy. For all privacy matters, our exclusive contact address is support@creatorkit.xyz.