K
Log inGet started

Privacy Policy

Last updated: August 1, 2026

Back to home

1. Data Controller

The personal data controller is Kontenu, represented by its publisher. For any questions about your personal data, you can contact us at: contact+staging@kontenu.app

2. Data Collected

When you use Kontenu, we collect the following data:

  • Identification data: name, email address.
  • Authentication data: OAuth tokens (access token and refresh token) and profile information authorized by the third-party services you connect. We never store your Google password (or that of another OAuth provider).
  • Usage data: consumption history, pages viewed, interactions and product events.
  • Technical data: IP address, browser, performance, diagnostics and logs.
  • Enrichment data: content generated automatically from your usage data.
  • Marketing data: email address of newsletter subscribers (including non-customers).
  • Google/YouTube data: when you connect your Google account, we receive only the following data through Google APIs, strictly limited to the scopes you have authorized:
    • Google account identifier, email address, name and profile photo (scopes openid, email, profile);
    • OAuth access and refresh tokens (encrypted at rest) required to maintain the connection;
    • YouTube playlist and video metadata (title, channel, duration, thumbnail, publication date) read in read-only mode via YouTube Data API v3 (scope youtube.readonly).
    This data is used only for your personal timeline and visible Kontenu features.

3. Purposes of Processing

Your data is used to:

  • Synchronize your history and generate enrichments (Core Service)
  • Display your personalized timeline
  • Manage your account and preferences
  • Improve our services and fix bugs
  • Measure feature activation and usage from limited product events
  • Send you marketing communications and newsletters (with your consent)

*Note: The Kontenu service is inherently linked to the processing of your usage data. Refusing certain processing may prevent use of the service.*

4. Legal Basis

The processing of your data is based on:

  • Consent: connection to third-party platforms, commercial marketing and newsletters
  • Performance of the contract: provision of the service
  • Legitimate interest: security, product improvement

5. Recipients and Subprocessors

5.1 Subprocessors Processing Data Received through Google APIs

When you connect your Google account to use YouTube API v3, Kontenu receives and processes the data strictly necessary for the service to operate: OAuth tokens, account identifiers, basic profile data, and the YouTube data accessible through the authorization you granted.

  • Hosting & database — OVHcloud (EU): hosts the application and stores the database required to operate the service, including account identifiers, basic profile data, encrypted OAuth tokens (AES-256-GCM) and YouTube data retrieved through the youtube.readonly scope.

No language model (LLM) provider receives this data obtained through Google authentication or from the youtube.readonly scope.

5.2 Other Subprocessors

We also use the following subprocessors to operate the service:

  • Resend— sends transactional emails (registration confirmation, password reset, account alerts). Resend may receive your account email address and, when the message content requires it, your display name. If you use Google to sign in, this account information may come from your Google profile. Resend never receives your Google OAuth tokens or YouTube data retrieved through the youtube.readonly scope.
  • PostHog Cloud EU (Frankfurt)— service usage, performance and diagnostics analytics, only when the technical configuration is available and administrative activation permits it. Users are associated through a stable technical identifier; their name and email address are not transmitted. PostHog receives neither OAuth tokens nor YouTube data from the youtube.readonly scope, nor note content. This administrative activation does not constitute an individual consent mechanism.
  • Language model (LLM) providers— used to classify and summarize videos in your timeline. See Section 5bis for precise details of what is transmitted: they receive no Google user data, only public video metadata.

These subprocessors access your data only to the extent strictly necessary to perform their services and may not reuse it for other purposes. Email campaigns and newsletters are managed directly by Kontenu on its own infrastructure — no third-party subprocessor is involved in processing your data for marketing purposes.

The service uses automated processing (artificial intelligence) to enrich your content. This processing does not involve any automated decision-making that has a legal or significant effect on you.

5.3 Non-sharing Commitment

We do not sell your personal data. We do not transfer your data to third parties for commercial or advertising purposes (retargeting, data brokers, advertising networks, marketing aggregators).

Your data may be disclosed to a third party only in the following cases:

  • With your explicit consent (e.g. a feature that you voluntarily enable).
  • To comply with a legal obligation (court order, tax or accounting obligation).
  • To ensure service security (incident investigation, fraud prevention, user protection).
  • In a corporate transaction (merger, sale, cessation of business) — in which case you would be informed in advance and would have a right to object before any transfer.

We do not transfer or disclose your Google user data to third parties for purposes other than those required to operate the Service, except with your explicit consent, to comply with applicable law, or in a corporate transaction with prior notice. Google OAuth tokens and YouTube data obtained through the authenticated youtube.readonly scope are disclosed only as necessary to host, store, and operate the Service. Our transactional email provider may receive your account email address and display name solely to send account-related emails. No LLM provider receives Google user data.

5bis. Data Received from Google APIs (Limited Use)

When you connect your Google account, Kontenu receives data through Google APIs (YouTube Data API v3, scope youtube.readonly). The use and transfer of this data are governed by the Google API Services User Data Policy, including the Limited Use.

We do not store your Google password. Access to your Google account relies exclusively on the OAuth 2.0 authorization mechanism provided by Google: you authenticate directly on Google's servers, and Kontenu receives only an access token limited to the scopes you have explicitly authorized. This token is stored encrypted at rest (AES-256-GCM) and can be revoked at any time.

Kontenu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

AI enrichment — what is NOT sent to language models. Kontenu uses language models (LLMs) to classify and summarize the videos displayed in your timeline. These providers receive no Google user data:

  • Not your Google OAuth tokens (stored server-side with AES-256-GCM encryption, never transmitted).
  • Nor your Google identifier, email or profile photo.
  • Nor the fact that a video appears in your Likes, Watch Later or playlists — that signal remains strictly local to our servers and is used only for internal scoring.

The models receive only the public video metadata (title, description, channel name, public transcript, tags, chapters, category) — the same information available without authentication through public YouTube pages and public APIs that provide access to this content. Consequently, LLM providers are not recipients of Google user data under the Google API Services User Data Policy.

These calls are stateless. Our LLM providers are contractually required to not reuse this content to train their models and not to retain it beyond the window strictly necessary to process the request.

In practice, we explicitly commit to:

  • Use this data only to populate your personal timeline and visible user-facing features (deduplication, displayed enrichment).
  • Not transfer it to data brokers, data resellers or third-party aggregators.
  • Not use it for retargeting or deliver personalized advertising.
  • Not use it to train models artificial intelligence models (general-purpose or customized).
  • Not use it for credit scoring, loan, insurance or employment assessment.
  • Allow you to disconnect your Google account from Settings > Connections > YouTube API v3 or revoke access directly from https://myaccount.google.com/permissions.

6. Retention Period

Your data is retained for as long as your account is active. If you delete your account, your data is erased within 30 days, unless there is a legal retention obligation (billing).

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

  • Right of access, rectification and erasure
  • Right to data portability
  • Right to object (particularly to commercial marketing)
  • Right to restriction of processing
  • Right to withdraw consent at any time for processing based on consent (newsletters, marketing)

Each marketing communication contains an unsubscribe link that allows you to exercise your right to withdraw immediately.

To exercise these rights: contact+staging@kontenu.app

8. Transfers Outside the EU

The main hosting (OVHcloud) and storage of data received through Google APIs are located in the EU.

Resend (transactional email) and some LLM providers may be located outside the EU. Resend may receive your account email address and, where applicable, your display name to send transactional emails. LLM providers do not receive Google user data; they receive only public video metadata (see Section 5bis). Any transfers outside the EU are governed by standard contractual clauses or the Data Privacy Framework (DPF).

9. Data Security

We implement appropriate security measures to protect your data:

  • Encryption of sensitive data (AES-256)
  • Secure connections (HTTPS/TLS)
  • Secure authentication (OAuth 2.0)
  • Restricted access to data

10. Cookies

Kontenu uses only cookies that are essential to the operation of the service (authentication, session). Analytics and logging tools are configured without a persistent PostHog cookie and with pseudonymous technical identifiers. The PostHog SDK is loaded only when its technical configuration is available and administrative activation allows it; this global circuit breaker does not replace individual consent collection. For more information, see our Cookie Policy.

11. Changes

This policy may be updated. If a substantial change is made, you will be informed by email or a notification in the application.

12. Complaint

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (French Data Protection Authority):

www.cnil.fr