Privacy Policy
Last updated: July 6, 2026
This Privacy Policy explains how Next Upload Ai (“we,” “us,” or “our”) collects, uses, discloses, and safeguards your personal data when you use the YouTube Growth Engine platform. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
1. Data Controller
The data controller responsible for your personal data is:
Next Upload Ai
Email: contact@nextuploadai.com
Website: nextuploadai.com
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at the email address above.
2. Personal Data We Collect
2.1 Information You Provide
- Account Information: Email address, password (stored as a salted hash), and display name when you create an account.
- Payment Information: When you subscribe to a paid plan, your payment details are processed and stored by Stripe. We do not store full credit card numbers.
- Communication: Information you provide when contacting our support team or responding to surveys.
2.2 Information Collected Automatically
- Usage Data: Pages visited, features used, analysis requests, and interaction patterns.
- Device & Browser Data: IP address, browser type, operating system, and device identifiers.
- Cookies & Similar Technologies: We use cookies and similar tracking technologies as described in our Cookie Policy.
2.3 Information from Third-Party Services
- YouTube Data: When you analyze a YouTube video, we retrieve video metadata, channel information, and public comments via the YouTube Data API.
- OAuth Authentication: If you choose to authenticate via Google OAuth, we receive basic profile information from your Google account.
3. Legal Basis for Processing
We process your personal data under the following legal bases as defined by the GDPR:
Contractual Necessity
To provide the Service and fulfill our obligations under our Terms & Conditions (e.g., account management, billing, technical support).
Legitimate Interests
To improve the Service, ensure security, prevent fraud, and analyze usage patterns. We balance these interests against your privacy rights.
Consent
For non-essential cookies, marketing communications, and certain data processing activities where you have given explicit consent.
Legal Obligation
To comply with applicable laws, regulations, and legal processes (e.g., tax reporting, data retention requirements).
4. How We Use Your Personal Data
We use your personal data for the following purposes:
- To provide, maintain, and improve the YouTube Growth Engine Service
- To process transactions and manage your subscription
- To analyze YouTube comments and generate insights, content ideas, hooks, and scripts
- To communicate with you about your account, service updates, and support requests
- To detect, prevent, and address technical issues, fraud, or abuse
- To comply with legal obligations and enforce our Terms & Conditions
- To send marketing communications (only with your explicit consent, which you can withdraw at any time)
5. Data Sharing & Third-Party Processors
We do not sell your personal data to third parties. We may share your data with trusted service providers who process data on our behalf, including:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database & Authentication | Account info, analysis data |
| OpenAI | AI Analysis & Generation | Comments, analysis prompts |
| Stripe | Payment Processing | Payment details, billing info |
| Netlify | Hosting & Deployment | IP addresses, request logs |
| YouTube Data API | Video & Comment Fetching | Video URLs, public comments |
| Google Analytics | Usage Analytics | Page views, IP address, session data, device info |
| Plausible Analytics | Privacy-first Analytics | Page views (anonymized, no cookies) |
Each provider is contractually obligated to process your data only as instructed by us and in compliance with applicable data protection laws.
6. International Data Transfers
Your personal data may be transferred to and processed in countries other than your country of residence. When we transfer data from the European Economic Area (EEA) to countries that have not been deemed adequate by the European Commission, we rely on appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Data Processing Agreements (DPAs) with our sub-processors
- For US-based providers, verification of EU-U.S. Data Privacy Framework certification where applicable
7. Data Retention
We retain your personal data only as long as necessary to fulfill the purposes described in this Privacy Policy, or as required by law:
- Account Data: Retained for the duration of your account plus 30 days after account deletion, after which it is permanently deleted.
- Analysis Data: Retained for as long as your account is active. You can delete individual analyses at any time.
- Payment Records: Retained for 7 years to comply with tax and accounting obligations.
- Logs & Usage Data: Retained for up to 12 months for security and analytics purposes.
8. Your Data Protection Rights
Under the GDPR and applicable privacy laws, you have the following rights regarding your personal data:
Right of Access
You can request a copy of the personal data we hold about you.
Right to Rectification
You can request that we correct inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”)
You can request deletion of your personal data, subject to certain legal exceptions.
Right to Restrict Processing
You can request that we restrict the processing of your data in certain circumstances.
Right to Data Portability
You can request a copy of your data in a structured, machine-readable format.
Right to Object
You can object to the processing of your data for direct marketing or legitimate interest purposes.
To exercise any of these rights, please contact us at contact@nextuploadai.com. We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Row-Level Security (RLS) policies in our database
- Regular security audits and penetration testing
- Strict access controls and employee training on data protection
- Secure, token-based authentication with Supabase
10. Children’s Privacy
The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or a prominent notice on the Service. The “Last updated” date at the top of this page will reflect the most recent revision.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Next Upload Ai
Email: contact@nextuploadai.com
Website: nextuploadai.com