Frame 117 operates Metarch at metarch.io. For the purposes of the GDPR, the data controller is Frame 117, Virkayu Creative S.R.L, Boulevard de France, 9, 1420 Braine-l'Alleud, Belgium, reachable at support@metarch.io.

What we collect

• Account: your name, email address and Google account identifier, received from Google Sign-In.
• YouTube data, read-only, with your consent: through Google OAuth we request two scopes: youtube.readonly (your channel list, your videos and their public statistics) and yt-analytics.readonly (aggregate analytics for channels you own, such as views and watch time). Both are read-only. Metarch cannot post, edit or delete anything on your channel.
• Public YouTube data about the channels and videos you research, retrieved through the YouTube Data API with our own API key. This is public platform data, not personal data about you.
• What you create: tracked channels, ideas, notes, watchlists, uploaded thumbnails, and any Strategist figures you type in.
• Technical: IP address, browser user agent and timestamps in server logs, kept for security and abuse prevention. A session token stored in your browser's local storage so you stay signed in.
• Billing: handled by Stripe. We never see or store your card number. We store your Stripe customer identifier, your plan, and your invoice history.

Why we are allowed to hold it

Performance of our contract with you (running the account you signed up for), your consent (the Google scopes, which you can withdraw at any time), our legitimate interest in keeping the service secure, and legal obligation (invoices and tax records).

How we use it

To run the service, compute outlier scores, keep you signed in, bill you, answer your support messages, and detect abuse. That is the whole list. We do not advertise, we do not sell data, we do not share it with third parties for their marketing, and we do not use your data or your Google data to train machine-learning models.

YouTube API Services

Metarch uses YouTube API Services. By using Metarch you are also agreeing to the YouTube Terms of Service. Google's own handling of any personal data you provide to it is described in the Google Privacy Policy.

Metarch does not allow any third party to serve content or advertisements inside the product, and carries no advertising of any kind.

Google user data

Metarch's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We access your Google and YouTube data only to display it back to you inside Metarch and to compute the metrics you asked for.
• We do not transfer it to others except as necessary to provide the service (our hosting provider), to comply with applicable law, or with your explicit consent.
• We do not use it for advertising, and we do not allow humans to read it, except with your explicit consent for a support request you raised, where necessary for security purposes, or where required by law.
• You can revoke Metarch's access to your data at any time from the Google security settings page at security.google.com/settings/security/permissions, also reachable at myaccount.google.com/permissions. Disconnecting a channel inside Metarch does all of it in one press: it tells Google to cancel the permission, and it deletes both the stored connection and the YouTube data cached against that channel. Revoking at Google instead stops Metarch reaching your data immediately; disconnect the channel in Metarch as well and the stored connection goes too.
• Cached YouTube data is refreshed and overwritten as part of normal operation, and is deleted within 30 days of you disconnecting a channel or deleting your account. If our access to YouTube API Services ends, we delete all stored API data.

Who we share Google user data with

Google user data means anything Metarch receives from your Google account: your name, email address and Google account identifier from Google Sign-In, and anything read from your YouTube channel with your permission under the youtube.readonly and yt-analytics.readonly scopes.

• We do not sell it, rent it or trade it. Metarch carries no advertising, uses no ad network, and has no data broker, affiliate or partner that receives your data.
• We do not use it to train machine learning or AI models, our own or anyone else's, and we do not pass it to a model provider for that purpose.
• One company holds it besides us: Hostinger International Ltd, our hosting provider. Metarch's servers and its database run there, so Google user data rests on Hostinger's infrastructure. Hostinger is a processor acting on our written instructions under its data processing agreement, and may not use the data for any purpose of its own.
• Nobody else receives it. Stripe handles payments and MailerLite sends account and product email. Neither is ever sent YouTube data or anything read from your Google account. Stripe receives your billing details, MailerLite receives your name and email address, and that is the whole of it.
• A court order, or an emergency. If a court or another legal authority makes a binding demand for data, we have to comply. The same applies if we need to investigate fraud or a break-in, or if somebody's safety is at risk. If we are allowed to tell you it happened, we will.
• If Frame 117 is sold. If the business is ever sold or merged, your data goes with it. We would email every registered user before that happened. The new owner has to follow this policy exactly as it stands. If they ever want to change it, they have to offer you the new terms first, and you can delete your account instead.
• When you ask us to. If you raise a support request and ask us to look at your own figures, we will. That is the only time, and only after you have asked.

There is no other sharing, transfer or disclosure of Google user data to any third party.

How we protect your data

Some of what Metarch holds is sensitive. The private analytics of a channel you own are published nowhere else, and neither is the permission Google issues us to read them. These are the mechanisms that protect both.

• Encrypted in transit, without exception. metarch.io is HTTPS only. A plain http request is redirected to https before any data is sent, and every call out to Google, Stripe and MailerLite runs over TLS.
• Your Google permission is encrypted at rest, with a key held somewhere else. The access token and refresh token Google issues are encrypted with AES-256-GCM before they are written to the database. The key is not in the database: it lives in a configuration file outside the public web root, which no visitor can request. A stolen copy of the database on its own does not give anybody a way into your YouTube account.
• Those tokens never reach your browser. They are used on the server only. Nothing capable of reaching your Google account is stored in your browser or exposed to any script running on the page.
• Passwords are hashed, never stored. Each one is put through a salted one-way hash. We cannot read your password, and neither can anybody who takes the database.
• Read-only by design. Both Google permissions Metarch requests are read-only. Metarch cannot post, edit, delete or schedule anything on your channel, because it never asks for the permission that would let it.
• Access is scoped to the account that granted it. Private analytics for a channel are returned to the account that connected it, and to accounts that have been given access to that channel inside Metarch. Every request is checked on the server against your session. Nothing is gated in the browser alone.
• Credentials live outside the code. API keys, the database password and the encryption key sit in one file outside the public web root. It is not in our source control and is not deployed with the site.
• People do not read it. Nobody at Metarch reads your private YouTube data. There are three exceptions and they are narrow: you asked us to look at something in a support request, we need to investigate a security problem, or the law requires it.
• It is deleted when it is no longer needed. Disconnecting a channel tells Google to cancel the permission, deletes the stored tokens, and deletes the YouTube data cached against that channel. Deleting your account removes all of it within 30 days.
• If something goes wrong. In the event of a personal data breach we will notify the Belgian Data Protection Authority, and affected users directly, within 72 hours of becoming aware of it, as the GDPR requires.

Public YouTube data we store, and what is a score rather than a copy

This is the question people ask most often about a tool like this one, so it is written out plainly rather than buried.

• We refresh, we do not stockpile. The view counts and video details Metarch holds against a tracked channel are re-fetched from the YouTube Data API on a schedule and overwritten with the current figures. A number you see in Metarch today is a recent reading, not a copy of something the API said once and we kept.
• A baseline is our own calculation, not API data. To judge whether a video outperformed, Metarch works out what that specific channel normally does, from that channel’s own catalogue, and holds that figure against the video. That baseline is deliberately fixed at the moment the video is measured, because a video released two years ago should be judged against the channel as it was then, not as it is now. It is a number Metarch computed. It is not a stored API response.
• The score moves when the views move. Every refresh recomputes the outlier score from the newly fetched view count. What is held long term is the conclusion, not the raw material.
• Removal. If a video or channel is deleted on YouTube, its data drops out of Metarch on the next refresh that reaches it. If our access to YouTube API Services ends, we delete all stored API data.

Who else processes it

• Google: YouTube Data API and YouTube Analytics API, and Google Sign-In.
• Stripe: payments and invoicing.
• MailerLite: product and account email.
• Hostinger: servers and database.

Each is bound by its own data processing terms. Where data leaves the EEA it does so under the European Commission's Standard Contractual Clauses.

How long we keep it

• Account and content data: for as long as your account exists, then deleted within 30 days of a deletion request.
• Invoices and payment records: seven years, as Belgian tax law requires.
• Server logs: 90 days.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to processing, and receive a portable copy. For any question or complaint about how Metarch handles your data, including anything on this page, email support@metarch.io and we will answer within 30 days. You also have the right to complain to the Belgian Data Protection Authority, the Gegevensbeschermingsautoriteit.

Cookies

Metarch uses no advertising or tracking cookies and runs no third-party analytics on the app. A single session token is kept in your browser's local storage; it is strictly necessary to keep you signed in and is removed when you sign out.

Children

Metarch is not intended for anyone under 16. We do not knowingly collect data from children.

Changes

We update the date at the top. Material changes are emailed to registered users before they take effect.

Frame 117 ("we", "us") operates frame117.com. This policy explains how we handle your data.

What we collect

We collect your email address when you sign up for our newsletter. We collect your name, email, and message when you contact us via our contact form.

How we use it

Your email is used solely to send you updates and content from Frame 117 via MailerLite. Contact form submissions are used only to respond to your inquiry. We do not sell, rent, or share your data with third parties for marketing purposes.

Third-party services

We use MailerLite for email delivery and EmailJS to process contact form submissions. These services process data in accordance with their own privacy policies.

Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, correct, or delete your personal data at any time. To unsubscribe from emails, use the unsubscribe link in any email. To request data deletion, email us at support@metarch.io.

Cookies

This site does not use tracking or advertising cookies.

Contact

Questions? Email support@metarch.io