Privacy Policy

1. Data Protection Contact

For questions concerning this Privacy Policy or the processing of your personal data please Contact us.

2. Principles of Data Processing

We process personal data only where there is a lawful basis and only to the extent reasonably necessary for the relevant purpose.

Depending on the processing activity, the legal basis may include:

• Article 6(1)(b) GDPR – Performance of a contract: where processing is necessary to provide your Winkiloo account, subscription, creator tools or another service requested by you.
• Article 6(1)(c) GDPR – Legal obligation: where processing is necessary to comply with accounting, tax, regulatory, consumer-protection or other legal requirements.
• Article 6(1)(f) GDPR – Legitimate interests: where processing is necessary for legitimate interests such as platform security, fraud prevention, service improvement, abuse prevention, operation of the Service or establishment and defence of legal claims, provided that your rights and interests do not override those interests.
• Article 6(1)(a) GDPR – Consent: where you have expressly consented to processing, for example certain optional cookies, integrations or communications.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

3. Personal Data We Collect

The categories of personal data we process depend on how you use Winkiloo.

3.1 Registration and Account Data

When you create a Winkiloo account, we may collect:

• Name or creator name
• Email address
• Password in securely hashed form
• Account creation date
• Email-verification status
• Preferred language
• Country
• Timezone
• Subscription or plan information
• Account role and permissions
• Referral or invitation information
• Account and security settings.

We do not store your password in plain text.

3.2 Creator Profile Data

If you create a creator profile, we may process information such as:

• Creator or display name
• Profile image
• Profile banner
• Biography
• Country
• Language
• Creator niche or category
• Social or channel links
• Creator statistics
• Collaboration information
• Public reviews and ratings
• Other information you choose to display publicly.

Information designated as public may be visible to anyone, including users who do not have a Winkiloo account, and may be indexed by search engines.

3.3 YouTube Channel and Video Data

When you add or connect a YouTube channel or video, Winkiloo may process publicly available or authorised information such as:

• YouTube channel ID
• Channel name and handle
• Channel URL
• Channel description
• Channel profile image or banner
• Subscriber count
• Video count
• Channel view statistics
• YouTube video IDs
• Video titles and descriptions
• Video thumbnails
• Video publication dates
• Public video statistics
• Other information returned by authorised YouTube API Services.

4. Google Sign-In and YouTube OAuth

Winkiloo may allow you to connect your Google account and authorise access to certain YouTube information through Google's OAuth 2.0 authorisation process.

Winkiloo only receives access to information covered by the permissions that you approve on Google's authorisation screen.

Depending on the features you activate, this may include:

• Your Google account identifier
• Your email address and basic account information
• Your YouTube channel identity
• Your channel and video information
• YouTube Analytics data
• Channel performance metrics
• Other data covered by the specific OAuth permissions you approve.

Winkiloo does not receive your Google account password.

4.1 How We Use Google User Data

Google user data obtained through Google APIs is used only to provide, maintain and improve Winkiloo features that you have requested or authorised, such as:

• Verifying ownership or authorised control of a YouTube channel
• Importing authorised channel information
• Displaying YouTube analytics
• Generating creator growth reports
• Providing channel and video insights
• Providing AI-assisted analysis where you request such functionality
• Refreshing connected channel information
• Maintaining the security and integrity of your connected account.

Winkiloo does not sell Google user data.

Winkiloo does not use Google user data for advertising purposes or for creating advertising profiles.

Winkiloo's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

4.2 Sharing, Transfer and Disclosure of Google User Data

Winkiloo does not sell Google user data, does not transfer Google user data to data brokers or advertising networks, and does not share Google user data with third parties for their own advertising, profiling or marketing purposes.

Google user data may be disclosed or processed only where necessary to provide, secure, maintain or support Winkiloo functionality that you request or authorise. Depending on the feature used, the categories of recipients may include:

• Hosting and infrastructure service providers: where information is processed as necessary to host Winkiloo, operate databases, maintain backups, deliver application functionality or protect the Service.
• Google and YouTube: where communication with Google or YouTube APIs and services is necessary to perform the OAuth-authorised functionality you request, such as retrieving channel, video or analytics information, refreshing authorised data or managing the connection.
• AI service providers, including OpenAI: when you deliberately use an AI-powered Winkiloo feature, relevant channel, video, analytics or other information necessary for that specific request may be transmitted for processing solely to provide the requested AI functionality. Winkiloo does not send your Google account password, Google OAuth access token or Google OAuth refresh token to the AI provider.
• Email and communications infrastructure: where limited account information, such as an email address, must be processed to deliver transactional or service-related communications requested by or necessary for your Winkiloo account.
• Security, fraud-prevention and technical support providers: where limited information is necessary to protect Winkiloo, investigate abuse, troubleshoot technical problems or maintain the security and integrity of the Service.
• Professional advisers and competent authorities: where disclosure is reasonably necessary to obtain legal, accounting, audit or other professional advice, to establish or defend legal claims, or where disclosure is required by applicable law, regulation, court order or another binding legal request.

Service providers that process Google user data on behalf of Winkiloo are permitted to process that information only for the contracted service and not for unrelated purposes, subject to the applicable contractual and data-protection arrangements.

Google user data obtained through OAuth is not made public merely because you connect a Google or YouTube account. Any information that appears on a public Winkiloo creator or video page is governed separately by the public-profile and publication functionality described in this Privacy Policy.

Winkiloo's use and transfer of information received from Google APIs is limited to the practices disclosed in this Privacy Policy and adheres to the Google API Services User Data Policy, including the applicable Limited Use requirements.

Raw and Aggregated or Anonymized Google User Data

Raw Google user data: Winkiloo may allow raw Google user data to be processed only where necessary to provide the Service. Depending on the feature used, this may include processing by Winkiloo's hosting and infrastructure providers, communication with Google or YouTube APIs, processing by OpenAI when a user explicitly requests an AI-powered feature and only the relevant channel, video or analytics information required for that request, security or technical service providers, and competent authorities where disclosure is legally required. Google OAuth access tokens and refresh tokens are not disclosed to OpenAI, advertisers, other Winkiloo users or data brokers.

Aggregated or anonymized Google user data: Winkiloo may derive aggregated or anonymized statistics from Google user data for internal service operation, analytics, security, troubleshooting and product improvement. Winkiloo does not sell aggregated or anonymized Google user data and does not disclose it to advertisers, data brokers or other third parties for their own advertising, profiling or marketing purposes. Where such information is processed by a contracted service provider on Winkiloo's behalf, it is processed only for the purpose of providing the relevant service to Winkiloo.

4.3 Google OAuth Tokens

When required to keep a YouTube connection active, Winkiloo may store OAuth access tokens and/or refresh tokens provided by Google.

These tokens are used only to perform authorised API requests on your behalf and are subject to technical and organisational access controls.

Winkiloo does not disclose Google OAuth access tokens or refresh tokens to advertisers, data brokers, payment processors, other Winkiloo users or AI service providers.

4.4 Disconnecting Google or YouTube

You may disconnect your Google or YouTube account through Winkiloo where that functionality is available.

You can also revoke Winkiloo's access directly through your Google Account permissions:

Google Account – Third-party access

Revoking access may prevent YouTube ownership verification, analytics, growth reports or other connected functionality from continuing to work.

5. YouTube API Data Retention

Winkiloo processes YouTube API data in accordance with the applicable YouTube API Services policies.

Where YouTube API policies require API data to be refreshed or deleted within a particular period, Winkiloo will refresh or delete such data in accordance with those requirements.

In particular, YouTube API data subject to the applicable 30-day storage limitation must be refreshed from YouTube or deleted no later than required by YouTube's API policies.

If you request deletion of stored YouTube-related user data, Winkiloo will process the request as soon as reasonably possible and within the period required by YouTube API Services policies.

Deleting YouTube data stored by Winkiloo does not delete data stored by YouTube itself. To delete information directly from YouTube, you must use YouTube's own services or an authorised application that supports such deletion.

6. YouTube Analytics Data

If you authorise YouTube Analytics access, Winkiloo may retrieve and process analytics relating to your connected YouTube channel and videos.

This may include information such as:

• Views
• Watch time
• Average view duration
• Audience-retention information
• Subscriber changes
• Impressions
• Click-through rates where available
• Traffic-source information
• Geographic or audience statistics where made available
• Video-level performance information
• Other metrics authorised through the YouTube Analytics API.

We use this information to provide dashboards, analytics, reports, alerts, comparisons and creator recommendations requested through Winkiloo.

7. Campaign, Discovery and Interaction Data

When you use Winkiloo discovery, campaign, promotion or creator-feedback functionality, we may process:

• Campaign identifiers
• Selected videos or channels
• Campaign targeting criteria
• Campaign status
• Views or interactions recorded within Winkiloo
• Completion and verification data
• Creator Credit usage
• Feedback actions
• Abuse-prevention information
• Fraud and integrity signals.

We process this information to operate campaign functionality, calculate eligible activity, prevent abuse and maintain platform integrity.

8. Reviews and Testimonials

If you submit a review or testimonial, we may process:

• Your creator or display name
• Profile image
• Star rating
• Review text
• Video testimonial
• Submission and publication date
• Moderation status.

Approved reviews and testimonials may be displayed publicly.

If you submit content intended for publication, please do not include information that you do not wish to make public.

9. Messaging and Collaboration Data

If you use Winkiloo messaging or collaboration features, we may process:

• Sender and recipient account identifiers
• Message content
• Message timestamps
• Read or delivery status
• Collaboration listings
• Collaboration requests and responses
• Moderation and abuse reports.

Messages are processed to deliver the communication requested by you, maintain platform functionality, enforce our Terms and protect users from abuse.

We do not use private creator messages for public display unless the users concerned expressly choose to publish the relevant information or disclosure is otherwise required by law.

10. Artificial Intelligence Features

Winkiloo may use artificial intelligence services to provide features such as:

• Channel analysis
• Video analysis
• Growth reports
• Title and description suggestions
• Thumbnail recommendations
• Creator recommendations
• Feedback summaries
• Translations
• Other AI-assisted creator tools.

When you use an AI feature, information relevant to your request may be transmitted to an AI service provider for processing.

Depending on the feature, this may include:

• Your prompt or instructions
• Channel or video information
• Analytics information
• Text that you ask Winkiloo to analyse or translate
• Other information necessary to generate the requested result.

Winkiloo currently uses or may use OpenAI API services for certain AI functionality. If the requested AI feature uses information obtained through an authorised Google or YouTube connection, only the information relevant to that requested feature may be sent for processing. Google OAuth access tokens, Google OAuth refresh tokens and Google account passwords are not sent to OpenAI.

Where OpenAI processes personal data on behalf of Winkiloo through the API, processing is subject to the applicable contractual and data-protection arrangements between Winkiloo and OpenAI.

According to OpenAI's current API data policies, inputs and outputs sent through the OpenAI API are not used to train OpenAI models by default unless the API customer expressly opts in to such data sharing.

Please avoid submitting unnecessary sensitive or confidential personal information to AI features.

11. Translation Features

Winkiloo may provide automated translation functionality for interface content, creator content, reports, emails or other text.

Text submitted for AI-assisted translation may be transmitted to the relevant AI provider solely for the purpose of generating the requested translation and related service functionality.

Translations may be stored in Winkiloo so that the same content does not need to be repeatedly translated.

12. Subscription and Billing Data

If you purchase a Winkiloo subscription, Creator Credits or another paid service, we may process:

• Customer name
• Email address
• Billing address where required
• Country
• Tax information where required
• Purchased plan or product
• Amount and currency
• Transaction identifier
• Subscription status
• Billing interval
• Payment-provider customer identifier
• Payment status
• Refund or chargeback information
• Invoice information.

Payments may be handled by third-party payment processors such as Stripe and/or PayPal, depending on the payment methods made available by Winkiloo.

Complete card details are generally provided directly to the payment processor and are not intended to be stored by Winkiloo.

Payment providers process information under their own contractual and privacy terms in addition to any processing carried out on our behalf.

13. Creator Credits

We maintain records relating to Creator Credits, including:

• Current credit balance
• Credits purchased
• Credits earned
• Credits awarded through referrals or promotions
• Credits spent
• Transaction dates
• Related campaign or account information
• Corrections, reversals or adjustments.

This information is processed to operate Winkiloo's internal credit system, prevent fraud, resolve disputes and maintain transaction records.

14. Referral and Affiliate Data

If you participate in a Winkiloo referral or affiliate programme, we may process:

• Your referral identifier or referral link
• Referred registrations
• Qualifying subscription or purchase events
• Reward eligibility
• Creator Credit rewards
• Fraud-prevention information.

We use this information to administer the referral or affiliate programme and prevent duplicate, self-referred or fraudulent rewards.

15. Email and Communications

We may use your email address to send service-related communications, including:

• Email verification
• Password-reset messages
• Security notifications
• Account notifications
• Billing and subscription messages
• Trial-expiry notices
• Weekly growth reports where enabled
• Collaboration or messaging notifications
• Referral notifications
• Important changes to the Service or legal documents.

These service communications may be necessary to perform our contract with you or to protect your account.

Marketing communications will only be sent where permitted by applicable law. Where consent is required, you can withdraw your consent at any time.

You can unsubscribe from optional marketing emails using the unsubscribe functionality provided in the message or through available account settings.

Essential transactional or security messages cannot always be disabled while your account remains active.

16. Contact Requests and Support

If you contact Winkiloo, we may process:

• Your name
• Email address
• Account identifier
• Subject and message
• Attachments you provide
• Support correspondence
• Technical information necessary to investigate the issue.

This information is used to answer your request, provide support and document relevant communications.

17. Server Logs, Security and Technical Data

When you access Winkiloo, our servers and security systems may automatically process technical information such as:

• IP address
• Date and time of access
• Requested URL
• HTTP response status
• Browser type and version
• Operating system
• Referrer URL where provided
• Session identifiers
• Login and authentication events
• Failed-login attempts
• Rate-limit events
• Error and diagnostic information
• Security and abuse indicators.

We process this information to deliver the website, troubleshoot technical problems, prevent attacks and fraud, investigate abuse and maintain the security and reliability of Winkiloo.

18. Cookies and Similar Technologies

Winkiloo uses cookies and similar browser-storage technologies.

Some cookies are technically necessary for the operation, security and functionality of the Service. These may include cookies or local-storage entries used for:

• Login sessions
• Authentication
• Security and CSRF protection
• Remember-me functionality
• Language preferences
• Cookie-consent preferences
• Other functionality explicitly requested by you.

Non-essential cookies or similar technologies will only be used where a valid legal basis and, where required, your consent exists.

You can manage applicable preferences through Winkiloo's cookie settings.

More information is available in our Cookie Policy.

19. Publicly Available Information

Certain information on Winkiloo is intentionally public.

This may include:

• Creator profile information
• Public channel information
• Public YouTube statistics
• Approved reviews
• Testimonials
• Public collaboration listings
• Other information explicitly submitted for publication.

Public information may be indexed by search engines, copied by third parties or remain visible in third-party caches after it has been removed from Winkiloo.

20. Sources of Personal Data

We obtain personal data from several sources:

• Directly from you
• From your use of Winkiloo
• From Google when you use Google authentication or OAuth
• From YouTube API Services
• From publicly accessible YouTube information
• From payment service providers
• From creators who interact with you through Winkiloo
• From referral or invitation functionality
• From technical and security systems.

21. Purposes of Processing

We may process personal data for the following purposes:

• Creating and maintaining Winkiloo accounts
• Providing creator profiles
• Providing channel and video functionality
• Verifying YouTube channel ownership
• Providing YouTube Analytics features
• Generating growth reports
• Providing creator discovery and campaign functionality
• Providing messaging and collaboration tools
• Providing AI creator tools
• Providing translation functionality
• Managing subscriptions and Creator Credits
• Processing payments
• Administering referrals and affiliate programmes
• Sending transactional communications
• Providing support
• Preventing fraud and abuse
• Protecting Winkiloo and its users
• Monitoring and improving platform performance
• Complying with legal obligations
• Establishing, exercising or defending legal claims.

22. Recipients of Personal Data

We do not sell your personal data or Google user data. We disclose personal data only where necessary for the purposes described in this Privacy Policy, where you request or authorise the disclosure, or where another lawful basis requires or permits it.

Depending on the features you use, recipients may include:

• Hosting and infrastructure providers
• Email-delivery and communications providers
• Google and YouTube in connection with their APIs, OAuth and related services
• Payment processors such as Stripe and/or PayPal for billing-related data
• AI service providers such as OpenAI when you request AI-powered functionality
• Security, fraud-prevention and technical support providers
• Professional advisers such as accountants, lawyers or auditors
• Competent authorities where disclosure is required or permitted by law.

Section 4.2 explains specifically the circumstances in which Google user data may be shared, transferred or disclosed and the categories of recipients that may process it.

Where a service provider processes personal data on our behalf, we use appropriate contractual and data-protection arrangements as required by applicable law and limit the provider's processing to the services it performs for Winkiloo.

23. No Sale of Personal Data

Winkiloo does not sell personal data or Google user data to data brokers, advertisers or other third parties.

Personal data is disclosed only where necessary for the purposes described in this Privacy Policy, where you have requested or authorised the disclosure, where required by law, or where another lawful basis exists.

24. International Data Transfers

Some of our service providers may process personal data outside Germany or the European Economic Area ("EEA"), including in the United States.

Where personal data is transferred to a country outside the EEA, we use an appropriate transfer mechanism where required by law.

Depending on the provider and destination, safeguards may include:

• An adequacy decision adopted by the European Commission
• The EU-U.S. Data Privacy Framework where the recipient is validly certified
• European Commission Standard Contractual Clauses
• Other legally recognised safeguards.

Additional safeguards may be implemented where necessary following assessment of the relevant transfer.

25. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable law.

Retention periods vary depending on the category of information and may include:

• Account data: generally retained while your account remains active and subsequently for a limited period where necessary for legal, security or dispute-resolution purposes.
• YouTube API data: refreshed or deleted according to applicable YouTube API Services policies.
• OAuth tokens: retained only while necessary for the authorised connection, unless earlier revoked or deleted.
• Billing and accounting records: retained for the period required by applicable tax and commercial-record-keeping law.
• Security and server logs: retained for a limited period appropriate for security, troubleshooting and abuse prevention unless longer retention is required for an investigation.
• Support correspondence: retained for as long as needed to handle the request and any related legal or contractual matters.
• Public content: generally retained until you delete it, close your account, withdraw publication where applicable, or the content is removed by Winkiloo.
• Backups: deleted or overwritten according to our backup-retention cycle.

Data may be retained for a longer period where necessary to comply with legal obligations, investigate fraud, enforce agreements or establish, exercise or defend legal claims.

26. Account and Data Deletion

You may request deletion of your Winkiloo account and associated personal data through available account functionality or by contacting us.

Following a valid deletion request, personal data will be deleted or anonymised unless continued retention is required or permitted by law.

Some information may remain temporarily in protected backups until those backups are overwritten in the ordinary backup cycle.

Information required for tax, accounting, fraud-prevention or legal-claim purposes may be retained for the applicable statutory period.

27. Your Rights Under the GDPR

Where the GDPR applies, you may have the following rights:

27.1 Right of Access

You may request confirmation of whether we process personal data concerning you and request access to that data.

27.2 Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete data.

27.3 Right to Erasure

You may request deletion of personal data where the applicable legal requirements are met.

27.4 Right to Restriction of Processing

You may request restriction of processing in circumstances provided by applicable law.

27.5 Right to Data Portability

Where applicable, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format and may have the right to transmit that information to another controller.

27.6 Right to Object

Where we process personal data on the basis of legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation.

You may object at any time to processing for direct-marketing purposes.

27.7 Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

27.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data violates applicable data-protection law.

28. Exercising Your Rights

To exercise a data-protection right, contact us.

We may need to verify your identity before responding to a request in order to protect personal data against unauthorised disclosure or deletion.

We will respond within the period required by applicable data-protection law.

29. Supervisory Authority

You may lodge a complaint with a competent supervisory authority, in particular in the EU or EEA Member State of your habitual residence, place of work or place of the alleged infringement.

Winkiloo's competent supervisory authority will depend on the final registered location and legal establishment of the controller.

30. Automated Decision-Making

Winkiloo may use automated systems to support functions such as fraud detection, campaign integrity, abuse prevention, creator analytics, recommendations or AI-generated insights.

Unless expressly stated otherwise, Winkiloo does not intend to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

If we introduce such processing in the future, we will provide the information and safeguards required by applicable law.

31. Children

Winkiloo is intended primarily for adult creators and users who are legally able to enter into contracts for the Service.

Winkiloo is not intended to knowingly collect personal data directly from children in circumstances where parental or guardian consent is legally required and has not been obtained.

If you believe that a child has provided personal data to Winkiloo contrary to applicable law, please contact us.

32. Data Security

Winkiloo uses technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Measures may include, as appropriate:

• Encrypted HTTPS connections
• Secure password hashing
• Role-based access controls
• Administrative permission controls
• Authentication and session controls
• CSRF protection
• Input validation
• Rate limiting
• Upload restrictions
• Security logging
• Backup procedures
• Restricted administrative access
• Periodic security review.

No internet service can guarantee absolute security. Users are also responsible for protecting their passwords and account credentials.

33. Personal Data Breaches

If Winkiloo becomes aware of a personal-data breach, we will assess the incident and take appropriate containment, investigation and remediation measures.

Where required by applicable law, we will notify the competent supervisory authority and affected individuals within the applicable legal timeframes.

34. Third-Party Websites

Winkiloo may contain links to third-party websites, YouTube videos, creator websites, social networks or other external services.

This Privacy Policy applies only to processing carried out by Winkiloo.

We are not responsible for the privacy practices of independent third-party websites. You should review their privacy policies before providing personal data.

35. YouTube Embedded Content

Winkiloo may display or embed YouTube videos or other YouTube content.

When YouTube content is loaded, information may be transmitted directly between your browser and YouTube or Google.

Where legally required, non-essential third-party content or associated storage technologies will be subject to appropriate consent controls before activation.

36. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Winkiloo, applicable law, third-party services or our processing activities.

The current version will always display its latest revision date at the top of the page.

Where a change materially affects how we process your personal data, we will provide additional notice where required by law.

37. Language Versions

Winkiloo may provide this Privacy Policy in multiple languages.

The English version is maintained as the source version for translation purposes. Translations are provided to improve accessibility and understanding.

Nothing in this section limits rights under mandatory data-protection or consumer-protection law.

38. Contact Us

If you have questions, concerns or requests relating to privacy or personal-data processing, Contact