Privacy Policy
Last updated: 2026-06-05
This Privacy Policy explains how ChannelForge (“we”, “us”) collects, uses, and protects personal data when you use our platform (the “Service”). It is designed to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and other applicable privacy laws.
1. Data Controller
The data controller is ChannelForge, contactable at privacy@channelforge.com.
2. What Data We Collect
- Account data: email address, hashed password, account creation date, experience level.
- Billing data: processed by Stripe; we store only customer/subscription identifiers, plan code, billing status, and period dates. We never see or store your full card details.
- Channel DNA & configuration: niche, language, style, brand voice, editorial rules you set up.
- Run data: script, generated assets, render output, packaging metadata associated with each Run.
- YouTube metrics: if you connect your channel, we ingest aggregated metrics (views, watch time, retention, CTR, likes, comments, subscribes from video, traffic sources). We never read private user-level data from your YouTube audience.
- Operational logs: request timestamps, IP address, user agent, error traces, used only for security, abuse prevention, and debugging.
3. Purposes & Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service and account features | Art. 6(1)(b) — contract |
| Process payments and manage subscriptions | Art. 6(1)(b) — contract |
| Compute aggregated, anonymized algorithm patterns | Art. 6(1)(f) — legitimate interest in improving the Service |
| Comply with legal and tax obligations | Art. 6(1)(c) — legal obligation |
| Prevent abuse, fraud, and security incidents | Art. 6(1)(f) — legitimate interest |
| Send service emails (transactional) | Art. 6(1)(b) — contract |
| Send marketing emails (if any) | Art. 6(1)(a) — consent (opt-in, revocable) |
4. Sub-processors
We share the minimum necessary data with the following processors:
- Supabase — database, auth (hosted in EU regions where available).
- Stripe — payments (PCI-DSS compliant).
- Vercel — web hosting and edge delivery.
- Anthropic — AI inference for script and algorithm-analysis tasks (no training on your data).
- ElevenLabs / Replicate — voice synthesis and visual rendering inference.
- Google (YouTube Data API) — only when you connect your channel.
Cross-border transfers outside the EEA are covered by Standard Contractual Clauses approved by the European Commission.
5. Retention
- Account data: until you delete your account, then 30 days for residual cleanup.
- Run data and channel DNA: same as account, plus up to 90 days backup retention.
- Billing records: 10 years (mandatory by Italian tax law).
- Operational logs: 90 days max.
- Aggregated, anonymized algorithm patterns: indefinitely (cannot identify you).
6. Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15).
- Request rectification of inaccurate data (Art. 16).
- Request erasure / be forgotten (Art. 17).
- Request restriction of processing (Art. 18).
- Receive your data in a portable format (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time without affecting prior lawful processing (Art. 7).
- Lodge a complaint with the supervisory authority (in Italy: Garante per la protezione dei dati personali).
To exercise any right, email privacy@channelforge.com. We respond within 30 days.
7. Security
We apply encryption in transit (TLS 1.3), encryption at rest where the underlying provider supports it, Row Level Security on the database, idempotent webhook handling, principle of least privilege for service credentials, and audit logging of subscription events. No system is perfectly secure; if we detect a breach affecting your data, we will notify you within 72 hours where required by Art. 34 GDPR.
8. Cookies
We use only technically necessary cookies for authentication and session management. We do not use third-party advertising or tracking cookies. If we add analytics in the future, we will request consent under the ePrivacy Directive.
9. Children
The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If we discover such data, we will delete it.
10. Changes
We may update this Policy. Material changes will be communicated through the Service or by email at least 14 days before they take effect.
11. Contact
Email: privacy@channelforge.com.