1. Introduction
Welcome to CtrlViews (“we”, “us”, or “our”). CtrlViews is an AI-powered analytics and content planning platform for content creators on Twitch, YouTube, and Kick, accessible at ctrlviews.com.
This Privacy Policy explains what data we collect, why we collect it, how we process it, who we share it with, and what rights you have over your personal data. It applies to all visitors, registered users, and subscribers.
2. Data Controller
The data controller responsible for your personal data is CtrlViews. For privacy-related inquiries, please contact us at noreply@ctrlviews.com.
Note: CtrlViews does not currently publish a registered legal entity address. If you need to contact us in writing for a formal legal matter, please first reach out via the email above.
3. Data We Collect
3.1 Account Information
When you sign up or sign in (via email/password or Google OAuth), we collect your email address, display name, profile picture URL, and authentication identifiers managed by Supabase Auth.
3.2 Profile Data
Your display name (user-editable), language preference (Turkish or English), avatar URL, AI token balance, and calendar notification preference.
3.3 Platform Connection Data
If you choose to connect your Twitch, YouTube, and/or Kick accounts, we store your user ID and username on each platform, OAuth access and refresh tokens, granted scopes, and token expiry timestamps. Connection is optional and revocable at any time.
- Twitch (user:read:email, channel:read:subscriptions): Your Twitch profile and subscriber list (subscriber IDs, names, subscription tiers, gift status).
- YouTube (youtube.readonly, yt-analytics.readonly): Channel and video statistics (including unlisted/private videos), and YouTube Analytics data (views, watch time, estimated earnings, demographic breakdowns).
- Kick (user:read, channel:read): Your Kick profile and channel data (follower count, subscriber count, live status, category/game, VOD history).
3.4 Subscription and Billing Data
Subscription status and plan tier, and subscription lifecycle events received from our payment provider via webhooks. We do not store full credit card numbers, CVV codes, or complete payment instrument data on our servers.
3.5 Usage and Token Data
Logs of which AI features you used and when, and your token balance history.
3.6 Calendar and Scheduling Data
Content items added to your calendar: platform, category, game, title, description, scheduled date/time, duration, AI-generated production plans, and notification sent status.
3.7 AI Interaction Data
When you use AI features, we send your selected content parameters (platform, category, game, title, tags, duration, time slot, language), historical trend data from our database, and previously generated titles to OpenAI. We do not send your name, email, or account ID to OpenAI as part of AI prompts.
3.8 Guest Usage Data
Unauthenticated users may use limited AI features via a guest token stored in a browser cookie (guest-cookie). No personally identifiable information is collected from guests beyond this functional cookie.
3.9 Analytics Data
We use Vercel Analytics to collect aggregated, anonymized usage statistics (page views, referrer, browser/device type). This data is not linked to individual user identities.
3.10 Email Communications
We use Zoho SMTP (via noreply@ctrlviews.com) to send welcome emails, subscription confirmation/cancellation notifications, and calendar event reminder notifications (if enabled).
4. Purposes and Legal Bases for Processing
| Purpose | Legal Basis |
|---|---|
| Account creation and management | Contract performance |
| Authentication | Contract performance |
| Providing the core service (analytics, AI tools, calendar) | Contract performance |
| Payment processing and subscription management | Contract performance |
| Transactional emails (welcome, subscription, notifications) | Contract performance / Legitimate interests |
| AI feature generation | Contract performance |
| Token balance and usage logging | Contract performance / Legitimate interests |
| Aggregated analytics and product improvement | Legitimate interests |
| Security, fraud prevention, and abuse protection | Legitimate interests / Legal obligation |
5. Third-Party Services and Subprocessors
- Supabase — Database and authentication provider (data processor). Stores all account data, profile data, platform tokens, subscription records, usage logs, and calendar items. Operates on AWS infrastructure (EU or US depending on region). Privacy Policy
- Vercel — Hosting and serverless infrastructure (data processor). Processes request logs, IP addresses; Vercel Analytics collects aggregated usage data. Located in the US and global edge network. Privacy Policy
- OpenAI — AI language model provider (data processor). Receives AI prompt content including your content parameters and platform trend data. Located in the US. Privacy Policy
- Google (OAuth & YouTube API) — Identity provider and YouTube data API provider. Processes Google account identity for sign-in; YouTube channel and analytics data when connected. Located in the US. Use of Google API data is subject to the Google API Services User Data Policy, including Limited Use requirements.
- Twitch — Platform API provider. Processes Twitch account and channel data when connected via OAuth. Privacy Policy
- Kick — Platform API provider. Processes Kick account and channel data when connected via OAuth. Privacy Policy
- Zoho (SMTP) — Email delivery provider (data processor). Receives your email address and email content for transactional messages. Privacy Policy
6. International Data Transfers
Your personal data may be transferred to and processed in the United States and other countries by our subprocessors listed in Section 5. We rely on each provider’s own data transfer mechanisms (standard contractual clauses, adequacy decisions, or equivalent frameworks) for cross-border data transfers.
7. Data Retention
| Data Category | Retention |
|---|---|
| Account and profile data | Retained while your account is active. Deleted upon account deletion. |
| Platform connection tokens | Retained while the connection is active. Deleted when disconnected or account deleted. |
| Calendar items | Retained while your account is active. Deleted upon account deletion. |
| Usage and token logs | Retained while your account is active. Deleted upon account deletion. |
| Subscription records | Retained as required by applicable financial regulations and our payment provider’s merchant records. |
| Vercel Analytics data | Aggregated and anonymized; retained per Vercel’s data retention policy. |
| Guest cookie data | Expires with browser session or cookie expiry. |
8. Cookies and Local Storage
| Cookie / Storage | Purpose | Type |
|---|---|---|
| Supabase session cookie | Maintains your authenticated session | Necessary |
| guest-cookie | AI token balance for unauthenticated users | Necessary (functional) |
| CSRF state cookie | Prevents CSRF attacks during platform OAuth flows | Necessary (security) |
| Kick PKCE verifier cookie | PKCE code verifier for Kick OAuth flow | Necessary (security) |
| Vercel Analytics | Aggregated, anonymized usage analytics | Analytics |
We do not currently use advertising or marketing cookies.
9. Your Rights
Depending on your location and applicable law, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data. You can delete your account directly from your profile settings.
- Restriction: Request that we restrict processing of your data.
- Objection: Object to processing based on legitimate interests.
- Data Portability: Request a copy of your data in a machine-readable format.
- Withdrawal of Consent: Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, contact us at noreply@ctrlviews.com.
10. Children’s Privacy
CtrlViews is not directed at individuals under the age of 13 (or under 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at noreply@ctrlviews.com.
11. Security
We implement reasonable technical and organizational measures including HTTPS encryption, httpOnly session cookies, server-side-only OAuth token exchange (tokens are never exposed to the browser), and Row Level Security (RLS) on database tables.
Note: Platform OAuth tokens are currently stored in plaintext in the database. Encryption at rest for sensitive token columns is planned as a future security improvement.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the “Last Updated” date when changes are made. For material changes, we will make reasonable efforts to notify you.
13. Contact
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: noreply@ctrlviews.com
Website: https://ctrlviews.com