HIVEMIND YT Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how HIVEMIND YT LLC, a California limited liability company (referred to here as HIVEMIND YT LLC, we, us, or our), collects, uses, stores, shares, and protects personal information in connection with HIVEMIND YT, a YouTube creator-growth software-as-a-service product available at hivemind.yt (the Service). HIVEMIND YT helps YouTube creators with analytics (Pulse Analytics), short-form clip creation and publishing (Create Clips), video intelligence and knowledge bases, community portals, and related features.

HIVEMIND YT is currently offered in a private beta through an invite access code. Paid subscription plans exist within the product, but during the beta period access is provided free of charge. Plans, prices, and features are not final and are subject to change at any time. This Privacy Policy applies regardless of whether you access the Service during the free beta period or on a paid plan.

By creating an account, connecting your accounts, or otherwise using the Service, you acknowledge the practices described in this Privacy Policy. Where the Service connects to YouTube and other Google services, you must agree to this Privacy Policy before you can access the YouTube-connected features and functionality of the Service.

This Privacy Policy is incorporated into and supplements our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service. We may provide additional or just-in-time privacy notices at the point where particular information is collected; those notices supplement, and do not replace, this Privacy Policy.

2. Information We Collect

We collect the following categories of information, depending on the features you use:

Google account profile information (Google Sign-In / OAuth). When you sign in with Google, we receive your basic Google profile information, which includes your email address, display name, and profile photo. We use this to create and secure your account and to identify you within the Service.

YouTube account data and authorization tokens (YouTube Data API v3). When you connect your YouTube channel, you authorize the Service through Google OAuth, and we store the resulting authorization tokens (including refresh tokens) so the Service can act on your behalf for the features you enable. We request only the scopes that are critical to features you can see and use in the product. The scopes and what each enables are:

youtube.readonly: read access to your YouTube account and channel data and content, such as your channels, videos, video metadata, playlists, and similar resources, used to power Pulse Analytics dashboards, your video library, and Knowledge Base / Video Intelligence features for channels and playlists you own or are authorized to manage.

yt-analytics.readonly: read access to your YouTube Analytics reports, used to display channel and video performance intelligence in Pulse Analytics.

youtube.upload: the ability to upload videos and associated metadata that you submit through the Service, used by Create Clips and related publishing features when you choose to publish a video to your own YouTube channel.

youtube.force-ssl: the ability to perform account-management and content actions on your YouTube account on your behalf over secured connections (for example, managing or updating resources you direct us to act on), used to carry out the actions you initiate within the Service.

Captions for your own channel. The Service downloads captions only for content on your own channel, which you authorize. We do not use captions to access or process content you do not own.

Ingested video metadata and captions for owned channels (Knowledge Base / Video Intelligence). When you ingest videos from channels, playlists, or documents you own or are authorized to manage, we process the associated video metadata, captions, and document content through official Google and YouTube APIs in order to generate AI analysis, sponsor insights, and related outputs. This path uses only official Google/YouTube APIs. It does not use scrapers and does not perform stream-ripping.

AI-generated analysis and outputs. We store the analysis, summaries, insights, generated clips, and other outputs that the Service produces from your inputs and connected data so you can view, reuse, and manage them. AI-generated content is produced algorithmically and is described further in the section on automated processing.

Payment information (via Stripe). When you purchase a paid subscription, payments are processed by Stripe. We do not store full payment card numbers; Stripe stores and processes cardholder data. We receive and store limited billing-related information such as your subscription status and plan, Stripe customer and payment-method tokens, and transaction records (amounts are handled in integer minor units). If you participate in our affiliate program, commissions are paid through Stripe Connect, and we process the associated payout and account-status information.

Bring-your-own-key (BYOK) credentials. You may choose to supply your own third-party AI or YouTube API keys. Depending on the storage mode you select, your keys may be stored for the session only, on your device, or in your account. You are responsible for your own keys, including any usage, costs, and compliance obligations associated with them. We use your keys only to provide the features you direct.

Content you create, submit, or connect. This includes clips and projects you build, community portal content and chat messages, documents you upload, publishing and scheduling instructions, and configuration and preferences within the Service.

Usage, device, and analytics information (analytics beacons). We collect technical and usage information through analytics beacons and similar technologies, such as log data, device and browser information, IP address, pages and features used, and interaction events. We use this to operate, secure, measure, and improve the Service. We do not use information received from Google APIs to serve advertising. Cookies and similar tracking technologies are described in our separate Cookies and Tracking disclosure.

Communications and support information. When you contact us at contact@hivemind.yt or otherwise communicate with us, we collect the content of those communications and related metadata.

3. How We Use Information

We use the categories of information above for the following business and commercial purposes:

To provide, operate, and maintain the Service, including creating and authenticating your account, connecting your YouTube and other accounts, and delivering Pulse Analytics, Create Clips, Knowledge Bases / Video Intelligence, Community Portals, and related features.

To carry out the actions you direct on your behalf, including reading your YouTube and analytics data, ingesting and analyzing content for channels and playlists you own or are authorized to manage, generating clips and analysis, and (where you choose) uploading or publishing content to your own YouTube channel and to connected social platforms.

To generate AI analysis and outputs using Google Gemini and Vertex AI and, where applicable, your own BYOK credentials.

To process payments, manage subscriptions and the affiliate program, and maintain billing, ledger, tax, and audit records.

To secure the Service, prevent fraud and abuse, enforce our Terms and policies, and maintain the integrity and reliability of the platform.

To measure, analyze, and improve the Service and to develop user-facing features that are prominent in the Service.

To communicate with you about your account, transactions, security, changes to the Service, and support requests.

To comply with legal obligations and to establish, exercise, or defend legal claims.

Limited use of Google user data. We use data obtained through the YouTube and Google API scopes only to provide or improve user-facing features that are prominent in the Service. We do not use Google user data for any purpose unrelated to those features, and our use of Google user data is further limited as described in the Google API Services User Data Policy section below.

4. Legal Bases for Processing (GDPR / UK GDPR)

Where we process personal data subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR, we rely on one or more of the following legal bases under Article 6:

Performance of a contract (Article 6(1)(b)): to provide the Service you request, including authenticating your account, connecting your accounts, carrying out the actions you direct, and processing your subscription.

Consent (Article 6(1)(a)): where you give consent that is freely given, specific, informed, and unambiguous, for example when you connect your YouTube or other accounts, supply BYOK credentials, ingest content, or direct publishing to a connected platform. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; you can withdraw by disconnecting the relevant account, deleting the relevant data, or revoking access as described below.

Legitimate interests (Article 6(1)(f)): to secure the Service, prevent fraud and abuse, measure and improve features, and operate our business, where those interests are not overridden by your interests or fundamental rights. We carry out a balancing assessment where we rely on this basis and will provide further information on request.

Compliance with a legal obligation (Article 6(1)(c)): to retain certain financial, tax, and audit records and to respond to lawful requests.

Where we process special categories of data, we will do so only with your explicit consent or on another lawful basis permitted under Article 9.

5. How We Share Information (Service Providers and Processors)

We do not sell your personal information for money, and we do not transfer or sell Google user data to third parties such as advertising platforms, data brokers, or information resellers. We share information only as described here:

Service providers and processors. We share information with vendors that process information on our behalf under contract and only for the purposes we direct, including: Google (including Google Gemini and Vertex AI) for AI processing of your inputs and connected data; Firebase and Google Cloud for hosting, authentication, storage, and infrastructure, including the server-side render worker used for optional clip rendering; Stripe for payment processing and Stripe Connect for affiliate payouts; and Firecrawl for certain web-retrieval functions. We maintain a list of our principal sub-processors and will make current sub-processor information available on request.

Social publishing platforms at your direction. When you choose to publish or schedule content to a connected platform, we transmit the content and related metadata to that platform only on your behalf and at your direction. Supported destinations include Meta (Facebook, Instagram, and Threads), TikTok, X (formerly Twitter), and LinkedIn. Your use of each platform is governed by that platform's own terms and privacy policy, directly between you and that platform.

Legal, safety, and compliance. We may disclose information where required by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect rights, safety, or property, to enforce our Terms, or to prevent fraud or abuse.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy or a successor policy.

With your direction or consent. We may share information for other purposes that you direct or to which you consent.

We do not use Google user data, including YouTube data obtained through the granted scopes, for serving advertising, including retargeting, personalized, or interest-based advertising.

6. Google API Services User Data Policy and Limited Use

HIVEMIND YT's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Consistent with the Limited Use requirements, we confirm that, for all of the YouTube scopes we request (youtube.readonly, yt-analytics.readonly, youtube.upload, and youtube.force-ssl):

We limit our use of data obtained through these scopes to providing or improving user-facing features that are prominent in the HIVEMIND YT interface, and we only request scopes that are critical to those features.

We do not transfer or sell Google user data to third parties such as advertising platforms, data brokers, or information resellers.

We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.

We do not allow humans to read Google user data unless we first obtain your affirmative agreement to view specific messages or data, doing so is necessary for security purposes (such as investigating abuse), doing so is necessary to comply with applicable law, or the data (including derived aggregations) has been aggregated and anonymized and is used for internal operations in accordance with applicable requirements.

We keep this Privacy Policy accessible from within the application and from the OAuth consent surface, and we publish the policy URL as required once the application is publicly available.

7. YouTube Data Handling, Refresh and Deletion, and Revoking Access

The Service uses YouTube API Services. By using the YouTube-connected features of the Service, you are also subject to the YouTube Terms of Service, and Google's Privacy Policy applies to personal information processed in connection with the YouTube API Services.

Google Privacy Policy. You can review the Google Privacy Policy at http://www.google.com/policies/privacy.

Categories of YouTube data we handle. As described above, through the granted scopes we access and may store: your YouTube account and channel data and content (youtube.readonly); your YouTube Analytics reports (yt-analytics.readonly); video uploads and the metadata you submit (youtube.upload); and the account-management and content actions you direct us to perform on your behalf (youtube.force-ssl), as well as captions for your own channel that you authorize. We store related authorization tokens to enable these features.

Refresh-or-delete within 30 days. We store YouTube-authorized data only as long as necessary for the specific consent you grant as an active user, and in any event for no longer than 30 calendar days, after which we delete or refresh the stored data. An automated process enforces this 30-day refresh-or-delete practice. In addition, if you request deletion, or if we cannot verify your continued authorization, we delete the relevant stored YouTube-authorized data within 30 days.

Revoking access. In addition to our normal procedure for deleting stored data, you can revoke the Service's access to your Google and YouTube data at any time through the Google security settings page at https://security.google.com/settings/security/permissions. You can also disconnect your YouTube account from within the Service. After you revoke access, we will delete the associated stored YouTube-authorized data within 30 days, except for any records we are permitted or required to retain as described in the Data Retention section.

To request deletion of YouTube data we have stored, you may use the in-product controls or contact us at contact@hivemind.yt.

Team sharing of connected-YouTube data. If you connect a YouTube channel and you are the owner of a HIVEMIND YT Team, you may grant a named teammate specific capabilities that use your connection inside HIVEMIND YT: browsing your channel's uploads, building and updating Knowledge Bases from your videos, creating clips from your videos, and reading your channel analytics. You choose each capability for each teammate and confirm the grant in the product; nothing is shared by default. Your teammate never receives your Google credentials or tokens: every action runs on our servers under your own authorization, is recorded in your Team activity list with the teammate's identity, and stops the moment you revoke the grant, remove the teammate, or disconnect your channel. Teammates cannot publish or change the visibility of your videos, cannot connect or disconnect your channel, cannot delete your Knowledge Bases or videos, and cannot change billing. This sharing is one of the user-facing features described in Section 6 and is governed by the Limited Use requirements there.

8. Data Retention and Pseudonymization

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, to provide the Service, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Retention periods vary by data category and purpose.

YouTube-authorized data is retained subject to the 30-day refresh-or-delete and deletion-on-request practices described in the section above.

When you request erasure or close your account, we delete or de-identify the user-facing personal information associated with your account. However, certain money, ledger, tax, and audit records must be retained to comply with legal, accounting, and audit obligations and to establish, exercise, or defend legal claims. For these records, rather than deleting them, we pseudonymize them: user-facing identifying fields are erased, while the financial and audit records are retained in a pseudonymized form for the period required by law. This means that complete erasure of financial and audit records may not be possible, and we will retain only what is necessary for these legal-retention purposes.

Registration and trial-code records. When you create an account using an invitation or registration code, or redeem a trial code, we record that fact against your account: an irreversible hash of the code used and the time it was used. Those records are what enforce the rule that a code may be redeemed at most once per account, so they are retained for the life of the account and cannot be deleted on their own through the in-product deletion controls; they are deleted when the account itself is deleted.

When personal information is no longer required and no legal-retention obligation applies, we delete it or de-identify it.

9. US State Privacy Rights (CCPA/CPRA and VA, CO, CT, UT)

California residents (CCPA/CPRA). Subject to applicable law, California residents have the right to know the categories and specific pieces of personal information we have collected, the sources, the business or commercial purposes for collection, and the categories of third parties to whom we disclose personal information; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right not to receive discriminatory treatment for exercising these rights.

We provide a notice of the categories of personal information we collect and the purposes for which each category is used at or before the point of collection. The categories of personal information we collect, the purposes, and the categories of third parties to whom we disclose information are described in the Information We Collect and How We Share Information sections above.

Do Not Sell or Share My Personal Information. We do not sell your personal information for money. To the extent that any use of third-party cookies, pixels, or similar trackers for cross-context behavioral advertising constitutes a sale or sharing under the CCPA/CPRA, you have the right to opt out. We provide a clearly labeled Do Not Sell or Share My Personal Information (or Your Privacy Choices) control and at least two methods to submit opt-out requests, and we honor a user-enabled opt-out preference signal, such as the Global Privacy Control (GPC), as a valid opt-out of sale or sharing for the browser or device on which it is enabled. We will not resume selling or sharing after you opt out without your later authorization, and we will wait at least 12 months before asking you to opt back in. We do not use Google user data for advertising. Details of how we process opt-out preference signals are provided in our separate Cookies and Tracking disclosure.

Other US state residents (Virginia, Colorado, Connecticut, Utah). Subject to applicable law, residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) have the right to access their personal data; the right to delete personal data; in Virginia, Colorado, and Connecticut, the right to correct inaccuracies and the right to data portability; and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. None of these laws provides a private right of action; enforcement is by the applicable state attorney general (and, in Colorado, the applicable regulator). We provide accessible mechanisms to exercise these rights as described in the How to Exercise Your Rights section.

Response timing. For verifiable requests under the CCPA/CPRA, we will respond within 45 calendar days, which may be extended by an additional 45 days where reasonably necessary and permitted, with notice to you. Where other state laws set different timelines, we respond within the timeframe required by the applicable law.

We update this Privacy Policy at least every 12 months to the extent required by applicable law.

10. GDPR / UK GDPR Rights and International Transfers

Where we process personal data subject to the GDPR or UK GDPR, you have the following rights, subject to the conditions and exceptions in applicable law: the right of access to your personal data; the right to rectification of inaccurate or incomplete data; the right to erasure (the right to be forgotten); the right to restriction of processing; the right to data portability; the right to object to processing, including processing based on legitimate interests; and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law.

You also have the right to withdraw consent at any time where we rely on consent, and the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your national data protection authority).

International transfers. HIVEMIND YT is operated from, and personal data is processed in, the United States, and our service providers may process personal data in the United States and other countries. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on a valid transfer mechanism, such as an adequacy decision where available or, in the absence of adequacy, appropriate safeguards such as the European Commission's Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Agreement or Addendum), which provide enforceable rights and legal remedies for data subjects. You may request further information about the safeguards we rely on by contacting us at contact@hivemind.yt.

11. Automated Processing and AI-Generated Content

The Service uses automated and artificial-intelligence processing (including Google Gemini and Vertex AI, and, where you choose, your own BYOK credentials) to generate analysis, summaries, insights, clips, and related outputs. AI-generated content is produced algorithmically and is not reviewed by a human before it is delivered to you. It may be inaccurate, incomplete, or unsuitable for a particular purpose.

AI-generated outputs are provided without warranty and do not constitute professional, financial, legal, or medical advice. We make no guarantees regarding channel growth, revenue, or other results. You should independently verify AI-generated outputs before relying on them. Where required, we label or otherwise indicate which content is AI-generated.

We do not use automated processing to make decisions that produce legal or similarly significant effects about you without a lawful basis. Further disclaimers regarding AI-generated content, including its copyright status, are set out in our Disclaimers.

Processing on our own keys (Google Cloud and Vertex AI). Where an AI feature runs on our own Google keys rather than on a key you supply, the prompts we send and the outputs we receive are processed by Google Cloud through Vertex AI. In that arrangement Google acts as our processor under the Cloud Data Processing Addendum, which means it processes that content on our instructions and for the purpose of providing the feature you asked for. Google states that prompts and responses on this service are not used to train or fine-tune its artificial-intelligence or machine-learning models. Google also states that prompts and responses are logged and stored for up to 30 days for the sole purpose of monitoring for abuse; an exception to that abuse-monitoring logging can be requested from Google, and we will update this Privacy Policy if and when one is granted to us. Where you instead supply your own Google Gemini API key, that traffic does not run on our keys and is governed by Google's own Gemini API terms rather than by the Cloud Data Processing Addendum, as the next paragraph describes.

Your own Google Gemini API key (BYOK) and Google's use of that content. Where you supply your own Google Gemini API key, the content the Service sends to Google on your behalf is governed by Google's Gemini API Additional Terms of Service, and how Google may use that content depends on whether your key belongs to a Google Cloud project with an active billing account. For keys on Google's unpaid (free) tier, Google states that it uses submitted content and generated responses to provide, improve and develop Google products, services and machine learning technologies, and that human reviewers may read, annotate and process API inputs and outputs. For keys on a billing-enabled project (Pay-as-you-go), Google states that it does not use prompts or responses to improve its products. HIVEMIND YT does not control Google's use of content under your own key and cannot alter it. You can review Google's terms at https://ai.google.dev/gemini-api/terms.

12. How to Exercise Your Rights, Data Export, and Deletion

You can exercise your privacy rights and manage your data in the following ways:

In-product controls. You can update account information, disconnect connected accounts (including YouTube), and manage BYOK credentials. You can export your data using the in-product controls, and you can request deletion of your account and associated data through the in-product controls where available or by emailing contact@hivemind.yt; we honor verified deletion requests as described in the Data Retention section. The Service provides a data-export capability that lets you obtain a copy of your data.

Revoking Google and YouTube access. You can revoke the Service's access to your Google and YouTube data through the Google security settings page at https://security.google.com/settings/security/permissions, or by disconnecting your YouTube account within the Service.

Contacting us. You can submit access, deletion, correction, portability, opt-out, and other rights requests, or ask questions about this Privacy Policy, by emailing contact@hivemind.yt, or by writing to our registered agent on file with the California Secretary of State.

Verification and authorized agents. To protect your information, we will take reasonable steps to verify your identity before acting on a request, and we may decline or limit a request where we cannot verify it or where an exception applies. You may use an authorized agent to submit a request where permitted by law, subject to verification. We will not discriminate against you for exercising your rights.

If we deny a request in whole or in part, we will explain the basis for the denial to the extent required by applicable law, and we will inform you of any right to appeal where the applicable state law provides one.

13. Minors Under 18

The Service is not intended for anyone under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use the Service or provide any personal information.

If we learn that we have collected personal information from a person under 18 without appropriate consent, we will take reasonable steps to delete that information. If you believe a person under 18 has provided us with personal information, please contact us at contact@hivemind.yt.

14. Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and loss. These include the use of secured connections, access controls, and reliance on established infrastructure providers (Firebase and Google Cloud) and processors (including Stripe for payment data).

We do not store full payment card numbers; cardholder data is handled by Stripe. BYOK credentials are stored according to the storage mode you select (session, device, or account), and you are responsible for the security and appropriate use of keys you supply.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for the security of any keys and content you connect to the Service.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make material changes, we will update the Last Updated date above and, where required by law, provide additional notice. We will not use personal information for materially different purposes than those disclosed at collection without providing an updated notice.

Your continued use of the Service after an updated Privacy Policy takes effect constitutes your acknowledgment of the updated policy, to the extent permitted by applicable law.

16. Contact Us

HIVEMIND YT LLC is the entity responsible for the processing of personal information described in this Privacy Policy. This Privacy Policy is governed by the laws of the State of California, without regard to its conflict-of-laws principles.

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your information, contact us at contact@hivemind.yt, or by mail addressed to our registered agent on file with the California Secretary of State. Our website is hivemind.yt.

For reference, you can review the Google Privacy Policy at http://www.google.com/policies/privacy, and you can revoke application access to your Google data at https://security.google.com/settings/security/permissions.