Privacy Policy

1. Controller

The controller responsible for processing personal data is:

Reconnector Consulting Services LLC
750 E Cowboy Way, Suite 3
LaBelle, FL 33935, USA
Represented by: Dirk C.E. Luedtke
Privacy contact: tubemakers.c1@gmail.com

The controller is established in the USA and also addresses users in the European Union. Requests from data subjects and supervisory authorities in the EU are answered directly via the privacy contact address above.

2. This website

When you visit tubemakers.net, our server processes the technically necessary connection data (IP address, time, requested page, browser type). This data is used solely to deliver the page, for security and for troubleshooting, and is deleted after a short period. The website sets no cookies, embeds no external fonts, videos or analytics tools and transmits no data to advertising networks.

3. Use of YouTube API Services

TubeMakers uses YouTube API Services, in particular the YouTube Data API, the YouTube Analytics API and the YouTube Reporting API. TubeMakers is bound by the YouTube API Services Terms of Service and the YouTube Developer Policies. By using the YouTube features you also agree to the YouTube Terms of Service; the Google Privacy Policy applies in addition:

• YouTube Terms of Service
• Google Privacy Policy
• Google security settings – manage granted access

TubeMakers’ use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Which data is processed

Account and sign-in data: your e-mail address and display name; your password stored only as a cryptographic hash, never in plain text; when you use “Sign in with Google”, the stable Google account identifier (we never link accounts by e-mail address alone); the workspace you belong to and your role in it; your language setting; the time your account was created and the time you last signed in; your sign-in sessions, for which we store the session identifier as a hash together with your IP address, your browser identification (user agent), the time of creation and the time of last use – a session expires 30 days after it was last used; invitations issued to you, comprising the invited e-mail address, the intended role and workspace, the invitation key as a hash and an expiry date; and sign-in attempts, recorded with the time, the e-mail address entered, the IP address and whether the attempt succeeded – including attempts for addresses that have no account. We use this data to create and operate your account, to identify you when you sign in, to keep your workspace separate from other customers’, and to protect the service against abuse. The IP address and browser identification recorded with a session are stored so that security-relevant events remain traceable; they are not evaluated during use. The record of sign-in attempts is used to block an e-mail address or IP address after repeated failures. We do not use it for advertising, profiling or any purpose not described here.

Public data: channel and video IDs, channel name, video title, description, tags, thumbnail URL, publication time, duration and publicly visible statistics such as views, likes, comment count and subscriber count.

Authorised data after Google consent: data of your own YouTube channel, in particular traffic sources, audience retention, impressions and click-through rates, views, subscriber gains, country and time series and further performance data provided by the YouTube Analytics/Reporting APIs.

Connection data: consent status of the Google connection, encrypted access tokens, connected channel, time of connection and technical check/error data. TubeMakers never requests or stores your YouTube or Google password.

Google Cloud and speech data: If you choose Google Cloud Text-to-Speech as your speech provider, TubeMakers stores the identifiers of the Google Cloud project and billing account you select, the names of the configured Workload Identity resources, the technical service-account address, setup status, and your voice and speaking-rate choices. Payment and credit-card data is entered only at Google and is neither retrieved nor stored by TubeMakers. For speech synthesis, the narration text you approve and the selected voice settings are sent to Google Cloud Text-to-Speech in your project; the generated audio is returned to TubeMakers.

TubeMakers analyses: From API data TubeMakers calculates its own metrics, ratios, trends, categories and recommendations. In the application these are clearly labelled as TubeMakers analysis and not as metrics provided by YouTube. TubeMakers does not infer sensitive attributes of viewers or creators (such as health, age, origin, religion, political opinion or sexual orientation).

5. Purposes

We process the data to

• enable the user to research public channels and videos and manage their selected references;
• display the authorising channel owner’s own statistics and performance data;
• generate TubeMakers analyses and visible product recommendations;
• run imports, refreshes, quota management, security, troubleshooting and data deletion;
• at your explicit request, configure your own Google Cloud project for Text-to-Speech and turn approved narration text into audio there.

The data is not used for any other purpose not described here. Google user data is not sold and not used for advertising.

6. Google connection and permissions

Google sign-in, the YouTube connection and Google Cloud setup are three separate, voluntary steps. TubeMakers requests only the permissions required for the respective feature already shown to you.

For YouTube read and analytics features these are the scopes youtube.readonly (read channel and video information) and yt-analytics.readonly (read your own channel’s statistics). TubeMakers does not request write permissions for your YouTube channel: it does not upload videos, does not publish anything and does not change the visibility, playlists or metadata of your channel. You upload and publish yourself directly on YouTube.

Only if you choose Google Cloud Text-to-Speech and start setup yourself does a separate consent screen request the one-time scope https://www.googleapis.com/auth/cloud-platform. This scope technically permits access to Google Cloud resources. TubeMakers uses it solely for the project you specify: create or inspect the project, link the billing account you select, enable the Text-to-Speech API, and configure a narrowly limited Workload Identity connection and its service account. The access is short-lived, discarded after setup and never retained through a refresh token. It is neither Google sign-in nor the YouTube connection.

7. Legal basis

For users in the European Union and the European Economic Area the General Data Protection Regulation (GDPR) applies under Art. 3(2) GDPR, even though the controller is established in the USA. Processing is based on:

• Performance of a contract (Art. 6(1)(b) GDPR) for account, workspace, research, analyses, planning and support – i.e. all features you have ordered from us;
• Consent (Art. 6(1)(a) GDPR) for the voluntary connection of your YouTube channel and the voluntary setup of your Google Cloud project; you give each consent on a separate Google consent screen and may withdraw it at any time with effect for the future;
• Legitimate interests (Art. 6(1)(f) GDPR) in security, abuse prevention, error logging and operational stability; our interest is to run the application reliably and securely;
• Legal obligations (Art. 6(1)(c) GDPR), such as commercial and tax retention of invoicing data.

Transfers to third countries: The application runs on servers in Germany. Where data is transferred to the USA – through access by the controller itself or through the US service providers listed in section 8 – we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR). For users outside the EU the data protection laws of their country apply as applicable.

8. Recipients and processors

Data is transferred only to service providers required to operate the described features. They process data on our behalf and according to our instructions; data processing agreements or the providers’ API data protection terms apply.

What is not sent to AI providers: account data, access tokens and the Google-authorised analytics of your own channel are not transferred to providers of text, image or speech models. Narration text is sent only to the speech provider you select when you explicitly generate a sample or audio track. Public video information and your drafts are transferred solely for the visible features you use in TubeMakers; under their terms, the named providers do not use API data to train their general models.

Authorised YouTube data is shared only for the visible TubeMakers feature requested by the user and within the scope of their consent. Google or YouTube user data is never sold. TubeMakers does not allow third parties to serve content or advertising in the application. Authorities receive data only where we are legally obliged.

9. Tenant isolation

Authorised data is stored separately per channel owner and workspace. Access is granted only to the authorising user and team members they explicitly approve. Data of different channel owners is not combined into a shared private analysis.

10. Retention and refresh

Public and other non-authorised YouTube API data is refreshed or deleted no later than 30 calendar days after retrieval. Other authorised metadata is likewise refreshed or deleted within 30 days. Authorised statistics and performance data is stored only as long as required for the consent granted and the product feature; authorisation and the continued existence of the content are re-verified at least every 30 days.

Where YouTube expressly approves TubeMakers under the additional policies for derived metrics and extended statistics retention, approved statistics and TubeMakers analyses are retained for no more than 36 calendar months. Titles, channel names, descriptions and comment text are excluded from this extension and remain subject to the 30-day rule.

The short-lived access used for Google Cloud setup is not stored. Non-secret project, billing and Workload Identity identifiers and the voice selection remain as account settings while the service relationship is active. After revocation, these details may be used only for a repair you explicitly start; new and already prepared speech calls remain blocked. Following a deletion request or termination, the details are deleted within the period for account and workspace data.

Operational periods:

• Account data (name, e-mail, workspaces, settings): for the duration of the usage relationship and up to 30 days after account deletion or end of contract.
• Invoicing and contract data: for the statutory retention periods (generally up to ten years).
• Web server access logs (IP address, time, requested address): at most 35 days.
• Application and security logs: rolling, generally a few weeks, at most 90 days.
• Backups: rolling (7 daily, 4 weekly, 6 monthly), hence overwritten no later than six months. Backups are used only for recovery after an outage; after a recovery, deletions performed in the meantime are re-applied.
• Support requests by e-mail: up to twelve months after the case is closed.

11. Revocation, disconnection and deletion

You can disconnect the YouTube connection in TubeMakers at any time and request deletion of your stored data. TubeMakers then revokes the access token with Google and deletes the authorised data stored on the basis of this consent as soon as possible and within seven calendar days. The same applies when your TubeMakers account is deleted.

You can additionally revoke access in your Google security settings. TubeMakers regularly verifies granted permissions and deletes data when authorisation can no longer be confirmed.

You can disconnect Google TTS in TubeMakers setup by choosing Revoke connection. This immediately blocks new speech calls and retries. TubeMakers retains no long-lived Cloud setup credential. The Google Cloud project, billing account and resources remain under your control; you can also remove the Workload Identity connection, service account or entire project in Google Cloud. A deletion request removes the related project, connection and voice details held by TubeMakers under the periods for account and workspace data.

Deletion in TubeMakers does not delete or modify data on YouTube or resources in your Google Cloud project. You must delete that content or those resources in the relevant Google service.

Deletion requests: via the page Delete your data or by e-mail to tubemakers.c1@gmail.com.

12. Security

TubeMakers applies appropriate technical and organisational measures, including encrypted transport (HTTPS), encrypted storage of access tokens, server-side-only token handling, tenant and role checks, access restrictions, logging of security-relevant events, regular backups and restore and deletion tests.

13. Cookies and local storage

The website tubemakers.net sets no cookies and stores nothing on your device. The application at https://app.tubemakers.net uses strictly necessary session cookies for sign-in only; these do not require consent. No analytics, tracking or advertising cookies are used.

14. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time with effect for the future. You may also lodge a complaint with the data protection supervisory authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The members of the European Data Protection Board are listed at edpb.europa.eu.

For all requests contact tubemakers.c1@gmail.com.

15. Obligation to provide data, automated decisions

Providing account data is required to conclude the usage contract; without it no account can be created. Connecting a YouTube channel and configuring a Google Cloud project are voluntary. Without the YouTube connection your own channel analytics is unavailable; without an approved speech provider TubeMakers cannot generate an audio track.

TubeMakers makes no automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. TubeMakers analyses are recommendations whose implementation is decided by you alone. No profiling of natural persons takes place.

No data protection officer has been designated, as the statutory requirements for a mandatory designation are not met; please direct privacy requests to the address given in section 1.

16. Changes

This Privacy Policy is updated when features, data processing, recipients or legal requirements change. Before any new use of YouTube or Google data not covered by the existing consent, we inform you in advance and obtain new consent where required.