Privacy Policy

Editorial Transform ("we", "our", "the Service") is a B2B publishing tool operated by Michael Krivda as an individual sole operator (referenced as "we" / "our" throughout this document as a legal convention only). This Privacy Policy explains what data we collect from our partner publishers, how we use it, and how we protect it.

The Service is not offered to individual end-users. We work exclusively with verified news publishers who authorize our platform to publish content on their own YouTube channels.

1. Information we collect

From the partner publisher, when they onboard Editorial Transform:

• OAuth 2.0 credentials — refresh tokens issued by Google, scoped to youtube.upload and youtube.readonly. These are stored encrypted (Fernet symmetric encryption) and used only to publish content to the publisher's own channel.
• Channel identifiers — YouTube channel ID and display name for the publisher's channel.
• Contact information — the email address of the publisher's authorized administrator.
• Publishing activity — logs of every upload including the source article URL, target YouTube video ID, timestamps, and success/failure status. These logs support audit and troubleshooting.
• Content generated by the Service — video files, thumbnails, and metadata derived from the publisher's own editorial articles. Stored on our object storage for the duration configured by the publisher (default 14 days for compressed output).

From end-users viewing publisher content via our embedded widget on publisher websites, we collect only what is necessary to operate the widget:

• Anonymous session identifier — a random UUID stored in a first-party cookie, used to deduplicate view counts, likes, and to remember which videos the viewer has already seen. Not linked to any personal identity.
• Interaction events — video opens, watch progress (25/50/75/100%), likes, shares, and article clicks. Used strictly for aggregated analytics shown to the publisher (never sold, never used for advertising).
• Technical metadata — user-agent string, viewport size, referrer URL — used for troubleshooting compatibility issues.

We do not collect names, emails, IP addresses beyond what is required for request routing, or any other personal identifiers from widget viewers. The widget does not integrate with third-party analytics or advertising trackers.

2. How we use OAuth data

Access granted through OAuth 2.0 is used solely for the following actions on the granting publisher's own YouTube channel:

• Uploading video content generated from the publisher's own editorial articles
• Setting video metadata (title, description, tags, category, thumbnail)
• Reading channel information for display in the publisher's admin panel

We do not:

• Access or modify any content on channels other than those explicitly granted to us
• Share OAuth tokens or channel data with any third party
• Use OAuth data for advertising, profiling, or any purpose beyond what is described here
• Retain OAuth tokens after a publisher revokes access

3. Google API Services User Data Policy

Editorial Transform's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Third-party services and data sharing

We do not sell, rent, or share personal information or OAuth credentials with third parties. The following third-party services are used strictly as infrastructure providers — each receives only the minimum data required to perform its function, and none receives OAuth credentials or channel identifiers:

5. Data retention

6. Publisher rights

Every partner publisher may at any time:

• Revoke OAuth access directly from their Google Account permissions page. This immediately stops all uploads and invalidates our stored refresh token.
• Request deletion of all their data from our systems by contacting us at michael.krivda@gmail.com. We will complete deletion within 30 days.
• Export their data — upload history, published video IDs, and article mapping — upon request.

7. Security

OAuth refresh tokens are stored using Fernet (AES-128-CBC) symmetric encryption at rest. All API communication uses TLS 1.2+. Database access is restricted to the application server; no external network access is permitted to the database. Infrastructure runs on EU-based Hetzner Cloud (Germany) with data residency in the European Union.

8. GDPR compliance

Because our infrastructure is located in the European Union and we serve publishers whose audiences may include EU residents, we align our practices with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"):

• Lawful basis for processing. Publisher OAuth data — legitimate interest and explicit publisher consent (via Google's OAuth flow). Widget viewer anonymous session data — legitimate interest for essential service functionality.
• Data minimization. We collect only what is strictly necessary for the Service to function. See section 1 for the complete list.
• Data Subject Rights. Publishers and their end-users have the right to access, rectify, delete, restrict processing of, and export their data. Requests to michael.krivda@gmail.com are actioned within 30 days.
• Data residency. All personal data is stored within the EU (Germany). No data transfer to countries without an adequacy decision.
• No profiling. We do not perform automated decision-making or profiling on individuals.
• Data Protection Contact. Data protection questions and Data Subject Requests may be sent to michael.krivda@gmail.com. Response within 30 days.
• Breach notification. In the event of a data breach affecting personal data, affected publishers will be notified within 72 hours, in line with GDPR Article 33.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated to partner publishers via email with at least 30 days' notice.

10. Contact and legal notices

For questions about this policy, data requests, or security concerns:
michael.krivda@gmail.com