Privacy Policy
1. Controller
Francisco Garcia Poncetta, Neuhausen, 80638 München, Germany. Email: frangponcetta@gmail.com.
2. Hosting
The site and database run on Lovable Cloud (built on Supabase and cloud hosting providers). When you visit, your IP address is processed to deliver the site. For free audits we store only a one-way hash of your IP address, to limit abuse. Legal basis: Art. 6(1)(f) GDPR.
3. Free audits
When you enter a channel, we read public YouTube data: video titles, descriptions, view counts, thumbnails and the links in descriptions. We check those links automatically. Results are stored so they can be reopened. Legal basis: Art. 6(1)(f) GDPR.
4. YouTube API Services
SponsorGuard uses YouTube API Services. By using SponsorGuard you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's Privacy Policy applies to that data: https://policies.google.com/privacy
5. Sign-in
If you sign in with Google, we receive your name, email address and Google account ID, to give you access to your reports and dashboard. Legal basis: Art. 6(1)(b) GDPR.
6. Payments
Purchases are processed by Stripe, which acts as merchant of record and processes your payment details under its own privacy policy (https://stripe.com/privacy). We receive your name, email, country, plan, subscription status and the channel you entered at checkout. Legal basis: Art. 6(1)(b) GDPR, plus Art. 6(1)(c) GDPR for records we must keep by law.
7. AI email drafts
When you ask for a recovery email draft, the video facts (title, views, link, brand) are sent to an AI model (OpenAI, accessed through the Lovable AI gateway) only to generate the draft. Legal basis: Art. 6(1)(b) GDPR.
8. Agency inquiries
If you send the inquiry form, we use your name, email and roster size to reply. Legal basis: Art. 6(1)(b) GDPR.
9. Business contact details from public channels
When we audit a channel, we may note the business email address the creator publishes in their YouTube descriptions for inquiries. We may use it to send that creator their audit results once. Source: public YouTube video descriptions. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in informing creators about issues on their own channel). You can object at any time by replying "no thanks" to any email. We then delete your address and won't contact you again.
10. Recipients and transfers
Our service providers are Lovable, Supabase, Google, Stripe and OpenAI. Some of them process data in the USA. Transfers rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.
11. Cookies and storage
We use only technically necessary storage: your sign-in session and small preferences, such as your free draft counter. No advertising and no tracking cookies.
12. Retention
Account and report data is kept while your account is active and deleted on request. Payment records are kept as long as tax law requires (up to 10 years). Outreach contacts are deleted on objection, or after 12 months without a reply.
13. Your rights
You have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interest (Art. 21 GDPR). Email frangponcetta@gmail.com. You can also complain to a data protection authority. The authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach.
Last updated: October 2026