Privacy Policy

1. Introduction

Prepostr ("we," "us," or "our") operates the website at prepostr.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

2. Data Controller

For the purposes of applicable data protection laws (including the GDPR and LGPD), the data controller is:

Leonardo Grigorio Araujo Desenvolvimento de Software Ltda - ME
Trade name: Lion Stance
CNPJ: 54.036.904/0001-04
Av. Paulista, 1106, Sala 01, Bela Vista
São Paulo - SP, 01310-914, Brazil
Email: [email protected]

If you have questions or concerns about how your data is handled, you may contact us at the email address above.

3. Information We Collect

3.1 Account Information

When you sign in with Google OAuth, we receive and store:

• Your name and email address
• Your Google profile picture URL
• A unique Google account identifier

We do not receive or store your Google account password.

3.2 YouTube Channel Data

When you connect your YouTube channel, we access your channel through the YouTube API Services with your explicit consent. We collect:

• Your channel name, ID, and thumbnail
• Video metadata for videos you own (titles, descriptions, thumbnails, view counts, durations)
• Captions/transcripts of your own videos, used for AI content generation
• OAuth access and refresh tokens (encrypted at rest, used only to communicate with Google APIs on your behalf)

We request the read-only YouTube scope (youtube.readonly) only. We never request permission to upload, edit, delete, or comment on your behalf. Your channel data is refreshed through the YouTube API on a recurring schedule (at least every 14 days while your channel is connected) and is never shown to other users or used for advertising. Disconnecting your channel deletes the stored tokens immediately.

Prepostr uses YouTube API Services. Prepostr is an independent product and is not affiliated with, endorsed by, or sponsored by YouTube or Google LLC.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.3 Competitor Channel Analytics

When you add channels you do not own for tracking ("competitor channels"), we collect information those channels have made public on YouTube:

• Channel names, thumbnails, subscriber counts, and video counts
• Public video titles, descriptions, thumbnails, view counts, like counts, durations, and publish dates
• Publicly available captions, which we condense into a short AI-generated summary

We obtain this information through the YouTube Data API and from publicly accessible YouTube pages, in some cases via network infrastructure providers (see Section 6). This is the same public information available to anyone on youtube.com; we never access private, unlisted, or restricted content. Thumbnails are loaded directly from YouTube and are not re-hosted by us.

Because channel names and public videos can identify a creator, we treat this information as personal data of that creator and process it under our legitimate interest in providing competitive analytics (Section 4). We store a caption summary rather than the caption text, keep competitor data only while at least one Prepostr user tracks the channel, and delete it within 7 days after the last user stops tracking. Creators who prefer that their public channel not be analysed in Prepostr can write to [email protected] and we will exclude the channel.

3.4 Generated Content

Content you generate through our AI features (social media posts, blog drafts, chat messages) is stored in your account and is not shared with other users.

3.5 Usage Data

We do not run third-party analytics or advertising trackers on the Service. We keep an internal usage log of AI requests (feature used, model, token counts, cost, timestamp) to enforce plan limits and understand which features are used. Our hosting provider's standard server logs (IP address, user agent, requested URL) are retained for up to 30 days for security and troubleshooting. Google Search Console gives us aggregated, non-identifying search statistics about our public website.

3.6 Payment Information

Payments are processed by Stripe. We do not store your credit card number, CVC, or full billing details on our servers. We store only your Stripe customer ID, subscription ID, and plan information to manage your account. See Stripe's Privacy Policy.

3.7 AI Agents and Browser Extension

You may optionally connect third-party AI assistants (for example Claude or ChatGPT) to your workspace through our MCP server, or install the Prepostr browser extension for YouTube Studio. When you authorise such a client we issue it a scoped access token; the client can then read, and if you allow it, write the same workspace data you see in the dashboard (video metadata, drafts, notes, suggestions). Data sent to an AI assistant is governed by that assistant's own privacy policy. The browser extension reads only the identifier and title of the video open in YouTube Studio and sends them to prepostr.com; it does not read your browsing history or other sites. You can revoke any connected client at any time from Settings → AI Agent Access (MCP).

4. Legal Basis for Processing

We process your personal data under the following legal bases (as defined by the GDPR and equivalent provisions of the LGPD):

• Contract performance: Processing necessary to provide the Service you signed up for (account management, content generation, billing).
• Consent: YouTube channel access is granted via explicit OAuth consent. You may withdraw this consent at any time by revoking access through your Google Account permissions.
• Legitimate interest: Processing public information about creators whose channels our users choose to track (Section 3.3), keeping internal usage and security logs, and preventing abuse, provided this does not override the fundamental rights of the people concerned. You may object to this processing as described in Section 11.

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Generate AI-powered content from your video transcripts
• Display analytics and trend data from publicly available YouTube data
• Process your subscription payments
• Track your token usage against your plan limits
• Improve and optimize the Service based on aggregated usage patterns
• Communicate with you about your account (e.g., billing notifications, service updates)
• Detect and prevent abuse, fraud, or violations of our Terms of Service

6. Third-Party Services and Data Sharing

We share your data with the following third-party services only as necessary to provide the Service:

We do not sell, rent, or trade your personal information to any third party for marketing or advertising purposes.

7. AI-Generated Content and Data Processing

When you use our AI features, the inputs listed in Section 6 (transcripts, titles, caption summaries, thumbnails, your messages and notes) are sent to third-party AI model providers via OpenRouter to generate suggestions. No personally identifiable information such as your name or email is included in these requests.

Requests are made under OpenRouter's and each provider's API terms, which for the providers we use state that API inputs are not used to train their models. We cannot independently audit every provider's internal practices. AI-generated content is stored in your account and is visible only to you and members of your workspace.

8. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Strictly necessary: Authentication session cookies to keep you signed in. These are essential for the Service to function and cannot be disabled.
• Functional: Theme and language preferences to personalize your experience.

You can configure your browser to refuse non-essential cookies. Blocking essential cookies may prevent you from using the Service.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States, where our third-party service providers (Google, OpenRouter, Stripe) operate.

When data is transferred outside the European Economic Area (EEA) or Brazil, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• The service provider's own compliance frameworks (e.g., Google's and Stripe's GDPR compliance programs)
• Your explicit consent provided when connecting third-party services

10. Data Retention and Account Deletion

You can permanently delete your account at any time from Settings → Profile → Danger zone → Delete account. Deletion is immediate and irreversible. When you confirm, we:

• Cancel any active Stripe subscription right away (no further charges) and remove your Stripe customer record
• Delete your user record, all workspaces you own, every project, transcript, generated content task, chat session and message, system prompt, competitor list, trend analysis, and YouTube OAuth tokens
• Hard-delete all of your token usage logs
• Sign you out of every active session

Some retention exceptions still apply:

• Stripe billing records: Stripe retains invoices and payment records for the period required by tax and accounting law, independently of our deletion.
• Backups: Encrypted database backups may contain your data for up to 30 days before they roll off, after which copies are gone.
• Shared analytics caches: Public YouTube data we cache about competitor channels is not tied to your identity and is shared with other users tracking the same channel, so it is not deleted with your account. It is purged automatically within 7 days after the last user stops tracking the channel.
• Usage logs: Your AI usage logs are hard-deleted with your account. Aggregated, anonymised statistics may be kept.

While your account is active we retain your workspace data (drafts, notes, chat history, trend reports, view-count history) for as long as you keep it. Pending workspace invitations expire after 30 days. Account deletion also revokes the Google permissions granted to Prepostr for your connected channels.

If you only want to remove specific data without closing your account, you can delete individual workspaces, projects, or YouTube connections from the dashboard. You can also disconnect a YouTube channel at any time via Settings → Connections, which immediately invalidates the stored OAuth tokens.

11. Your Rights

Depending on your jurisdiction (including under the GDPR for EU/EEA residents, the LGPD for Brazilian residents, and the CCPA for California residents), you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure ("right to be forgotten") of your personal data and account, available self-service from Settings → Profile → Danger zone
• Data portability to receive your data in a structured, machine-readable format, on request to [email protected]
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent for data processing at any time without affecting the lawfulness of processing performed before withdrawal
• Revoke YouTube access at any time through your Google Account permissions
• Lodge a complaint with your local data protection authority if you believe your rights have been violated (in Brazil, the ANPD; in the EU/EEA, the supervisory authority of your member state)

To exercise any of these rights, contact us at [email protected]. We will acknowledge your request within 72 hours and respond substantively within 30 days. If we need additional time, we will inform you of the reason and the expected timeline.

12. Data Security

We implement industry-standard security measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encrypted storage of OAuth tokens and sensitive credentials
• Access controls limiting data access to authorized services only
• Regular security reviews of our infrastructure and dependencies

While we take reasonable measures to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security and are not responsible for the security practices of third-party services we integrate with.

13. Children's Privacy

The Service is not intended for children under the age of 13 (or 16 in the EU/EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will promptly delete the information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes that affect how we process your personal data, we will notify you via email (to the address associated with your account) and/or through a prominent notice on the Service at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before the effective date.

15. Contact

For privacy-related inquiries, data requests, or complaints:

Email: [email protected]

General support: [email protected]