Privacy Policy

Shotpipe ("we", "us") is operated by Dani Giesen, sole proprietor, registered in the Netherlands. This policy explains what we collect, why, how we keep it safe, and your rights under the GDPR.

1. What we collect

Account information

• Your email address and password (password is stored hashed by Supabase Auth — we never see it).
• Account creation date and last login time.

Channel and content information

• YouTube channel URLs, handles, or IDs you connect.
• Publicly available channel metadata (video titles, thumbnails, view counts, dates) fetched via the YouTube Data API.
• Your channel's analytics (watch time, retention) when you authorise YouTube Analytics via Google OAuth.
• Video ideas, scripts, references, and notes you submit to generate briefs.
• Briefs, plans, and reports we generate for you.
• Competitors you add to your workspace.

Billing information

• Subscription status, trial end date, and renewal date.
• Stripe Customer ID. Stripe holds your payment card details — we never see or store full card numbers.

Technical information

• Server logs (IP address, user-agent, request path, status code, timestamp) retained for up to 30 days to debug issues and prevent abuse.
• Cookies: a session cookie to keep you logged in, and a channel-context cookie to remember your active channel. We do not use third-party advertising or analytics cookies.

2. Why we collect it

• To provide the Service to you (legal basis: contract).
• To bill your subscription (legal basis: contract).
• To send essential service emails — welcome, trial-ending reminder, payment-failed notice (legal basis: contract).
• To keep the Service secure and prevent abuse (legal basis: legitimate interest).

3. Who we share it with (sub-processors)

We use the following providers to operate the Service. Each is bound by a data-processing agreement and processes your data only on our instructions:

• Supabase (EU region) — account auth and database.
• Fly.io (Amsterdam region) — application hosting.
• Anthropic (Claude API) — AI processing of your prompts and references. Anthropic operates a zero-retention policy on our API requests.
• Stripe — payment processing.
• Resend (EU region) — transactional email delivery.
• Cloudflare — DNS and email routing.
• Google (YouTube Data API + YouTube Analytics API) — channel data on your behalf when you connect a channel or authorise OAuth.

We do not sell or rent your personal data to anyone, ever.

4. International transfers

Most of our processing happens within the EU (Supabase EU, Fly.io Amsterdam, Resend EU). Anthropic and Stripe process data in the US under Standard Contractual Clauses approved by the European Commission.

5. How long we keep it

• Account and generated content: while your account is active, plus 30 days after you delete it.
• Billing records: 7 years (Dutch tax law).
• Server logs: up to 30 days.
• Backups: rolling 30-day retention.

6. Your rights

Under the GDPR you have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your data — use Settings → Delete account, or email us.
• Export your data — email us and we'll provide a machine-readable archive.
• Object to processing based on legitimate interest.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise any of these rights, email dani@shotpipe.app. We respond within 30 days.

7. Security

We use industry-standard practices: HTTPS everywhere, hashed passwords (via Supabase), encrypted database at rest, principle of least privilege for service credentials, and regular dependency updates. No system is perfectly secure; if you spot a vulnerability please email dani@shotpipe.app and we will acknowledge within 48 hours.

8. Children

The Service is not intended for users under 16. We do not knowingly collect data from children.

9. Changes

We will email you when we make material changes to this policy and update the "Last updated" date above. Continued use of the Service after a change constitutes acceptance.

10. Contact

Privacy questions, GDPR requests, or anything else: dani@shotpipe.app.