Privacy policy

This policy explains what happens to personal data in connection with two things: the website you are reading now, and Prompt & Ship Publisher, the private application used to publish and measure the channel's videos. It is written to be read, not to cover the author, so if something is unclear please ask.

Who is responsible

The data controller is Damien Yvert, an individual based in Portugal, operating the Prompt & Ship AI Lab channel and this website as a sole person. There is no company behind it and no data protection officer is required.

Contact for anything in this policy: damienyvert.dev@gmail.com.

Because the controller is established in the European Union, the General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and Portuguese law 58/2019 apply.

This website collects no personal data

• There are no cookies. The site sets none, first party or third party.
• There is no analytics and no tracking: no Google Analytics, no Meta pixel, no heatmaps, no session recording, no fingerprinting.
• There are no forms. Nothing on this site stores anything you type, because there is nothing to type into. The only way to reach the owner is the email address above, which is an ordinary mailbox.
• There are no third party requests. Fonts are served from this domain, icons are inline, and there is no embedded player, no embedded feed and no content delivery network other than the host.
• There is no advertising, no user account, no login and no newsletter.

The site is a set of static files hosted by Vercel Inc., acting as a processor. Like any web host, Vercel's infrastructure processes standard server and request logs, which can include your IP address, the requested URL, the time of the request, the referrer and your browser user agent. These logs exist for delivery, security and abuse prevention and are handled under Vercel's own terms. See the Vercel privacy policy. The owner does not use these logs to build profiles and does not combine them with any other data.

If you open the channel on YouTube or Instagram from a link on this site, you leave this site and the policies of those platforms apply from that point on.

The Prompt & Ship Publisher application

Prompt & Ship Publisher is an internal tool, used only by the owner, on the owner's own YouTube channel and the owner's own Instagram professional account. It is not a product, it is not offered to anyone else, there is no sign up, and it has no users other than the owner. Its only job is to upload the videos this channel produces and to read back how they performed.

As a consequence, the application does not collect data from other users. The only account credentials it holds are the owner's own. The only account statistics it reads are the owner's own. If you watch or follow the channel, nothing in this application is about you personally: the numbers it reads are aggregated audience statistics produced by the platforms themselves, which is the same information the platforms show in their own dashboards.

YouTube API Services

Prompt & Ship Publisher uses YouTube API Services. Specifically it uses the YouTube Data API to upload videos to the owner's own channel and to set their title, description, tags, thumbnail, visibility and altered content disclosure, and the YouTube Analytics API to read that same channel's performance.

What data is accessed

• Authorisation data: an OAuth 2.0 access token and refresh token for the owner's Google account, plus the identifier of the authorised YouTube channel.
• Channel and video metadata: video identifiers, titles, descriptions, publication dates, privacy status and upload status for videos on the owner's channel.
• Channel analytics: views, watch time, average view duration, audience retention curves, impressions and click through rate, subscribers gained and lost, traffic sources, and device or geography breakdowns. These are the aggregated reports YouTube itself computes. The application does not request, and YouTube does not provide, the identity of individual viewers.

How that data is used

For one purpose only: to publish the channel's videos and to analyse their performance so that future videos are better. In practice that means deciding which topics to cover again, which opening seconds keep people watching, and which formats to stop making. The data is not used for advertising, not used to target anyone, not used to build profiles of viewers, and not used to train artificial intelligence or machine learning models.

How that data is stored and for how long

• Credentials (access and refresh tokens, client secrets) are kept in an encrypted secrets store, encrypted at rest, reachable only by the owner's own pipeline and never written to logs. They are retained until the owner revokes them or the tool stops being used, and are deleted when either happens.
• Aggregated metrics are stored in a private database that only the owner can access, protected by access controls and encrypted at rest. They are retained for up to 24 months, then deleted or kept only as totals that identify no one.
• The application stores no YouTube data about third parties beyond what is described in the section on public comments below.

Sharing

No data obtained from YouTube API Services is shared with, sold to, or transferred to any third party. It is not sold, rented, traded, used for advertising, or passed to data brokers, information resellers or model training providers. The only parties that ever see it are the owner and the infrastructure providers strictly necessary to run the tool (hosting and database), who act as processors under contract and may not use it for their own purposes.

How to revoke access

Access granted to this application through a Google account can be removed at any time from the Google security settings page: https://security.google.com/settings/security/permissions. Revoking access immediately stops the application from reading or writing anything on that account.

Google API Services User Data Policy

Prompt & Ship Publisher's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: the data is used only to provide and improve the publishing and analytics features described above; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for serving advertising; it is not used to train generalised artificial intelligence or machine learning models; and no humans read it except the owner, with your permission, for security purposes, or where required by law.

Instagram and Meta

Prompt & Ship Publisher uses the Instagram API to publish Reels to the owner's own Instagram professional account and to read that same account's insights. As with YouTube, the only authorised account is the owner's.

• What is accessed: an access token for the owner's Instagram professional account, the account identifier and username, media identifiers and captions of the owner's own posts, and the insights Instagram computes for that account and those posts (reach, views, likes, comments and saves counts, shares, follower count, profile visits, follows).
• How it is used: to upload and publish Reels, to apply the AI content label, and to measure how posts performed in order to improve future ones. Nothing else.
• How it is stored: tokens in the same encrypted secrets store, insights in the same private database, both reachable only by the owner.
• Retention: insights for up to 24 months, tokens until revoked or expired, after which they are deleted.
• Sharing: none. Data obtained from the Instagram API is not shared with, sold to, or transferred to third parties, is not used for advertising, and is not used to train models.

How to revoke access. In the Instagram app, open Settings, then Website permissions, then Apps and websites, and remove the application. For an account managed through a business portfolio, open Meta Business settings at business.facebook.com/settings and remove the app's access there. Meta's own practices are described in the Meta Privacy Policy and the Instagram Privacy Policy.

Instructions for asking for a check or a deletion are on the data deletion page.

Public comments on videos and posts

If you comment on a video or a post, that comment is published on YouTube or Instagram and it stays governed by the policies of those platforms, not by this one. The platform decides how it is stored, moderated and displayed.

Prompt & Ship Publisher may read the public comments on the owner's own posts for one reason: to measure engagement, for example how many comments a video received and what subjects keep coming up, so that the next videos answer real questions. When comment text is read it is used in aggregate, it is not republished elsewhere, it is not used to profile you, it is never sold, and any working copy is deleted within 30 days. If you delete your comment on the platform, it is no longer available to the application either.

The owner may of course also read and reply to comments manually, as any channel owner does.

If you write to us

When you send an email to damienyvert.dev@gmail.com, the message, your email address and anything you choose to include are processed for the sole purpose of answering you. The mailbox is a standard Gmail mailbox, so Google acts as the mail provider. Messages are kept for as long as needed to deal with the matter and for up to 12 months afterwards, except where a longer period is required to show that a legal request was handled.

Legal bases for processing

• Server logs of this website (Article 6(1)(f) GDPR, legitimate interests): keeping the site available, diagnosing faults and preventing abuse. The interest is limited, the data is not enriched, and you can object as described below.
• Publishing to the owner's own accounts and reading their statistics (Article 6(1)(f) GDPR, legitimate interests, and Article 6(1)(b) for the owner's own relationship with the platforms): running and improving an educational channel. Where the data is the owner's own, the owner is also the data subject.
• Reading public comments in aggregate (Article 6(1)(f) GDPR, legitimate interests): understanding what the audience asks for. The data is already public, the use is limited to measurement, and you can object.
• Answering your emails (Article 6(1)(f) GDPR, or Article 6(1)(b) where you ask for something that amounts to a service, or Article 6(1)(c) where the law requires an answer, such as a data subject request).

There is no processing based on consent, because nothing here asks for consent, and there is no automated decision making or profiling that produces legal effects for you.

International transfers

The service providers involved (Vercel, Google and Meta) are established in the United States and may process data there or in other countries. Those transfers rely on the safeguards those companies put in place, in particular the EU US Data Privacy Framework and the European Commission's standard contractual clauses, as described in their own privacy policies linked above. The owner does not transfer data outside the European Economic Area by any other route.

Your rights

Under the GDPR you have the right to:

• Access the personal data held about you;
• Rectification of data that is wrong or incomplete;
• Erasure of your data, where the law allows it;
• Restriction of processing while a dispute is settled;
• Objection to processing based on legitimate interests, including the uses described above;
• Portability, that is to receive the data you provided in a structured, commonly used and machine readable format.

The right to withdraw consent is not listed because nothing here runs on consent, as explained in the section on legal bases. If that ever changes, the right will be added here at the same time.

To use any of these rights, email damienyvert.dev@gmail.com. Requests are answered within 30 days, and in any case within the one month required by Article 12(3) GDPR, extendable by two further months for complex requests, in which case you will be told why. There is no charge. You may be asked for enough information to find your data, for example the username that left a comment, and for nothing more than that.

Note that data held by YouTube, Instagram or Meta about your own account is controlled by those companies: requests about it should go to them directly, through their privacy tools.

If you are not satisfied, you have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt, or with the authority of the country where you live or work.

Children

The channel and this website are not directed at children under 13, and in the European Union not at children under 16. The content is made for adults at work. The channel is not designated as made for kids, and neither the website nor the application knowingly collects or processes personal data relating to children. If you believe a child's data has reached the owner, write to damienyvert.dev@gmail.com and it will be deleted without delay.

Changes to this policy

This policy may change when the tools or the platforms change. The date at the top always shows the version in force, and any substantive change will be reflected there. Previous versions are not archived publicly, so if you need the wording as it stood on a given date, ask for it by email.

Questions, requests or corrections: damienyvert.dev@gmail.com.