01
Who we are and how to contact us
Owen Creative is operated by Owen Media Systems Ltd, a private limited company incorporated in England and Wales with company number 16779565 (“Owen Creative”, “we”, “us” or “our”). For the personal information described in this notice, Owen Media Systems Ltd is the data controller unless this notice states otherwise.
You can contact us through the representative who invited you to Owen Creative or by writing to:
Owen Media Systems LtdSkyview House, 10 St Neots Road
Sandy, Bedfordshire
United Kingdom, SG19 1LB
Please mark data protection correspondence “Privacy”. We have not appointed a data protection officer because we are not currently required to do so.
02
Scope of this notice
This notice applies to the Owen Creative website, account area, Google sign-in, YouTube connection, hosted Model Context Protocol (“MCP”) service, server-delivered playbooks, MCP App views and related support. It applies to authorised users and prospective users who interact with those services.
It does not govern YouTube, Google, Supabase, Railway, Anthropic, Claude or any other third-party service acting under its own purposes and privacy notice. Where you choose to send Owen Creative results to an AI client, that client’s provider will process the information under the arrangements between you and that provider.
03
Information we process
Account and identity information
When you sign in with Google through Supabase Auth, we may process your name, email address, profile image, authentication-provider identifiers, product-user identifier and sign-in/session information. We do not receive or store your Google password.
YouTube connection information
If you separately connect YouTube, we process the connected channel ID, channel title, channel image URL, uploads-playlist ID, granted read-only scopes, connection status, connection and validation timestamps, and an encrypted Google refresh token. One Owen Creative account may connect no more than one YouTube channel at a time.
Live YouTube API data
At your request, we retrieve available channel and video metadata, visibility, public counters, thumbnails, YouTube Analytics metrics, audience-retention reports, traffic, geography, audience age and gender, and other breakdowns supported by the YouTube Data API v3 and YouTube Analytics API v2. This may include information that is private to the channel owner.
Owen Creative does not maintain a historical warehouse of YouTube Analytics reports in the current service. API results are processed at request time in application memory, returned to your authorised client and not written to the application database as analytics history. Short-lived access tokens may be held in memory for the duration of a request. The AI client you choose may retain conversation content or results under its own settings, terms and privacy notice.
AI-client authorisation information
When you connect an AI application, Supabase’s OAuth service may process the client identity, requested scopes, redirect address, consent decision, grants, access tokens, refresh tokens and associated session data. Owen Creative uses this information to ensure that only clients you approve can request your channel data.
Provider-usage information
Before each outbound YouTube API request, we create a user-linked operational usage record. Section 11 explains the exact contents and permanent retention of this ledger.
Technical, security and support information
We and our infrastructure providers may process IP address, browser and device information, request headers, timestamps, session-cookie values, security events, error information and correspondence you send to support. Application logs are designed to exclude credentials, prompts, report rows, video titles and analytics values.
04
Where information comes from
We obtain personal information:
- directly from you when you sign in, connect or contact us;
- from Google and Supabase when they authenticate you and maintain your product session;
- from YouTube’s official APIs when you grant access and request an analysis;
- from the AI client you authorise when it makes an authenticated request on your behalf; and
- automatically from our application and hosting infrastructure when the service is used.
05
Why we use information and our lawful bases
| Purpose | Information | Lawful basis |
|---|---|---|
| Provide and administer your account and the service | Account, session, connection and client-authorisation data | Performance of our contract with you, or steps taken at your request before entering one |
| Retrieve and return your requested YouTube evidence | YouTube connection credentials and live API data | Performance of our contract with you |
| Secure the service and prevent misuse | Session, technical, consent and security information | Our legitimate interests in protecting users, credentials, systems and provider access |
| Meter provider usage and manage quota | Permanent provider-usage ledger | Our legitimate interests in provider accounting, quota reconciliation, service planning and abuse prevention |
| Provide support and resolve disputes | Account information and correspondence | Performance of our contract and our legitimate interests in operating and defending the service |
| Comply with law and enforce our terms | Relevant account, usage, security and correspondence data | Legal obligation and our legitimate interests |
You are not legally required to provide this information. However, we cannot create an account without authentication data, connect YouTube without the required read-only grant, or answer an analytics request without accessing the relevant YouTube API data.
06
How we access and use Google and YouTube data
Owen Creative uses YouTube API Services. Product sign-in and YouTube access are separate actions. Signing in creates your Owen Creative account; it does not give Owen Creative access to your YouTube channel. You must separately choose to connect YouTube.
The YouTube connection requests only the youtube.readonly and yt-analytics.readonly scopes. We use them only to identify the channel you control, verify that requested videos belong to it, retrieve current channel/video information and analytics, and return evidence-led read-only results to you through clients you approve.
Owen Creative cannot upload, publish, edit, comment on, change the visibility of or delete YouTube content. We do not use Google user data for advertising, sell it, train a general-purpose model on it, or permit unauthorised third parties to access it. Google credentials are never sent to your AI client.
Human access to Google user data is restricted to circumstances permitted by Google’s Limited Use requirements, such as when you give affirmative permission for support, when access is necessary for security or abuse investigation, or when required by law. Access is limited to authorised personnel with a need to know.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements, the YouTube API Services Developer Policies, and the Google Privacy Policy.
09
International transfers
Some service providers and AI clients may process personal information outside the United Kingdom, including in the United States. Where UK data protection law treats a transfer as restricted, we rely on an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer-risk assessment.
You may contact us using the details in section 1 for more information about the safeguard relevant to a particular transfer.
10
How long we keep information
| Information | Current retention approach |
|---|---|
| Product account and authentication data | While the account remains open. After closure, only information reasonably required for security, disputes, legal compliance and the permanent usage-ledger relationship is retained |
| YouTube connection and encrypted refresh token | Until you disconnect, revoke access, the grant becomes invalid, or the connection is otherwise terminated. The stored connection data is then deleted within the periods stated in section 14 |
| Live YouTube API results | Processed for the request and response; not persisted in the application database as analytics history |
| OAuth state and PKCE material | Valid for 10 minutes for completion and replay protection. Expired records are rejected and removed during normal cleanup |
| Authorised AI-client grants and sessions | Until revoked or expired, subject to Supabase OAuth session lifecycle and security requirements |
| Provider-usage ledger | Indefinitely; see section 11 |
| Security, infrastructure and support records | Only for as long as reasonably necessary for operational security, incident investigation, support, legal claims and provider obligations |
11
Permanent provider-usage ledger
We retain an append-only record of each YouTube provider request admitted on your behalf. Each row contains only a generated record ID, your Supabase product-user ID, a closed provider category, a closed operation category, a meter-policy version, a bounded unit count and a database-generated admission timestamp.
The ledger does not contain prompts, tool names or arguments, request URLs, credentials, channel or video identifiers, YouTube API responses, analytics, report rows, titles, metric values, request outcomes, latency, trace IDs, AI-client IDs or free-form metadata. It is operational product data rather than a copy of your YouTube data.
We retain this ledger indefinitely and keep it linked to the product user for provider quota reconciliation, product-usage accounting, security, capacity planning and potential future fair-usage controls. Disconnecting YouTube does not remove it. The current database restricts ordinary deletion of a Supabase Auth user while linked ledger rows exist.
This technical restriction does not remove any right you have under data protection law. Requests to object, restrict or erase will be assessed individually, taking account of the applicable lawful basis, our compelling legitimate grounds, legal obligations and the establishment, exercise or defence of legal claims.
12
How we protect information
We use organisational and technical safeguards appropriate to the nature of the service. These include server-derived user and channel authority, strict read-only YouTube scopes, one-channel enforcement, encrypted Google refresh tokens using AES-256-GCM, secure session-cookie settings, a host-only anti-forgery cookie for MCP consent, OAuth state and PKCE protections, explicit AI-client consent, access controls, input validation and structured-log redaction.
No internet service is completely secure. You are responsible for protecting your Google account, device, AI-client account and active sessions, and for notifying us promptly if you believe access has been compromised.
13
Your data protection rights
Depending on the circumstances and lawful basis, UK data protection law may give you the right to:
- request access to personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- request erasure of personal information;
- ask us to restrict how information is used;
- receive certain information in a portable format;
- object, on grounds relating to your particular situation, to processing based on legitimate interests; and
- withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing.
These rights are not absolute. We may need to verify your identity and may retain information where an exemption or overriding lawful ground applies. We normally respond within one month. You will not usually have to pay a fee, although the law permits a reasonable fee or refusal for requests that are manifestly unfounded or excessive.
To exercise a right, contact the representative who invited you or write to the address in section 1, identifying the account and request. We may ask for information needed to verify your identity before acting.
14
Disconnecting and deleting YouTube data
You can disconnect your channel from the YouTube connection page. This removes the saved Google grant and connection record and prevents new YouTube API access. You can also revoke Owen Creative from Google Account permissions.
You may request deletion of stored Google user data and YouTube API data through the representative who invited you or the contact details in section 1. After an in-product disconnect or a verified deletion request, we delete the applicable stored YouTube connection data as soon as possible and within seven calendar days. If you revoke access only through Google’s security settings, we delete it as soon as we receive and process notice of that revocation and no later than 30 calendar days afterwards.
Stored YouTube connection data means the channel ID, channel title, channel image URL, uploads-playlist ID, granted scopes, connection status, connection and validation timestamps, and encrypted Google refresh token. The current service does not persist analytics history. The provider-usage ledger described in section 11 contains no Google user data or YouTube API data and is governed separately.
Deleting data held by Owen Creative does not delete anything held by YouTube. To delete a channel, video, comment or other information on YouTube, you must use YouTube or another authorised client that supports that action.
15
Questions and complaints
Please contact us first so we have an opportunity to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office (“ICO”):
Information Commissioner’s OfficeWycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Further information is available at ico.org.uk/make-a-complaint.
16
Children
Owen Creative is a private professional service for YouTube creators and is not directed to children. You must be at least 18 years old to create an account or use the service. We do not knowingly collect personal information from children through the service.
17
Automated decision-making
Owen Creative does not make decisions based solely on automated processing that produce legal or similarly significant effects. The service returns channel evidence, deterministic calculations, coaching playbooks and presentation data to the AI client you choose. AI-generated interpretation is advisory; you decide whether to act on it.
18
Changes to this notice
We may update this notice to reflect changes in law, providers or the service. The latest version will be published on this page with a revised date. If we materially change how we access, use or share Google user data, we will provide an appropriate notice and obtain renewed agreement or consent where required before using the data for the new purpose.