Privacy Policy

1. Introduction

Videoster Inc. ("Videoster", "we", "us") is a corporation registered in Ontario, Canada, with its address at 3621 Southwick Street, Mississauga, ON L5M 7N9, Canada. We operate videoster.com, where video creators publish menus of fixed-price packages and companies book them.

This policy explains what personal data we collect, why, who processes it for us, how long we keep it, and what you can do about it. It covers creators, people at companies that book a package or join a collaboration room, people on a waitlist, creators who have never contacted us (Section 2), and visitors to our website.

We act as a data controller for the data described here. Depending on where you are, your rights come from the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended (CCPA/CPRA), or Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Section 7 sets out what each gives you.

2. Data We Collect

Creators who use Studio

• Account and sign-in: the email address you sign in with, and your session (Section 2, "Sign-in"). The country you live in, which decides your payment provider.
• Your channel: how you proved you own it — Google sign-in, or a one-time code we gave you to place in your channel description, which we store with your account and the channel. Your channel's public name, handle, description and statistics (subscribers, total views, number of videos), and the titles, lengths and dates of your recent uploads, read from YouTube's API.
• If you connect with Google sign-in: Google returns an authorization we store encrypted. We use it to read the share of views by country of your channel over the last 90 days (while you let your menu show it), and, for a video published in a collaboration, its views by country, from YouTube Analytics. See Section 5A.
• Your disclosure commitment: the name you type, your account email, the time, the version and a fingerprint of the text.
• Your menu: your handle, headline, language, topics, packages, prices, add-ons, start slots and example videos, and your typed signature of each package's standard terms, with its time and a fingerprint of the text.
• Payouts: to be paid you set up an account with the licensed payment provider for your country (Escrow.com or Airwallex), which verifies your identity, screens you against sanctions lists and takes your bank details on its own pages. We receive only the outcome — whether you are verified, whether the screening is clear, your payout currency and country, and the email address of your provider account — never your identity documents or bank details. For Escrow.com we open the account for you with the name and address from your tax form.
• Your US tax form: because neither provider collects it, we collect your Form W-8BEN or W-9 (name, country of citizenship, permanent address, date of birth, tax identification numbers, any treaty claim, your typed signature) or your entity's signed W-8BEN-E (uploaded file, entity name, country and address). It is stored encrypted and may be shown only to a company that has an agreement with you, because the paying company is responsible for tax withholding and reporting; each view is recorded. Our event record notes that a form was signed or viewed, its type, version and fingerprint — never its contents.

People at companies

• What you give at checkout: your company's name, ticker and exchange; your name, role and work email; the brief; the start slot and add-ons; your next results date if you give it; your answer about an offering quiet period; your signed affirmation about material non-public information; your typed signature of the order agreement; and the payment method you chose. No account is created; we keep a company record keyed by that email address.
• In the collaboration room: the names and work emails of colleagues added to the room, and who added them; the materials you provide; your comments and review decisions; your sign-off. Each is recorded with your name and the time.
• Payment: the amounts, the fees, the payment's status at the provider, and any refund. Payment itself happens on the provider's site; we never receive your bank or card details.

Brand teams (Premium)

• The team: the company name and ticker, and for each person invited: their email address, role (owner or member), who invited them and when, when they joined or were removed. A person joins by signing in with an email link sent to the invited address; we keep a session as for any sign-in.
• Billing: for Premium by card, Stripe's customer and subscription references, status and period dates (Stripe takes the card on its own pages; we never receive it); for Premium arranged with us, the period, a note of how it was agreed and whether it is invoiced manually, and which of our staff recorded it.
• Orders: which signed-in member booked an order, and which team it belongs to; a member can add an order they booked earlier with their own address to the team.
• Creator sourcing: what a member asks for (company, ticker, what is wanted, budget range, timing, languages, markets) and who asked; our team's internal notes, status, and which creators we contacted, how and when. We do not record what a creator said in reply.
• Exports: each download of the team's evidence packs or quarterly summary is recorded with who downloaded it.

What both sides create in a room

Drafts (text the creator pastes), links to cuts, comments pinned to a line of a draft or a moment of a cut, revision rounds and decisions, the creator's signed holdings declaration and no-trade commitment, the creator's signed confirmation of the in-video disclosure and the screenshot attached to it, the link to the published video, our disclosure check results, and the video's public view, like and comment counts. Everyone in the room can see all of this, and the order's record of it.

What is public

• A published menu at videoster.com/c/… shows the creator's name, channel and language, packages, prices, add-ons and open slots, the date the disclosure commitment was signed, the channel's public statistics with the date they were synced, example video titles and thumbnails, and past collaborations that have a disclosure page (the paying company, the package and the date). For a channel connected with Google sign-in, it also shows the share of views from the top countries over the last 90 days, unless the creator has turned off "Show where my viewers watch from". The creator directory lists published menus with a current commitment: name, headline, language, topics, starting price and whether the channel is verified.
• A disclosure page at videoster.com/d/… becomes public once the video for an order is registered, and may be indexed by search engines. It names the creator and links their channel, and shows the paying company, the company covered, the amount and form of the compensation, the package, the creator's holdings declaration and no-trade commitment, any public sources provided, the dates and our check results. It exists because the video itself is public and paid content must be disclosed. If a creator asks us to erase their data, the page stops naming them.

Nothing else on the site names a creator, and nothing public shows a company contact's name or email address.

Public channel data collected before any contact with us

We also hold records of YouTube channels built from publicly available sources — principally the YouTube Data API and public web pages — without the creator having any relationship with us: channel name, handle and description, recent video titles and descriptions, public subscriber and view figures, and business contact details published on the channel, with the page we found them on. We find finance channels through YouTube search and through channels other finance creators feature; a borderline case may be judged by Google's Gemini API (Section 5), and the titles read for that check are not kept. These records are not shown on any public page and are not shown to companies. A creator appears on the site only by publishing a menu themselves. If you would rather we did not hold such a record, see Section 7.

People who comment on a published video

For a video published in a collaboration, we may read up to 100 of its public comments to produce an automated summary of their sentiment and themes. We keep only the summary; the comments themselves, and the names of the people who wrote them, are not stored.

Waitlists and visitors

• Waitlist: if you join the waitlist for an industry that is not open yet, we keep the industry, your email address, whether you are a creator or a brand, and any note you add. We send nothing until that industry opens, and then email you once.
• Payments waitlist: if payments are not open yet for a creator you want to book, you can leave your email on their menu or checkout page. We keep your email address, the menu and the package. We send nothing until payments open for that creator, and then email you once.
• Enquiry data: whatever you type into our contact form.
• Sign-in: when you use a sign-in link we record the session, including your IP address and browser user agent. Sign-in links are single-use, expire after one hour, and are stored only in hashed form.
• Technical data processed to serve and protect the site: IP address, browser user agent, and request time. We use a hashed form of your IP address and email address to rate-limit the checkout, waitlist and sign-in forms.
• Bot protection on the sign-in page (Cloudflare Turnstile), which processes signals from your browser under Cloudflare's Turnstile privacy addendum.
• Cookies: see Section 8 and our Cookie Policy.

3. How We Use Your Data

• To operate the platform: Studio, menus, the directory, checkout, collaboration rooms, disclosure checks, disclosure pages and the record.
• To take payments through the provider and instruct it to release or refund them.
• To keep an audit trail, so that either side can show its counsel or a regulator what was signed, approved, checked and paid, and when.
• To communicate with you: sign-in links, order and room emails, payment notices, and service and security notices. A creator can stop order emails with the link in any of them.
• To protect the service: abuse prevention, rate limiting, fraud detection, and security investigation.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

4. Legal Basis for Processing (GDPR)

• Contract: Studio and menus, orders, rooms, payments and payouts, and the public disclosure page each order requires.
• Legitimate interests: holding records of public channels; summarising public comments on a published video for the parties to the collaboration; keeping an audit trail; protecting the service. We have weighed these against your interests, and you can object at any time under Section 7.
• Consent: connecting a YouTube channel, which you can withdraw at any time (Section 5A); joining a waitlist.
• Legal obligation: tax and corporate recordkeeping, including tax forms.

5. Third-Party Processors

We share personal data with the following providers, each acting on our instructions:

We may also disclose data to professional advisers, to a buyer in a corporate transaction, or where required by law or a regulator.

We do not use any analytics, advertising, or tracking provider.

5A. YouTube

Videoster uses YouTube API Services. By connecting your YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy. We request read-only access to your channel and its YouTube Analytics. We use it to confirm that you own the channel, to show the share of views by country on your menu (on by default; turn off Show where my viewers watch from in your studio, My menu → Your channel, and we hide it, delete the figures we stored and stop reading them), and to read views by country for a video published in a collaboration, which we show in that collaboration's room. We do not post, edit or delete anything on your channel.

You can withdraw this access at any time with Disconnect YouTube in your studio (My menu → Your channel), in your Google account permissions, or by emailing hello@videoster.com. When you disconnect in the studio, we revoke the authorization at Google, delete it, delete the views by country read for collaboration videos, and delete the channel statistics, views by country and video titles stored for your menu straight away; your menu is paused and no longer says "Channel verified" until you reconnect, or confirm the channel again with a description code. If you withdraw at Google or by email instead, we stop reading and delete the stored authorization and the views by country for collaboration videos, and remove the country figures from your menu when its figures are next refreshed (at least weekly). Deleting data we hold does not delete anything on YouTube; that is done in YouTube itself.

6. Data Retention

• Order and room records — the order, its agreement and signatures, room contents, payments, refunds, checks and the rest of the event record: retained for seven years, in line with US securities recordkeeping expectations.
• Account and menu data: retained for the life of the account and for three years afterwards, then deleted or anonymised.
• Brand team data (members, invitations, Premium periods, sourcing requests with our notes and contacts): for the life of the team and three years afterwards. Which team an order belongs to and who booked it are part of the order's record.
• Sessions, sign-in links and room access: a session lasts up to 30 days; a sign-in link expires after one hour; a room link keeps a browser signed in to that room for up to 120 days, and stops working when its holder is removed from the room.
• YouTube authorization: until you withdraw it or ask us to delete your data.
• Public YouTube data read with our own access to YouTube's API — channel names and descriptions, statistics, video titles and descriptions, including what a menu page shows: refreshed at least weekly, and deleted 30 days after it was read unless refreshed. Channels we checked and did not add are forgotten after 30 days.
• Collaboration videos: public counts are captured daily for 180 days after a video is registered. Figures read with the creator's own YouTube authorization are kept with the order's record; figures read with our own access are kept for 30 days. Comment summaries are kept for 30 days. Comments are never stored.
• Waitlist entries (industry and payments): until we email you that the industry or the creator's payments are open, or until you ask us to delete them.
• Billing and tax records: as long as tax and corporate law requires.
• Payout status: while you have a payout account and for seven years after the last payment to you.
• Tax forms: while you use the platform, and replaced when you sign a new one (a W-8BEN lapses at the end of the third calendar year after signing). If you ask us to erase your data, the form's contents and file are deleted; a note that a form of that type was signed remains in the record. Companies that already viewed it keep their own copy as their tax record.
• Audit trail: the record of actions is append-only and is not deleted. Where you exercise a right to erasure, we redact the personal data inside those records — replacing the values while leaving the structure, timestamps and sequence intact — and we log that redaction as its own entry rather than performing it silently.

7. Your Rights

Whichever law applies to you, you can contact us at hello@videoster.com and we will respond within the time that law allows (30 days under GDPR and PIPEDA, 45 days under the CCPA).

If you are in the EU, EEA or UK (GDPR), you may: access your data; correct it; have it erased; restrict how we process it; object to processing based on legitimate interests, including our holding a record of your public channel; receive your data in a portable format; and lodge a complaint with your supervisory authority.

If you are in California (CCPA/CPRA), you may: know what we collect and why; access it; correct it; delete it; and limit the use of sensitive personal information. We do not sell personal data or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front. We will not discriminate against you for exercising a right.

If you are in Canada (PIPEDA), you may: access your personal information, challenge its accuracy, withdraw consent subject to legal and contractual limits, and complain to the Office of the Privacy Commissioner of Canada.

Everyone in a room can read and download the order's record from the room.

Creators specifically:

• Take your menu down, straight away. Pause your menu in Studio. Your page and directory listing stop showing at once and nothing can be booked; orders already placed continue.
• Ask us to delete your data. Email hello@videoster.com from the address you sign in with, or, if you never used Videoster, with a link to your channel; we may ask you to confirm from a contact address published on that channel. Your menu, directory listing and name on disclosure pages are removed at once, and the data we hold about you is deleted or redacted as described in Section 6. Records of orders still in progress are kept until they close.

8. Cookies

We set two kinds of cookie, both strictly necessary: the session cookie that keeps you signed in after you use a sign-in link, and a room cookie, set when you open a collaboration room link, that keeps you signed in to that room only. We set no analytics cookies and no advertising cookies, and we do not track you across other websites. Full detail is in our Cookie Policy.

9. International Data Transfers

We are based in Canada. Our application database and file storage are held by Cloudflare in Eastern North America. The website itself is served from Cloudflare's global network, so a request may be handled in a data centre near you. Our email, payment and Google providers operate in the United States and globally. If you are in the EEA or UK, this means your data is transferred outside your region.

Where that happens we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), together with our providers' own transfer frameworks. Canada also benefits from a European Commission adequacy decision for commercial organisations subject to PIPEDA. You can ask us for detail on the safeguards that apply to a specific transfer.

10. Security Measures

The database is reachable only through our application and through the accounts of the people who run the service. Sign-in links are stored hashed and expire after an hour; room links are stored only as hashes and never written into the event record; YouTube authorization tokens and tax forms are stored encrypted. Data is encrypted in transit, and at rest by our infrastructure provider. Payment card and bank data never reach our systems. Forms and sign-in are protected by rate limiting and bot detection.

No system is perfectly secure, and we do not claim otherwise.

11. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the risk is high. Notification will describe what happened, what data was involved, what we are doing about it, and what you can do.

12. Children's Privacy

Videoster is not for anyone under 18. We do not knowingly collect personal data from anyone under 18, and we will delete it if we discover we have.

13. Changes to This Policy

We may update this policy. Material changes will be notified by email to the people we hold an address for at least 30 days in advance, and the date at the top of this page will change. Please check it periodically.

14. Contact

Privacy questions, requests and complaints, general support and legal notices: hello@videoster.com

Videoster Inc. 3621 Southwick Street, Mississauga, ON L5M 7N9, Canada