Privacy Policy

1. Introduction

EndSpec ("we," "us," or "our") provides a Software-as-a-Service (SaaS) platform called ventress.app that uses artificial intelligence to generate YouTube scripts, titles, descriptions, and tags based on popular ones in similar categories (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service, and describes your rights related to your data. We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

EndSpec
Bucharest
contact@endspec.net

3. Information We Collect

We collect the following types of information:

Account Information:

When you create an account, we collect your:

• Name
• Email Address
• Username
• Password (stored in a secure, hashed format)
• Billing Information (if you have paid subscriptions): Credit Card Number (processed through a third-party payment processor - see Section 6), Billing Address.

Usage Data:

We automatically collect information about how you use the Service. This includes:

• Types of scripts generated (e.g., topic, style, length). *We do NOT store the full text of generated scripts unless you explicitly choose to save them.*
• Titles, descriptions, and tags generated for your content.
• Keywords and topics you input into the Service.
• Features you use within the Service.
• Date and time of your Service interactions.
• Your IP address.
• Device information (e.g., browser type, operating system).

YouTube Data:

When you connect your YouTube channel to our Service (with read-only access), we collect:

• Channel metrics such as likes, number of videos, number of comments, views, and similar analytics data
• Channel metadata necessary to provide our title, description, and tag generation services
• We strictly use this data only to provide, maintain, and improve our Service directly to you

We DO NOT use your YouTube data for any of the following purposes:

• Targeted advertising
• Selling to data brokers
• Providing to information resellers
• Determining credit-worthiness
• Lending purposes
• User advertisements
• Personalized advertisements
• Retargeted advertisements
• Interest-based advertisements

Analytics Data:

We use Google Analytics to collect information about the use of our Service.

• Google Analytics collects: IP address, pages visited, time spent on pages, referral sources, and other usage data.
• We do not combine Google Analytics data with personally identifiable information.
• Google's use of this data is governed by the Google Analytics Terms of Service (https://marketingplatform.google.com/about/analytics/terms/us/) and the Google Privacy Policy (https://policies.google.com/privacy).
• You can opt-out of Google Analytics:
  • By disabling cookies in your browser.
  • By using the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

Cookies and Similar Technologies:

We use cookies and similar technologies.

• Essential Cookies: Necessary for the Service to function (e.g., session management, security). You cannot opt-out of these.
• Performance/Analytics Cookies: (e.g., Google Analytics cookies) Used to understand how users interact with the Service. You can opt-out as described above.
• Functionality Cookies: Used to remember your preferences (e.g., language). You can control these through your browser settings.
• Advertising Cookies: WE DO NOT USE ADVERTISING COOKIES.

You can control cookies through your browser settings. See our Cookie Policy for more information.

Communications:

When you contact us (e.g., via email, support form), we collect:

• Your Name
• Your Email Address
• The content of your message and any attachments.

4. How We Use Your Information

Purpose	Legal Basis (GDPR)	Data Used
To provide and maintain the Service, including script generation and YouTube optimization features	Performance of a contract (our Terms of Service)	Account Information, Usage Data, YouTube Data
To improve the Service (including AI model training)	Legitimate interests (improving our product and user experience; we have balanced these interests against your data protection rights)	Usage Data, Analytics Data
To communicate with you (service-related)	Performance of a contract, Legitimate interests (keeping you informed about important updates and your account)	Account Information, Communications Data
To process payments (if applicable)	Performance of a contract	Billing Information (processed through Stripe or a similar third party service)
To comply with legal obligations	Compliance with a legal obligation	All data types, as required by law
To enforce our Terms of Service	Legitimate interests (protecting our rights and property)	All data types, as necessary
To send marketing communications	Consent (you will be asked to opt-in separately)	Email Address, Name

5. Sharing Your Information

We may share your information with the following categories of recipients:

• Service Providers:
  • Amazon Web Services (AWS) for cloud hosting (https://aws.amazon.com/privacy/)
  • Stripe for payment processing (https://stripe.com/privacy)
  • SendGrid for email delivery (https://www.twilio.com/legal/privacy)

These providers are contractually obligated to protect your data and only use it to provide services to us.

• Google: As described above, we share data with Google through Google Analytics.
• Legal Authorities: We may disclose your information if required by law or legal process.
• Business Transfers: In the event of a merger, acquisition, or similar transaction, your data may be transferred. We will notify you of any such transfer and your choices.
• With Your Consent: We may share your information with other third parties if you have given us your explicit consent.

Important Note: We do not transfer your YouTube data to third parties for targeted advertising, data brokering, information reselling, credit evaluation, lending, user advertisements, personalized advertisements, retargeted advertisements, or interest-based advertisements.

6. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy, and as required by applicable law.

• Account Information: Retained for as long as your account is active, and for 3 years after account closure for legal and accounting purposes.
• Usage Data: Retained for 2 years for analysis and service improvement.
• YouTube Data: Retained only as long as necessary to provide the Service to you. Upon disconnection of your YouTube account or account deletion, this data is deleted within 30 days.
• Analytics Data: Subject to Google Analytics' data retention policies.
• Communications: Retained for 1 year after the last communication.
• Billing Information: Retained for 7 years as required by tax and accounting regulations.

You can request deletion of your data as described in Section 8.

7. Data Transfers Outside the EEA

Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA), including the United States. We use Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection for these transfers. Data is transferred to Amazon Web Services (AWS) for cloud hosting and Stripe for payment processing.

8. Your Data Protection Rights (GDPR)

You have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can request correction of inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): You can request deletion of your data, subject to certain exceptions (e.g., legal obligations).
• Restriction: You can request that we restrict the processing of your data under certain circumstances.
• Data Portability: You can request to receive your data in a structured, commonly used, machine-readable format.
• Object: You can object to the processing of your data based on legitimate interests or for direct marketing.
• Withdraw Consent: If we process data based on your consent, you can withdraw your consent at any time.
• Lodge a complaint: You can contact the relevant Data Protection Authority (DPA).

To exercise these rights, please contact us at contact@endspec.net. We will respond to your request within one month (this period may be extended in complex cases, but we will inform you if this happens).

9. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS).
• Encryption of data at rest.
• Access controls and authorization procedures.
• Regular security assessments and vulnerability scans.
• Data breach response plan.
• Staff training on data protection.

While we strive to protect your data, no method is 100% secure.

10. Children's Privacy

Our Service is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated Privacy Policy on our website.
• Sending you an email notification (if you have provided your email address).

We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

EndSpec
Bucharest
contact@endspec.net