Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

InnovationCraft UG (haftungsbeschränkt)
Im Vogelsang 22
56743 Thür, Germany
Email: support@brightbean.xyz

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

2. Services Covered

This privacy policy covers all services operated by BrightBean, including:

• BrightBean API: Our YouTube Intelligence API that provides structured data and analytics derived from publicly available YouTube content.
• BrightBean Studio: Our social media management tool that enables you to manage, schedule, publish, and analyze content across social media platforms.

Together, these are referred to as the "Service" throughout this policy.

3. Overview of Data Processing

3.1 What Data We Collect

We may collect the following types of personal data:

• Account data: Email address and name when you sign up for an API key, BrightBean Studio account, or waitlist.
• Google account data: Google profile information (name, email address, profile picture) received when you sign in with Google.
• YouTube data: YouTube channel information, videos, comments, ratings, and captions accessed through your linked YouTube account.
• Google Business Profile data: Business listing information accessed through your linked Google Business Profile.
• Usage data: API call logs, request timestamps, endpoints accessed, response codes associated with your API key, and activity within BrightBean Studio (e.g., scheduled posts, content drafts, and platform interactions).
• Technical data: IP address, browser type, operating system, and referring URL when you visit our website.
• Communication data: Content of emails or messages you send to our support address.

3.2 How We Use Your Data

We process your personal data for the following purposes:

• Providing, maintaining, and improving the BrightBean API service (using publicly available YouTube data only).
• Providing, maintaining, and improving BrightBean Studio (using your connected account data solely for the management features you have authorized).
• Authenticating your identity via Google Sign-In.
• Managing your account and API key, including monitoring usage against your plan limits.
• Managing, scheduling, posting, and editing YouTube videos and interacting with comments on your behalf.
• Managing your Google Business Profile listings on your behalf.
• Communicating with you about your account, service updates, and support requests.
• Ensuring the security and integrity of our service, including fraud prevention and abuse detection.
• Understanding how our website is used, so we know which pages are worth keeping — only where you have consented to analytics (see Section 5).
• Complying with legal obligations.

3.3 Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide our API service to you.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for service security, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for storage on your device): Where you have given explicit consent, such as website analytics (Section 5), authorizing access to your YouTube account or Google Business Profile via OAuth, or marketing communications. You may withdraw consent or revoke access at any time with effect for the future.
• Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with applicable laws.

4. Hosting and Server Log Files

Our website and API are hosted by third-party providers. When you access our website or API, the hosting provider automatically collects and stores information in server log files that your browser or client transmits. This includes:

• IP address of the requesting device
• Date and time of the request
• URL of the requested resource
• HTTP status code
• Browser type and version (for website visits)
• Referring URL

This data is processed on the basis of our legitimate interest in ensuring the stable and secure operation of our service (Art. 6(1)(f) GDPR). Server log files are retained for a maximum of 30 days and then deleted.

5. Analytics

Google Analytics is not loaded and no data is transmitted to Google unless and until you consent. When you first visit this website you are asked whether to allow analytics. If you decline, or simply do not answer, no request is ever made to Google and nothing is stored on your device beyond your answer itself.

If you consent, we use Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google acts as our processor under Art. 28 GDPR on the basis of the Google Ads Data Processing Terms.

With your consent, Google processes the following on our behalf:

• The pages you view on this website and the order in which you view them.
• The referring website or search term that brought you here.
• An approximate location (country, and usually region or city), derived from your IP address.
• Your device type, operating system, browser and screen size.
• Session timings, such as how long you stayed and where you left.

Your IP address. For visitors in the EEA, the connection terminates on Google servers within the EU. Google states that it does not log or store the IP address in Google Analytics 4 and uses it only to derive an approximate location before discarding it. However, making the request necessarily discloses your IP address to Google, which is why we ask before making it at all.

Transfer to the United States. Google Ireland Limited may pass data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. See Section 9 for the safeguards that apply.

What we have switched off. Google Signals, advertising features, remarketing and cross-device tracking are disabled on our property and stay disabled. We do not link this website's analytics to any advertising account, and we do not use it to build profiles or to target you.

Legal basis. Storing and reading information on your device requires your consent under § 25(1) TDDDG. The processing that follows is based on your consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, and withdrawing is as easy as giving it: use the "Cookie settings" control in the footer of any page. Withdrawal does not affect the lawfulness of processing carried out beforehand.

The data collected is retained in Google Analytics for 14 months and then deleted automatically. The cookies involved are listed in Section 12. You can also install Google's browser opt-out add-on, and further information is available in Google's Privacy Policy.

6. API and Studio Data Processing

The BrightBean API and BrightBean Studio are separate services with distinct data sources. Data from your connected accounts in BrightBean Studio is never used to power, train, or enhance the BrightBean API's intelligence features.

When you use the BrightBean API, we process the requests you make (including query parameters and endpoints called) to deliver the service. The API derives its data exclusively from publicly available YouTube content. We log API usage data (request timestamps, endpoints, response codes, and associated API key identifiers) for the purposes of rate limiting, billing, and service monitoring.

When you use BrightBean Studio, we process the content you create, schedule, and publish through the platform, as well as analytics data from your connected social media accounts, solely to provide the social media management features you have authorized.

7. Google API Services

BrightBean uses YouTube API Services and other Google API Services to provide core functionality. When you connect your accounts, we request specific permissions (OAuth scopes) to access data on your behalf:

7.1 Google Sign-In

We use Google Sign-In for authentication. This grants us access to your basic profile information (name, email address, and profile picture) to create and manage your BrightBean account.

7.2 YouTube API Services

BrightBean uses YouTube API Services. When you link your YouTube account, we request permission to:

• View your YouTube account information and channel data.
• Upload, edit, schedule, and manage your YouTube videos.
• View, create, edit, and delete comments, ratings, and captions on your behalf.

This data is accessed, collected, and stored solely to provide the YouTube management features you have authorized within BrightBean Studio. It is not used to power, train, or enhance the BrightBean API's intelligence features. We do not use YouTube data from connected accounts for advertising, and we do not share it with third parties except as described in Section 8 of this policy.

7.3 Google Business Profile

When you link your Google Business Profile, we request permission to view, edit, create, and delete your business listings. This data is accessed, collected, and stored solely to provide the Google Business Profile management features you have authorized within BrightBean.

7.4 Compliance and Revoking Access

BrightBean's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. For more information about how Google handles your data, see Google's Privacy Policy.

You can revoke BrightBean's access to your Google data at any time by visiting the Google security settings page or by disconnecting your account within the BrightBean application. Upon revocation, we will immediately stop accessing your Google data and delete all stored Google user data, including OAuth tokens and any cached YouTube or Google Business Profile data.

8. Data Sharing and Third Parties

We may share your personal data with the following categories of recipients:

• Hosting providers: For infrastructure and server operations.
• Payment processors: To handle subscription payments securely. Payment processors receive only the data necessary to complete transactions and are bound by their own privacy policies.
• Google Ireland Limited (analytics): Only if you have consented to analytics, and only the website usage data described in Section 5. If you have not consented, nothing is shared.
• Google: We send and receive data via Google APIs (YouTube Data API, Google Business Profile API) to provide the linked account features you authorize. Data shared with Google is subject to Google's Privacy Policy.

We do not sell your personal data to third parties. We only share data with third parties as described above or when required by law.

9. International Data Transfers

Some of our service providers, including Google, may process data outside the European Economic Area (EEA), in particular in the United States.

Google. Transfers to Google LLC in the United States are based on the EU-U.S. Data Privacy Framework, for which the European Commission issued an adequacy decision on 10 July 2023 and under which Google LLC is certified. Where the framework does not apply, transfers are based on the EU Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).

We are obliged to point out that, despite these safeguards, data transferred to the United States may in principle be subject to access by U.S. authorities under legislation such as Section 702 FISA and Executive Order 12333, and that the legal remedies available to you against such access may not correspond to those available within the EEA. Where a transfer to the United States depends on your consent, this residual risk is part of what you are consenting to.

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Retained for the duration of your account and deleted within 90 days of account closure, unless longer retention is required by law.
• API usage logs: Retained for up to 12 months for service monitoring and billing purposes.
• Server log files: Retained for up to 30 days.
• Communication data: Retained for as long as necessary to resolve your inquiry and for up to 3 years thereafter for legal purposes.
• YouTube and Google Business Profile data: Cached data from linked accounts is retained only while your account is active and the connection is authorized. Upon revocation or account closure, this data is deleted within 30 days.
• OAuth tokens: Retained while your account is active and your Google account is connected. Tokens are deleted immediately upon revocation or account closure.

11. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request information about whether and which personal data we process about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You may request that we restrict the processing of your data in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your personal data based on legitimate interests at any time.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at support@brightbean.xyz.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

12. Cookies and Local Storage

This website stores very little on your device, and nothing optional without your consent. The complete list is below.

How to withdraw or change your choice. Use the "Cookie settings" control in the footer of any page, or the button in Section 5 above. Your choice takes effect immediately: if you withdraw consent, analytics stops sending data and the _ga cookies are deleted. Changing your browser's cookie settings is not the withdrawal mechanism, and blocking cookies in the browser does not by itself stop the analytics request from being made — our consent control does.

If your browser blocks local storage, we cannot remember your answer between page loads, and you may be asked again. We will still honour your choice for as long as the page is open.

Third-party requests that are not tracking. Some of our free YouTube tools fetch data from YouTube after you submit a video or channel URL — for example thumbnail images from i.ytimg.com, or the YouTube player when you press play on an embedded video. These requests happen only in response to something you actively did, they are necessary to deliver the function you asked for, and they disclose your IP address to Google for that request. They set no cookies on our website. No such request is made simply because you opened a page.

Session cookies on our applications. When you sign in with Google to BrightBean Studio or the BrightBean platform, those applications set a session cookie to maintain your authenticated state. Those cookies are strictly necessary for a service you have expressly requested and are set on the application subdomains, not on this website.

13. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS/SSL), access controls, and regular security reviews.

14. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this page periodically.

15. Contact

If you have questions about this privacy policy or our data processing practices, please contact us:

InnovationCraft UG (haftungsbeschränkt)
Im Vogelsang 22
56743 Thür, Germany
Email: support@brightbean.xyz