Privacy Policy

1. Who we are

Trendnaut is software operated from Jundiaí, São Paulo, Brazil. We're the data controller for your account.

For privacy questions, data requests, or anything covered by this policy, write to hello@trendnaut.com — our designated Encarregado contact for LGPD purposes (Art. 41). We respond to most messages within 2 business days, and to formal data requests within 15 days as required by LGPD.

2. The promise

Three things we don't do, in plain English:

• We don't sell your data. No advertisers, no data brokers, no "data partners."
• We don't train AI models on your content. The AI we use is a third-party service that analyzes your data once per analysis, then forgets it. Details in section 7.
• We don't compare you to other creators. Your analysis uses only your own channel data. We don't pool data across users to build benchmarks.

Three things we do:

• We connect to your YouTube account through Google's official OAuth. You grant specific, limited permissions. You can revoke them anytime at myaccount.google.com/permissions.
• We process your data through service providers (database, hosting, AI, email). They're listed in section 6 with what each one receives.
• We keep your data while your account is active. When you delete your account, we permanently erase it within 30 days.

3. What we collect

We collect three kinds of data: what you give us, what you generate by using Trendnaut, and what your connected platforms send us.

4. Why we collect each thing

LGPD and GDPR both require us to have a specific purpose for every piece of data we collect. Here's the full list.

• Email: to identify your account, send transactional emails (trial reminders, weekly letters, billing receipts), and respond to support requests.
• Name: to personalize emails ("Hi Felipe" instead of "Hi there").
• Language preference: to display the product in your chosen language.
• Subscription data: to manage your access (trial, active, expired), bill you correctly, and provide receipts.
• Session data and IP: to keep you logged in, detect suspicious activity (for example, logins from unexpected countries), and prevent abuse.
• Cookies: authentication cookies are strictly necessary. Preference cookies remember your settings. Analytics cookies help us understand which features creators actually use.
• Product usage: to improve the product. We look at aggregate patterns ("most creators check the dashboard on Monday morning"), not individual behavior.
• Schedule data: to publish posts to your platforms at the times you set.
• YouTube channel and video data: to analyze your performance and generate recommendations. This is the core of what Trendnaut does. Without this data, there's no product.
• OAuth tokens: to make API calls to YouTube on your behalf. Without these, we can't read your analytics.

We don't collect anything we don't use. If you spot something in this list and can't see why we'd need it, email us. We'll explain or stop collecting it.

5. The legal basis (for GDPR users)

Under GDPR, we need a lawful basis to process your data. For most of what we do, that basis is performance of a contract: you signed up for Trendnaut, and we need to process your data to deliver the service you're paying for (or trialing).

Two exceptions:

• Analytics cookies: processed under consent. EU users see a consent banner before any analytics cookie is set. You can withdraw consent any time in your settings.
• Security logs and abuse prevention: processed under legitimate interest. Keeping the service safe is in your interest and ours.

For LGPD (Brazilian) users, the equivalent legal bases are execution of contract (Art. 7, V) and consent (Art. 7, I) for analytics.

6. Who we share data with

We use service providers ("subprocessors" in privacy law terminology) to operate Trendnaut. Each receives only what they need to do their job.

We have data processing agreements with these providers where they offer them, and we choose providers based partly on their compliance posture (GDPR, SOC 2 where available). Some of our providers are smaller and don't yet have formal SOC 2 reports. We've chosen them for reliability and engineering quality, and we monitor their practices.

We don't share your data with advertisers, data brokers, marketing companies, or any party not listed above.

7. What we send to AI providers

This section matters because it's where a third-party AI processes your content. Read it carefully.

When Trendnaut runs a pattern analysis on your channel, we send the following to OpenRouter (which routes to DeepSeek):

• Aggregated metrics: view counts, retention percentages, traffic source breakdowns by category, weekday averages, format duration buckets.
• Post titles: the titles of your own videos.
• Post duration: how long each video is.
• Computed hypothesis results: yes/no/inconclusive outcomes from deterministic statistical tests we run before calling the AI.
• Pattern signals: which weekdays performed better, which formats are most common, how many breakout videos you've had.

We do NOT send:

• Your email address or name
• Your OAuth tokens (these stay on our servers, encrypted)
• Video thumbnails or visual content
• Individual viewer data, comments, or messages
• Identifiers that map back to you outside Trendnaut

The AI provider receives a creator UUID (a random identifier we generated) and the data above. They process the request, return interpretation text, and don't retain the data for model training. We've confirmed this in their terms.

For the weekly post drafts generation, we send the same kind of analysis summary plus pre-computed candidate signals (format, suggested weekday, topic tags from your own posts). The AI generates draft titles, insights, and captions, which we save to your dashboard.

If this disclosure matters to you and you don't want any data sent to a third-party AI provider, the product doesn't work without it. Analysis is core. You can close your account anytime if this is a deal-breaker.

8. Google OAuth: what we ask for and why

When you sign in with Google to connect your YouTube channel, we request these specific scopes:

We don't request:

• Write access (we cannot post, edit, or delete videos through these scopes)
• Comment access
• YouTube Premium scopes
• Administrative or force-SSL scopes
• Access to viewer-level data

You can review what you've granted at myaccount.google.com/permissions and revoke our access at any time. Revocation immediately stops data sync. Your historical data remains visible in Trendnaut until you delete your account.

We follow Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the Trendnaut service for you. We don't transfer it to third parties except as described in section 6 (which is required to operate the service). We don't use it for serving ads. We don't allow humans to read your Google user data, except (a) with your explicit consent, (b) when necessary for security purposes, (c) when required by law, or (d) when the data has been aggregated and anonymized.

9. International data transfers

Trendnaut is operated from Brazil. Our service providers are based mainly in the United States and the European Union. This means your data crosses borders.

For users in the European Union, transfers from the EU to other countries are protected by:

• European Commission's 2021 Standard Contractual Clauses (SCCs) with providers that use them. Where providers participate in the EU-US Data Privacy Framework (adequacy decision, 2023), that applies instead.
• Adequacy decisions where applicable (for example, transfers between EU countries, or to countries the European Commission has deemed adequate).
• Provider-specific safeguards documented in their respective privacy policies.

For LGPD purposes, international transfers from Brazil rely on specific contractual clauses (LGPD Art. 33, II) or the controller's compliance guarantee (Art. 33, V), using contractual safeguards with each service provider.

10. Cookies and tracking

We use cookies in three categories:

11. Your rights

Under LGPD (Brazil), GDPR (EU), and equivalent laws elsewhere, you have rights over your personal data. Trendnaut honors these rights for all users, regardless of location.

You can:

• Access your data. Request a copy of everything we have about you.
• Correct inaccurate data. Tell us what's wrong and we'll fix it.
• Delete your data. Close your account, and we erase it within 30 days.
• Export your data. Download a structured copy from settings, anytime. Under GDPR Art. 20, you can also request direct transmission of your data to another controller.
• Restrict processing. Ask us to limit how we use your data in specific situations.
• Object to processing, particularly for analytics, where you can withdraw consent.
• Request review of automated decisions. Under LGPD Art. 20 and GDPR Art. 22, you can ask us to explain or review any recommendation our AI generated. Our recommendations are suggestions, not binding decisions, but the right exists and we'll honor it.
• Anonymize your data. For LGPD users, request that we keep aggregate insights but remove identifiers.
• Revoke consent for anything we process based on consent (analytics cookies primarily).
• Be informed about data sharing. See section 6 for our full subprocessor list.
• File a complaint with a supervisory authority. In Brazil: ANPD (https://www.gov.br/anpd/). In the EU: your country's data protection authority.

To exercise any of these rights, email hello@trendnaut.com. We respond within 15 days as required by LGPD. If your request is complex, we may extend that to 30 days and let you know.

We may ask you to verify your identity before processing a deletion or export request. This protects you against impersonation.

CCPA (California): Trendnaut does not currently meet CCPA applicability thresholds (annual revenue above $25M, processing data of 100,000+ California consumers, or 50%+ of revenue from selling personal information). We don't sell personal data. If our scale changes, we'll add explicit CCPA disclosures.

12. How long we keep your data

When you delete your account, we mark your data for deletion immediately and remove it from active systems. Backups containing your data are overwritten within 30 days. Billing records are kept for tax and audit purposes for 5 years, in compliance with Brazilian law.

13. Security

We protect your data with industry-standard practices: TLS encryption for all data in transit, encryption at rest in the database, OAuth tokens encrypted with an additional layer, and access controls limiting which parts of our team can see what.

We can't promise no incident will ever happen. Nobody honest can. We can promise that if one does, we notify the relevant supervisory authority within 72 hours (GDPR Art. 33) or 3 business days (LGPD, ANPD Resolution 15/2024), and notify you directly without undue delay when your data is at high risk. We'll be specific about what was affected.

For more detail on our security practices, see the Security Statement.

To report a vulnerability, write to security@trendnaut.com. We acknowledge security reports within 48 hours.

14. Children's privacy

Trendnaut isn't for users under 18. Creators on YouTube must be old enough to have a Google account that can monetize a channel (typically 13+ in the US, 18 in some jurisdictions), but Trendnaut specifically requires you to be 18 to use the product.

We don't knowingly collect data from anyone under 18. If you become aware that a minor has signed up, email us and we'll close the account and delete the data within 30 days.

15. Changes to this policy

We may update this policy as the product evolves. For material changes, like adding a new subprocessor that receives sensitive data or changing retention periods, we email you at least 30 days before the change takes effect. For minor changes (typo fixes, clarifying language), we update the "Last updated" date at the top and don't email everyone.

Previous versions of this policy are archived and available on request.

16. Contact

For privacy questions, data requests, or anything covered by this policy:

For LGPD-specific concerns, you can also contact Brazil's data protection authority directly at ANPD (https://www.gov.br/anpd/).