Privacy Policy
Last Updated: August 4, 2026
1. Introduction
Welcome to ytpix, operated by Karthikeyan R, an individual based in Bengaluru, Karnataka, India ("we," "our," or "us"). We are committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at ytpix.com or use our AI-powered content repurposing platform.
Data Controller: Karthikeyan R, Bengaluru, Karnataka, India. For any privacy-related inquiries, contact support@ytpix.com.
By using ytpix, you consent to the data practices described in this policy. If you do not agree with any part of this policy, please discontinue use of our services immediately.
2. Information We Collect
2.1 Information You Provide
- Account Information: Full name, email address, and password when you register.
- Profile Information: Avatar, display name, and preferences you choose to add.
- Content: YouTube URLs you submit for processing, and any additional text inputs.
- Team Workspace Data: Email addresses of colleagues invited to your Business team workspace.
- API Keys: Names and hashed secret keys associated with Business API integrations.
- Communications: Information you provide when contacting support or submitting inquiries.
- Payment Information: Billing details (processed securely by our payment processor — we do not store full credit card numbers).
2.2 Information Collected Automatically
- Usage Data: Pages visited, features used, generation history, clickstream data.
- Device Information: IP address, browser type and version, operating system, device type.
- Session Data: Login timestamps, session duration, interactions within the platform.
- Cookies: We use cookies and similar tracking technologies (see Section 6 for details).
- Performance Data: API response times, error rates, feature usage statistics.
2.3 Information from Third Parties
- Google Authentication: If you sign in with Google, we receive your name, email, and profile picture from Google.
- YouTube API: Video metadata and transcripts fetched via the YouTube Data API.
- Payment Processors: Payment confirmation and transaction details from our third-party payment processor.
3. How We Use Your Information
We use the collected information for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Account creation and management | Contractual necessity |
| Processing content generations | Contractual necessity |
| Billing and subscription management | Contractual necessity |
| Service improvement and analytics | Legitimate interest |
| Security and fraud prevention | Legitimate interest |
| Customer support | Contractual necessity |
| Email notifications (product updates, billing) | Consent / Legitimate interest |
| Legal compliance | Legal obligation |
4. YouTube Data API Compliance
ytpix uses the YouTube Data API to fetch video transcripts and metadata. Our use of this API complies with the YouTube API Services Terms of Service.
- We only access data from YouTube videos that you explicitly submit via our platform.
- We do not store YouTube API data beyond what is necessary for generation and account history.
- We do not share YouTube user data with third parties except as required by law.
- YouTube API data is subject to the Google Privacy Policy.
- You may revoke our access to YouTube data at any time by contacting us.
5. Data Sharing & Disclosure
We do not sell your personal information. We may share your data only in the following circumstances:
5.1 Service Providers
We engage trusted third-party service providers to help us operate our platform:
| Provider | Purpose | Data Shared |
|---|---|---|
| OpenAI | AI content generation | Video transcripts, generation prompts |
| Neon (PostgreSQL) | Database hosting | User accounts, generation history |
| Upstash Redis | Caching and queue management | Session data, job queues |
| Payment Gateway (Third-party) | Payment processing | Payment details (tokenized) |
| Coolify (Self-hosted) | Application & database hosting | Server logs, application data |
5.2 Legal Requirements
We may disclose your information if required to do so by law or in response to valid legal requests by public authorities.
5.3 Business Transfers
In the event of a merger, acquisition, or asset sale, your personal data may be transferred. We will notify you of any change in ownership or data usage.
6. Cookies & Tracking Technologies
We use cookies and similar technologies to enhance your experience, analyze usage, and secure our platform.
| Cookie Type | Purpose | Duration | Category |
|---|---|---|---|
| access_token | JWT authentication | 15 minutes | Essential |
| refresh_token | Session refresh | 7 days | Essential |
| csrf_token | CSRF protection | Session | Essential |
You can control cookies through your browser settings. Disabling essential cookies may impact platform functionality. For more details, see our Cookie Policy.
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
- Account Data: Retained until you delete your account or request deletion.
- Generation History: Retained for the duration of your account. Deleted within 30 days of account deletion.
- Payment Records: Retained for 7 years to comply with tax and legal obligations.
- Usage Analytics Data: Internal system usage details are retained in aggregate form indefinitely for capacity planning. No personal identifiers or tracking cookies are used.
- Communication Logs: Retained for 3 years from the last interaction.
8. Data Security
We take the security of your personal data and content extremely seriously. We implement robust, industry-standard administrative, technical, and physical security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:
Data Encryption
All communication between your browser and our platform is encrypted using Transport Layer Security (TLS 1.3/HTTPS). All persistent user data, generated content, and backups are encrypted at rest using the Advanced Encryption Standard (AES-256).
Secure Authentication & Identity
We utilize secure authentication protocols based on OpenID Connect (OIDC) and OAuth 2.0. User login sessions and access tokens are managed by a dedicated, secure Identity Provider. We never store your passwords in plain text.
Database & Infrastructure Security
Our databases are hosted in isolated virtual networks (VPC) with strict firewall rules and role-based access. There is no direct public database access from the open internet, preventing unauthorized data extraction.
Token & Session Safety
Access is authorized using short-lived JSON Web Tokens (JWT) stored in secure, HTTP-only, SameSite cookies to protect against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF).
Automated Backups
All transaction records, user configurations, and system data are backed up automatically daily to geographically distributed, secure storage with point-in-time recovery capabilities.
Audits & Activity Monitoring
We run automated security scanners to identify software vulnerabilities. All administrative updates, database operations, and system configs are tracked through access logs.
9. Your Rights (GDPR & CCPA)
Depending on your jurisdiction, you may have the following rights regarding your personal data:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of your personal data | Account settings or email request |
| Rectification | Correct inaccurate or incomplete data | Account settings |
| Erasure | Delete your account and associated data | Account settings (delete account) |
| Portability | Receive your data in a machine-readable format | Email request |
| Objection | Object to processing for marketing or analytics | Email request |
| Restriction | Restrict processing of your data | Email request |
| Withdraw Consent | Withdraw consent at any time | Account settings or email |
To exercise any of these rights, contact us at support@ytpix.com. We will respond within 30 days.
10. International Data Transfers
Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international data transfers, including:
- Standard Contractual Clauses (SCCs) for EU/UK data transfers.
- Data Processing Agreements (DPAs) with all sub-processors.
- Compliance with the EU-US Data Privacy Framework where applicable.
11. Children's Privacy
ytpix is not intended for children under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal data, we will delete it immediately.
12. AI & Automated Processing
ytpix uses AI models (including OpenAI's GPT-4o-mini) to generate content. You have the right to:
- Not be subject to decisions based solely on automated processing.
- Opt out of AI-powered features by discontinuing use of the generation feature.
- Request human review of any AI-generated content decisions.
- Access information about the logic and significance of automated processing.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Email notification to your registered email address.
- A prominent notice on the Platform.
- Updating the "Last Updated" date at the top of this policy.
We encourage you to review this policy periodically. Your continued use after changes constitutes acceptance of the updated policy.
14. Contact Information
For privacy-related inquiries, data deletion requests, or to exercise your data rights:
- Data Controller: Karthikeyan R (Individual / Freelancer)
- Address: Bengaluru, Karnataka, India
- Email: support@ytpix.com
- Contact Form: ytpix.com/contact
We will respond to all data rights requests within 30 days of receipt.