Privacy Policy

# Profluence Privacy Policy Profluence respects your right to privacy. This Profluence Privacy Policy explains who we are, how we collect, share and use data about you and how you can exercise your privacy rights. Our Privacy Policy applies to your use of Profluence Services and Products, and our use of personal information as you use those Services and Products. This Privacy Policy is considered part of your total Agreement with Profluence in combination with our other terms and policies. ## 1. Scope This policy applies to the Profluence website, applications, APIs and services. ## 2. Who We Are Profluence is an AI-powered creator and brand intelligence platform. ## 3. Controller vs. Processor In connection with the provision of Services to our subscribers, Profluence acts as a Processor/Service Provider when processing Customer Data on behalf of Subscribers under applicable data processing laws. Subscribers are considered Data Controllers (EU and UK laws), and remain responsible for personal information processing, while Profluence acts on behalf of subscribers. When processing information for itself as a business, Profluence is a Data Controller. If Profluence processes Customer Data as a Processor, the Profluence Data Processing Addendum applies. ## 4. Information We Collect We collect numerous forms of information from Subscribers, Authorized Users, publicly available information or profiles of non-Subscribers, and visitors to our website. Account, billing, connected social accounts, public-source intelligence, uploaded content, usage logs, AI-generated insights, support communications, beta testing, device information, Subscriber feedback, and Customer Care interactions. ## 5. Profluence Intelligence ### 5.1 Proprietary Intelligence Profluence combines Connected Data, publicly available information, machine learning, statistical analysis, and proprietary algorithms to generate intelligence products, including forecasts, relationship maps, opportunity scores, sentiment analysis, volatility indicators, classifications, recommendations, and other derived insights ("Proprietary Intelligence"). While Subscribers retain rights in the data they provide and third parties retain rights in their own content, the analytical methodologies, derived intelligence, scoring models, classifications, and other platform-generated intelligence constitute valuable proprietary assets of Profluence. Access to and use of such intelligence is governed by the applicable subscription plan, Terms of Service, and other contractual terms. ### 5.2 Artificial Intelligence Profluence uses artificial intelligence to assist Subscribers by: - identifying patterns - generating summaries - forecasting trends - detecting emerging narratives - identifying sponsorship opportunities - producing recommendations AI assists Subscribers in interpreting available information. AI-generated content is probabilistic and should not be relied upon as legal, financial, medical, or professional advice. Subscribers remain responsible for decisions they make using our Services. ### 5.3 Publicly Available Information Profluence may collect, index, analyze, organize, summarize, and display information obtained from publicly available sources, including: - news publications - public websites - public social media - public government records - public APIs - other publicly accessible online content Profluence does not claim ownership of publicly available content. Rather, Profluence processes that information to generate intelligence, insights, analytics, and predictions for Subscribers. ### 5.4 Relationship Intelligence Profluence may organize information using ontology-based relationship mapping. This allows the platform to identify relationships, patterns, entities, events, topics, audiences, products, organizations, brands, creators, and other connections that may not be immediately apparent from individual data points. Relationship intelligence is generated algorithmically and is intended solely to assist Subscribers in understanding available information. ### 5.5 Predictive Analytics Certain Services provide forecasts, probability scores, opportunity rankings, sentiment projections, launch timing recommendations, volatility indicators, and other predictive analyses. These predictions are based on historical information, publicly available information, Subscriber information, and proprietary analytical models. Predictions are estimates only. Actual outcomes may differ. ### 5.6 Export of Data from Profluence Certain intelligence, analytics, reports, and other platform-generated content may be subject to export limitations based upon the Subscriber's subscription plan. These limitations are intended to protect the integrity of the Services and Profluence's proprietary methodologies. ## 6. How We Use Information We use the data we collect to provide services, analytics, AI insights, scheduling, security, support, compliance, product improvement. Customer Data is not used to train general-purpose AI absent express disclosure and authorization. Where we collect your information for business purposes, we are the Controller, and we may use your information for: - Operating and improving our website and application Services and Products - As part of providing Services or Products - Process subscriptions, feedback, customer care, reviews, and analysis - Custom profile building to assist you in gaining insights and improve the services we make available - Analyzing and tracking user preferences and areas for product or service improvement - Communicating with Subscribers about Products and Services - Processing of job applicants - Business critical operational processes such as billing, legal, reporting, and fulfillment Where we collect data from you or on your behalf in connection with the services or products, we are a data processor or service provider. Notwithstanding the above, we may use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law. ## 7. Sharing Some information is shared as required to receive sub-processor services, such as those related to: Infrastructure, payment, AI, security and support providers, all of which is done under contract; legal disclosures; business transfers with confidentiality terms. We may share Subscriber or Creator information, who use the Services in order to effectively provide our matchmaking services, market segmentation features, and to manage their account. By example, we may share information with Brand Subscribers about creators who use the Services in order to help them identify, connect, and collaborate. Where compelled by applicable law, court order, regulation, or contract, we may share your information with competent law enforcement or jurisdictional bodies. In rare circumstances where we are undergoing a merger and/or an acquisition. We may use or share your non-sensitive data if you are an entrant in a contest or sweepstake. Further, we may share your information in a de-identified or aggregated format except as prohibited by law. A current list of our subprocessors is available in the Trust Center at /trust/legal/subprocessors. ## 8. International Transfers Transfers may occur using lawful safeguards such as SCCs where required. ## 9. Retention We retain your data only as long as necessary; we delete or anonymize data when no longer needed, subject to legal obligations. ## 10. Security We use standard security controls and methods to protect your data, including: encryption, MFA, RBAC, logging, monitoring, vulnerability testing, and HIBP checks where implemented. ## 11. Privacy Rights You have access, correction, deletion, portability, objection, restriction, appeal, subject to applicable law. Processor requests are forwarded to the relevant Controller. - **Right to Access, Correct, and Delete.** You may request access to, correction of, or deletion of your personal information at any time by contacting us at privacy@pro-fluence.com. If you submit a request to delete your information, this may limit your ability to use the Site and/or Services and Products. If you have authorized us to access your data via the YouTube API Services, you may also revoke our access to your data via the Google security settings page at https://security.google.com/settings/security/permissions. - **Right to Opt Out of Marketing Communications.** You may opt out of marketing communications at any time by clicking the "unsubscribe" or "opt-out" link in the marketing emails we send you. Please note that your opt out is limited to the email address, device, and phone number used and will not affect subsequent subscriptions. - **Right to Withdraw Consent.** If we have collected and processed your information with your consent, you may withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your information conducted in reliance on lawful processing grounds other than consent. If you are a resident of California, Colorado, Virginia, or another US state with applicable privacy legislation, you may also exercise the following rights: - **Right to Know.** You have the right to request certain information about our data practices in the preceding 12 months, including the categories of personal information we have collected about you, the categories of sources from which the personal information was collected, the categories of personal information disclosed for a business purpose or sold, the categories of third parties to whom the personal information was disclosed, the business or commercial purpose for collecting or selling the personal information, and the specific pieces of personal information we have collected about you. - **Right to Delete.** You have the right to request that we delete the personal information we have collected about you, subject to certain exemptions. - **Right to Correct.** Subject to certain exceptions, you have the right to request that we correct inaccurate personal information we have collected about you. We may request additional information showing that the information you want to correct is inaccurate. - **Right to Opt Out of Sale, Sharing, and Targeted Advertising.** You have the right to opt out of processing of your personal information for the purpose of (i) targeted advertising, (ii) "sale" or "sharing" of personal information, or (iii) profiling to provide you with tailored content, including suggested advertising. You may submit a request to opt out by emailing us at privacy@pro-fluence.com. - **Right to Limit Use of Sensitive Personal Information.** You may request that we limit the use and disclosure of your sensitive personal information to purposes authorized by applicable law. Profluence does not intentionally collect sensitive personal information and actively advises against providing it. If you believe we have sensitive personal information about you, contact us at privacy@pro-fluence.com. - **Right to Non-Discrimination.** You have the right not to receive discriminatory treatment by us for the exercise of any of your rights. - **Right to Appeal (Virginia and Colorado).** If we are unable to comply with your request, you may appeal our decision by emailing privacy@pro-fluence.com with the subject line "Appeal - Data Access Request." If after completing the appeal process you are still not satisfied with our response, you may contact your state Attorney General to file a complaint. You may also submit a verified privacy request directly through our Data Subject Request intake process. ## 12. Google API Services (YouTube) Disclosures This section applies specifically to Profluence's optional YouTube integration and controls over any conflicting general language in this Policy. ### 12.1 Scopes We Request When you choose to connect a YouTube channel, Profluence requests only: - `openid` — to associate the Google authorization with your existing Profluence account. - `https://www.googleapis.com/auth/youtube.readonly` — read-only access to your YouTube channel and its video statistics. Profluence never requests write, upload, delete, moderation, monetization, or Gmail/Drive/Calendar scopes, and cannot modify your YouTube account or content. ### 12.2 Google User Data We Access From the YouTube Data API we read and store: - your channel identifier, channel title, channel handle/custom URL, and channel thumbnail URL; - channel statistics: subscriber count, video count, and total view count; - for your ten most recent uploads: video ID, title, publication date, view count, like count, and comment count; - the OAuth tokens (access token and refresh token), their expiry, and the granted scope, solely to maintain the connection. We do not access viewer identities, private analytics reports, comment authors, watch history, demographic reports, subscriber lists, or the contents of your videos. ### 12.3 Derived Data We Generate From the data above Profluence computes and stores derived values, including average engagement rate, posting cadence (posts per week), follower and engagement time series, sponsorship-readiness and audience-trust indicators, forecast and momentum scores, and narrative or opportunity classifications. Derived values are stored against your account and are not published or made public by Profluence. ### 12.4 How Google User Data Is Used Google/YouTube data is used only to provide and improve the user-facing features you requested, specifically: Creator Intelligence, Social Forecast, Audience Trust, Opportunity Radar, Audience Constellation, Growth Navigator, Publishing and Launch Window recommendations, Sponsorship Readiness, and the reports and briefings you generate. It is not used for any unrelated purpose. Profluence does not use Google user data for advertising, ad targeting, ad measurement, or credit-worthiness or lending purposes. ### 12.5 Sharing and Transfer Raw and derived Google user data is disclosed only to the service providers strictly necessary to operate the features you use, under contract and solely on our instructions: - cloud database, storage, and authentication hosting; - application hosting, CDN, and network security; - background job execution for scheduled synchronization; - AI model inference (see 12.6); - error and performance monitoring, and support/email delivery for messages you initiate. A current list of subprocessors is maintained at /trust/legal/subprocessors. Profluence does not sell Google user data, does not share it with data brokers or advertisers, does not transfer it for targeted advertising, and does not disclose it to other Profluence users. Disclosure to human beings occurs only with your explicit consent, to comply with applicable law or valid legal process, as part of a merger or acquisition subject to confidentiality obligations, or where necessary for security investigations or abuse prevention. ### 12.6 AI and Machine Learning Some features send a limited, purpose-scoped subset of Google-derived data to third-party AI model providers, accessed through the Lovable AI Gateway. The data sent is limited to your platform name, channel handle, aggregate counts (followers, engagement rate, views), posting cadence, and recent video titles and dates — never OAuth tokens and never raw API responses in full. The purpose is solely to generate the intelligence, summaries, and recommendations displayed to you. Model providers are engaged as service providers and are contractually directed not to train their models on data submitted through the gateway. Profluence does not use Google user data to train, retrain, or fine-tune any general-purpose or foundation model, and does not use one user''s Google data to generate intelligence for another user. ### 12.7 Security OAuth tokens are held server-side and are never exposed to any other Profluence user, and never to your own browser. Access and refresh tokens are encrypted by Profluence at the application layer using AES-256-GCM authenticated encryption before they are written to the database, with the encryption key held in a managed secret store separate from the database. They are kept in a dedicated, server-only database column that no application client role can read, and can be decrypted only inside server-side code. This is in addition to the managed database's own encryption in transit (TLS) and encryption at rest, and row-level security so that a user's records are accessible only to that user and to authorized Profluence personnel. Token exchange, token refresh, and every YouTube API call occur only in server-side code; OAuth client credentials are held in a managed secret store and are never present in client code. The authorization flow is protected with a signed, single-use state value backed by a server-side nonce that is invalidated on first use, together with an explicit redirect-URI allowlist. Connection, token refresh, revocation, disconnection, and administrative events are recorded in an access-controlled connection audit log. Administrative access is restricted, role-based, and logged. ### 12.8 Retention Tokens and channel data are retained for as long as your YouTube connection remains active. Channel statistics are refreshed on a rolling basis (approximately every 24 hours) and the stored snapshot is overwritten; historical metric points and derived intelligence are retained for the life of your Profluence account so that trends and forecasts remain available to you. All of it is deleted as described in 12.9. ### 12.9 Disconnection, Deletion, and Revocation When you disconnect YouTube in Profluence (Accounts → Disconnect): - Profluence calls Google''s token revocation endpoint to revoke the stored grant; - the stored access token, refresh token, scope, and channel record are deleted; and - the metric history collected from that connection is deleted. Intelligence outputs you previously generated and saved (for example a report you created) remain in your account until you delete them or delete your account. When you delete your Profluence account, Profluence revokes any remaining Google grants and deletes your account and its associated data, subject only to records we are legally required to retain (such as billing records). You may also revoke Profluence''s access at any time directly from your Google Account at https://myaccount.google.com/permissions, and you may request deletion at any time by emailing privacy@pro-fluence.com or submitting a Data Subject Request. ### 12.10 Limited Use Profluence''s use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. By using the YouTube integration, you also agree to the [YouTube Terms of Service](https://www.youtube.com/t/terms), and your data at Google is handled under the [Google Privacy Policy](https://policies.google.com/privacy). ## 13. Children Our Services and Products are intended for users 18+. ## 14. Changes Material changes will be communicated via our online document portal. Please subscribe to our RSS feed at /legal/updates.xml to stay informed of changes to our policies and terms. ## 15. Contact privacy@pro-fluence.com | support@pro-fluence.com