TubeVault

Privacy Policy

Last Updated: April 6, 2026

1. Introduction

Welcome to TubeVault ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and services (the "Service").

This policy complies with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Republic of Korea Personal Information Protection Act (PIPA), as well as other applicable privacy laws.

Please read this policy carefully. By using TubeVault, you acknowledge that you have read and understood this Privacy Policy.

2. Data We Collect

2.1 Account Information (via Google OAuth)

When you register or log in using Google OAuth, we receive and store:

Email address

Profile name

Profile image URL

We do not receive or store your Google password.

2.2 YouTube API Services

If you use our YouTube integration features, we collect and process the following information via YouTube API Services:

This data is used to verify channel ownership, customize high-fidelity themes, and maintain brand consistency on your TubeVault profile. We do not store or access your private activity (e.g., watch history, comments) or modify content on your YouTube account. By using TubeVault, you agree to be bound by the YouTube Terms of Service and acknowledge Google's processing of your data as described in the Google Privacy Policy.

2.3 Usage Data

We collect data about how you interact with our Service, including:

2.4 Technical Data

We automatically collect certain technical information when you use our Service:

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process your personal data under the following legal bases:

Contract Performance: To provide the Service you have signed up for, including account creation and subscription management.

Legitimate Interests: To improve our Service, ensure security, prevent fraud, and conduct analytics — where these interests are not overridden by your rights.

Legal Obligation: Where processing is required to comply with applicable laws.

Consent: For non-essential cookies and analytics. You may withdraw consent at any time.

4. How We Use Your Data

We use the collected data for the following purposes:

To create and manage your account

To provide, operate, and maintain the Service

To process subscription payments via Paddle

To send service-related communications (e.g., billing receipts, important updates)

To analyze usage patterns and improve the Service

To detect, prevent, and address technical issues and fraud

To comply with legal obligations

5. Payments (Paddle)

We use Paddle (paddle.com) as our Merchant of Record for subscription payments. Paddle handles the complete payment transaction, including:

Collecting your billing and payment information

Processing credit/debit card and other payment methods

Issuing invoices and receipts

Managing tax compliance globally

TubeVault does not store, process, or have access to your credit card number or full payment details on our servers. Paddle's handling of your payment data is governed by Paddle's own Privacy Policy, available at paddle.com/privacy.

Paddle acts as the data controller for payment information. Please review Paddle's Privacy Policy for details on how they protect your payment data.

6. Third-Party Services

We integrate with the following third-party services. Each has their own privacy policy governing their use of your data:

Google OAuth — Authentication provider. Google Privacy Policy: policies.google.com/privacy

Google Analytics 4 (GA4) — Usage analytics. Google Analytics Privacy: policies.google.com/privacy

Paddle — Payment processing and Merchant of Record. Paddle Privacy Policy: paddle.com/privacy

We do not sell, trade, or rent your personal information to third parties for their marketing purposes.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law:

Account data: Retained for the duration of your account. Deleted within 30 days of account deletion request.

Usage data: Retained for up to 24 months for analytics purposes, then anonymized or deleted.

Payment records: Retained for up to 7 years as required for tax and accounting compliance (held by Paddle as Merchant of Record).

Logs and technical data: Retained for up to 90 days for security and debugging purposes.

You may request deletion of your account and associated data at any time via the Support system in your dashboard.

8. International Data Transfers

TubeVault operates globally. Your personal data may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that differ from the laws of your country.

When we transfer personal data from the EEA, UK, or other regions with data transfer restrictions, we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission

Adequacy decisions where applicable

Other lawful transfer mechanisms as required

For Korean users, international transfers are conducted in compliance with Article 28-8 of the Personal Information Protection Act (PIPA).

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

Strictly Necessary Cookies: Required for the Service to function. These cannot be disabled. Examples: session authentication tokens.

Analytics Cookies: Used by Google Analytics 4 to understand how users interact with our Service. These are only placed with your consent.

Preference Cookies: Used to remember your settings and preferences.

9.2 Managing Cookies

You can control and manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service. For EU/EEA users, non-essential cookies are only placed after you provide consent via our cookie consent mechanism.

10. Your Privacy Rights

10.1 Rights Under GDPR (EEA / UK Users)

If you are located in the EEA or UK, you have the following rights under the GDPR:

Right to Access: Request a copy of the personal data we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete data.

Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.

Right to Restriction: Request that we restrict the processing of your data.

Right to Data Portability: Receive your data in a structured, machine-readable format.

Right to Object: Object to processing based on legitimate interests.

Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time.

Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., your national Data Protection Authority).

10.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the CCPA/CPRA:

Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell.

Right to Delete: Request deletion of personal information we have collected.

Right to Correct: Request correction of inaccurate personal information.

Right to Opt-Out of Sale or Sharing: TubeVault does not sell or share your personal information for cross-context behavioral advertising.

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Do Not Sell or Share My Personal Information: We do not sell your personal information to third parties. If this practice changes, we will provide a prominent opt-out mechanism.

10.3 Rights Under PIPA (Korean Users)

If you are located in the Republic of Korea, you have the following rights under PIPA:

Right to access your personal information

Right to correct or delete your personal information

Right to suspend processing of your personal information

Right to withdraw consent

To exercise your rights, please contact us via the Support system in your dashboard. We will respond within the timeframe required by applicable law (generally 30 days).

11. Children's Privacy

TubeVault is not directed to children under the age of 13 (or 16 in the EEA where applicable). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will take steps to delete such information.

12. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

Encrypted data transmission (HTTPS/TLS)

Access controls and authentication

Regular security assessments

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last Updated" date at the top of this policy

Notify you via email (to the address associated with your account)

Display a prominent notice within the Service

Your continued use of TubeVault after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us via email at support@tubevault.app or through the Support system in your TubeVault dashboard.

For GDPR-related inquiries, you may also contact us to identify our Data Protection Officer or representative, where applicable.

For Korean users, if you wish to contact our domestic representative for PIPA purposes, please reach out through the Support system and specify that your inquiry relates to Korean privacy law.

© 2026 TubeVault. All rights reserved.