Privacy Policy

1. Controller and scope

Northwarden Ltd is the controller responsible for personal data processed through PeepTrend. This Privacy Policy explains how we collect, use, share, retain, and protect personal data when you use the website, account dashboard, emails, security systems, and related services.

Contact us about privacy at [email protected]. You can disconnect a YouTube channel or delete your account from the Profile page when you are logged in.

2. Personal data we collect

• Account data: email address, role, email verification status, theme preference, account timestamps, Terms and Privacy acceptance timestamps and document version, and authentication/session data. Passwords are stored only in a protected, non-readable authentication form; we do not store plain-text passwords.
• Registration and recovery data: pending registration records, password reset and password change records, six-digit verification code hashes, expiry times, attempt counters, IP address, and user agent. If you later start a paid trial or subscription, Stripe checkout/customer/subscription identifiers and status are stored for billing access.
• Security data: IP address, user agent, reCAPTCHA action and score metadata, rate-limit events, failed login counters, lockout state, security event logs, and abuse-prevention signals.
• Creator profile data: YouTube channel URL, channel ID, title, handle, thumbnail URL, subscriber count, video count, view count, preferred genres, preferred formats, average views, publishing cadence, language, and region where you connect a channel.
• Product usage data: opportunity filters, workflow states, saved/planned/published/dismissed items, notes, feedback, useful/not useful signals, and dashboard interactions.
• Generated idea data: opportunity context, prompt hash, model name, fit score, generated ideas, generated descriptions, hashtags, risks, raw model response, and generation status.
• Market and evidence data: public game metadata, Steam snapshots, YouTube search evidence, video statistics, channel statistics, score explanations, risk flags, and freshness metadata.
• Communications: emails and messages you send to us, support requests, and our responses.
• Technical data: device/browser information, logs, diagnostics, cookies, local storage, and similar technologies needed to operate, secure, remember preferences, record cookie choices, recover an active pending registration step, and improve the service.
• Analytics data, where permitted by your location and cookie choice: page views, button clicks, feature usage, approximate device/browser information, referrer/campaign information, consent or opt-out status, and similar product analytics events collected through Firebase/Google Analytics and Reddit Pixel where enabled.
• First-party aggregate analytics: we may count page views, CTA clicks, checkout attempts, feature usage, status codes, coarse country, coarse device class, route/page, and campaign labels in our own analytics database without storing IP addresses, email addresses, user IDs, cookie IDs, session IDs, raw user agents, or raw ad click identifiers.
• Advertising attribution data: if you arrive from a Google or Reddit ad, we may store ad click identifiers such as gclid, gbraid, wbraid, rdt_cid, or rdt_uuid, campaign parameters, landing page, referrer, and checkout/subscription identifiers so checkout-start, trial-start, and first-paid subscription conversions can be measured from browser events and server-side Stripe billing events. If analytics and ad-measurement cookies are not allowed, optional browser advertising tags are configured not to use advertising or analytics storage, and server-side ad conversion uploads are not sent for explicitly denied advertising analytics consent.
• Partner program data: if you apply for or participate in the PeepTrend partner program, we may process your application text, preferred promo code, audience and traffic-source descriptions, partner status, approved promo codes, RevShare settings, partner-link attribution, payout accounts, payout requests, payout status, payout notes, and commission ledger entries.
• Partner payout account details: if you add a payout account or request a payout, we may process beneficiary name, beneficiary address, IBAN, BIC/SWIFT code, bank name and address, correspondent bank BIC where needed, payout currency, payment purpose, payout amount, and payout status. Bank account details are encrypted while stored. When you delete a payout account, its stored bank details are deleted unless the account is tied to an active payout request. A payout request keeps an encrypted snapshot of the payout details selected for that request so we can maintain payment history, investigate disputes, and evidence completed or rejected payout decisions.
• Payment data: if billing is enabled, Stripe may process checkout, payment method, invoice, tax, fraud-prevention, dispute, refund, subscription, and transaction-support data as payment provider and merchant of record where applicable. We receive limited billing identifiers and subscription status, but we do not receive full card numbers.

3. Sources of personal data

We collect data directly from you when you register, log in, connect a channel, request a password reset, use dashboard features, or contact support.

We also collect data from service providers and public or third-party sources, including YouTube/Google services, Google Ads and Reddit Ads conversion systems where an ad click led to checkout, Steam/public game sources, OpenAI services, email delivery systems, hosting infrastructure, Firebase/Google Analytics and Reddit Pixel where enabled, observability systems, and Stripe where billing is enabled.

4. How we use personal data and lawful bases

• To create accounts, verify email addresses, authenticate users, provide the dashboard, save workflow states, and deliver requested features. Lawful basis: contract.
• To provide creator profile analysis, opportunity feeds, scoring, risk flags, market filters, generated creator ideas, and related product functionality. Lawful basis: contract and legitimate interests.
• To secure the service, prevent abuse, enforce rate limits, apply login lockouts, verify reCAPTCHA, investigate incidents, and maintain audit logs. Lawful basis: legitimate interests and, where required, legal obligation.
• To send transactional emails such as verification codes, password reset codes, account notices, security notices, and service messages. Lawful basis: contract and legitimate interests.
• To debug errors, monitor availability, protect infrastructure, and maintain product quality. Lawful basis: legitimate interests.
• To measure page views, CTA clicks, feature usage, and product behaviour through Firebase/Google Analytics. Lawful basis: consent where required, and legitimate interests where local law permits a notice-and-opt-out model for this measurement.
• To maintain first-party aggregate product and funnel metrics without user-level tracking, cookies, IP storage, or account identifiers, so we can understand service health, marketing page performance, checkout-start volume, free tool usage, and broad product behaviour. Lawful basis: legitimate interests in operating and improving the service.
• To measure Google Ads and Reddit Ads checkout-start, trial-start, and first-paid subscription conversions from browser checkout events, Stripe checkout events, and invoice events, attribute those conversions to ad clicks, prevent duplicate conversion reporting, and improve advertising spend. Lawful basis: legitimate interests, contract where the measurement is tied to checkout and subscription performance, and consent where required by applicable law or platform rules.
• To operate the partner program, review applications, create and manage promo codes, attribute partner traffic, calculate RevShare on eligible paid invoices, prevent self-referral or affiliate abuse, review payout requests, and keep commission/accounting records. Lawful basis: contract, legitimate interests, and legal obligation where accounting records are required.
• To manage trial setup, subscriptions, checkout, billing, invoices, tax, accounting, fraud prevention, refunds, payment disputes, account deletion subscription cancellation, and transaction support where paid billing is enabled. Lawful basis: contract, legitimate interests, and legal obligation.
• To send optional marketing communications where permitted. Lawful basis: consent or legitimate interests, depending on context and applicable law. You can opt out of marketing emails.
• To comply with law, respond to lawful requests, enforce our Terms, and protect our rights. Lawful basis: legal obligation and legitimate interests.

5. reCAPTCHA and automated abuse checks

We may use Google reCAPTCHA v3 for registration, login, password reset, and other sensitive actions. reCAPTCHA v3 runs in the background and returns a risk score and action metadata so we can detect automated traffic and abuse.

If the score, action, token, or other signal fails our checks, we may block or limit the request, temporarily block the IP/action pair, require a later retry, or record a security event. This is used for security and abuse prevention, not for advertising profiling by us.

6. Cookies, local storage, and similar technologies

We use cookies, local storage, and similar technologies where needed to provide the service, remember theme preference, maintain authentication state, support security controls, operate the dashboard, remember your cookie choice, recover an active pending registration step, and keep the service usable.

Strictly necessary storage is used where it is needed to provide a service you requested, keep the service secure, prevent abuse, remember your theme, remember your cookie settings, or return you to the same registration or billing step after a refresh or Stripe redirect.

If you arrive from a Google or Reddit ad, local storage may keep the ad click attribution needed to connect a later Stripe checkout, trial, or first paid subscription to that ad click. We keep this attribution for up to 90 days unless it expires or is replaced by a newer ad click.

If you arrive from an approved PeepTrend partner link or promo code, local storage may keep the partner code for up to 90 days so the discount can be applied automatically at checkout and partner traffic can be measured.

For visitors in countries where prior consent is required, optional analytics and ad-measurement storage is off unless you actively allow it. If you do not make a choice in those locations, we treat that as no storage consent and do not allow Google/Firebase analytics or ad-measurement cookies.

For visitors in countries where local rules permit analytics and ad-measurement storage with clear notice and opt-out controls, PeepTrend may enable those cookies by default until you turn them off. We currently use this model only for countries we have specifically reviewed, and we use prior opt-in for unknown or higher-risk jurisdictions.

If your browser sends Global Privacy Control or Do Not Track signals, PeepTrend does not enable analytics and ad-measurement storage by default.

We may load the Google tag in consent-denied mode so Google Consent Mode can receive limited cookieless measurement signals, such as page and checkout-start events, without using analytics or advertising storage where storage is not allowed. This helps us understand whether advertising leads to trial checkout starts while respecting your storage choice.

Where analytics and ad-measurement cookies are allowed by your choice or by the regional notice-and-opt-out model, Firebase/Google Analytics and Reddit Pixel may record page views, CTA clicks, trial checkout starts, feature usage, device/browser signals, approximate location or referrer/campaign data, and consent or opt-out status so we can understand and improve the product and measure ads. Google and Reddit may process this information according to their own service terms and privacy disclosures.

Separately, PeepTrend may use first-party aggregate analytics without cookies or user-level tracking to count broad product and funnel events. This layer is designed to exclude IP addresses, account identifiers, raw user agents, cookie IDs, session IDs, and raw ad click IDs.

You can change or withdraw your cookie choice at any time through the Cookie settings control in the website footer. If we add materially different advertising, marketing, or tracking technologies, we will request any fresh consent required by law before using them.

7. Sharing personal data

We do not sell personal data. We share personal data only where needed to operate, secure, support, improve, or legally protect the service.

• Hosting, database, Redis/cache, logging, monitoring, and infrastructure providers.
• Email providers, including SMTP delivery for verification and password reset emails.
• Google services, including reCAPTCHA v3 and the YouTube Data API.
• Firebase/Google Analytics, for analytics where you have granted consent or where local law permits a notice-and-opt-out model, and for limited Google Consent Mode measurement where storage is denied.
• Google Ads and Reddit Ads, where needed to measure checkout-start, trial-start, and first-paid subscription conversion events using ad click identifiers captured from ad visits. Reddit Conversions API uploads may include a Reddit click ID, Reddit UUID, hashed email address, event type, event time, event source URL, value/currency where relevant, and a deduplication conversion ID.
• Approved PeepTrend partners receive aggregated partner dashboard analytics and payout status for their own promo codes. We do not show partners your email address, payment method, full identity, raw IP address, or raw user-agent data through the partner dashboard.
• OpenAI or other AI providers used to generate creator idea packs.
• Steam/public game data sources and related public metadata providers.
• Stripe for paid checkout, payment processing, merchant-of-record services, tax, fraud prevention, disputes, refunds, subscription support, receipts, and transaction support where billing is enabled.
• Tax, accounting, and fraud-prevention providers where paid billing is enabled.
• Professional advisers, insurers, auditors, and legal authorities where necessary.
• A buyer, investor, lender, or successor if we are involved in a merger, acquisition, financing, restructuring, or sale of business assets, subject to appropriate safeguards.

8. YouTube API and Google services

When PeepTrend uses YouTube Data API services, we use YouTube and Google data only to operate creator research features such as channel profile analysis, YouTube evidence, creator supply checks, market filters, and generated creator idea context.

Use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google may process information under its own privacy disclosures. You can review the policies and API terms below.

9. International transfers

We may process and store personal data in the United Kingdom, the European Economic Area, the United States, and other countries where our providers operate.

Where personal data is transferred internationally, we rely on appropriate safeguards where required, such as adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, provider certification frameworks where valid, and related technical and organisational measures.

10. Retention

• Pending registrations that do not complete email verification are intended to expire within the applicable window and may be removed or replaced by a new registration attempt. If you later start a paid trial or subscription, Stripe checkout and billing records are kept only as long as needed for access control, billing, fraud prevention, accounting, tax, dispute handling, and subscription support.
• Password reset and password change codes are intended to expire after the verification window and are removed after use, expiry, replacement by a new code, or too many failed attempts.
• Account data is kept while your account exists and for a reasonable period after deletion where needed for legal, security, tax, dispute, or backup purposes.
• When you disconnect a YouTube channel, we remove the creator profile and channel-specific generated idea packs from your account.
• When you delete your account from the Profile page, we first attempt to cancel any active Stripe subscription, then delete the user account and product data tied to it, including creator profile, workflow, feedback, notes, generated idea packs, and saved account-level product data, unless retention is legally required or reasonably necessary for security, fraud prevention, dispute handling, accounting, backups, or abuse prevention.
• Cookie consent records are normally kept in your browser for up to six months unless you change your preferences sooner or we need fresh consent because purposes or providers materially change.
• Security logs, rate-limit records, captcha blocks, and authentication events are kept for as long as reasonably needed to detect abuse, investigate incidents, enforce Terms, and comply with legal obligations.
• Billing and accounting records may be kept for the period required by tax, accounting, and company law.
• Partner program records, including applications, approved promo codes, commission ledger entries, payout requests, payout status, payout account labels, encrypted payout-request detail snapshots, review notes, and related audit records, may be kept while needed for payout accounting, payment proof, fraud prevention, disputes, tax/accounting obligations, legal compliance, and partner-program administration. Partner payout account details are deleted when the partner deletes the saved payout account, unless the account is tied to an active payout request; historical payout requests keep their own encrypted detail snapshot.
• Backups and logs may persist for a limited period after deletion before being overwritten.

11. Your rights

Depending on your location and applicable law, you may have rights to access, rectify, erase, restrict, port, or object to certain processing of your personal data. Where processing is based on consent, you may withdraw consent at any time.

You can delete your account directly from the Profile page and can update cookie choices from the Cookie settings control in the website footer. For other rights requests or questions, contact [email protected]. We may need to verify your identity before responding. You also have the right to complain to the UK Information Commissioner's Office if you believe your data protection rights have been infringed.

12. Automated decision-making and profiling

Security systems such as reCAPTCHA, rate limits, and login lockouts may automatically limit, block, or delay actions to protect the service.

Opportunity scores, risk flags, creator fit, and generated ideas are recommendation and decision-support features for content planning. They are not used by us to make legal or similarly significant decisions about you.

13. Children

PeepTrend is intended for creators and businesses that can lawfully use a professional software service. It is not intended for children under 16. If you believe a child has provided personal data to us, contact [email protected].

14. Security

We use technical and organisational measures designed to protect personal data, including protected non-readable password storage, email verification, reset/change code expiry, request validation, rate limits, reCAPTCHA checks, login lockouts, security event logging, access controls, and encrypted transport where configured.

No online service can guarantee absolute security. You are responsible for keeping your password and devices secure and for notifying us if you suspect unauthorised access.

15. Changes to this Policy

We may update this Privacy Policy as the product, law, providers, or processing activities change. The latest version will be posted on this page with a new last updated date.

If a change is material, we will take reasonable steps to notify users, such as through the website, dashboard, or email.

16. Contact

Privacy questions and rights requests: [email protected].