Addictd Enterprise

Privacy Policy

This policy explains the data practices of the invitation-only Addictd Enterprise consulting workspace. It is separate from the consumer Addictd product and its privacy policy.

1. Scope

This Privacy Policy applies to Addictd Enterprise, an invitation-only service operated by addictd, Inc. for brand and agency consulting engagements. It covers the public Enterprise site, client authentication, the private workspace, and the dedicated YouTube connection. The consumer Addictd product uses a different application, identity system, Google project, and data environment.

2. Data we collect

We collect only information needed to operate an invited engagement:

  • Account and organization data: work email, display name, optional avatar, organization membership, role, authentication events, and engagement status.
  • Google authorization data: the Google account email and identifier that authorized access, granted scopes, token status, and encrypted access and refresh credentials. Plaintext Google credentials are never stored in the browser or database.
  • YouTube channel data: channel identity, video titles, descriptions, thumbnails, publication dates, duration, privacy status, and available view, like, and comment counts.
  • YouTube Analytics data: available audience-retention and relative- retention points for videos in the connected channel.
  • Operational data: bounded sync status, provider error categories, timestamps, evidence hashes, and security logs that deliberately exclude token values.

3. How we use Google user data

Addictd Enterprise requests only openid, email, youtube.readonly, and yt-analytics.readonly. We use that access to identify the authorizing account, import the organization's own YouTube catalogue, retrieve available audience-retention evidence, display that evidence in the client workspace, and deliver the client's consulting engagement.

The connection is read-only. Addictd Enterprise cannot publish, edit, rate, comment on, or delete anything on a client's YouTube channel. It does not request revenue data, Google Drive access, or a YouTube write scope.

We do not sell Google user data, use it for advertising, transfer it to data brokers, or use it to determine eligibility for credit or other high-impact decisions. Enterprise Google data is not used to train or improve the consumer Addictd product, a shared corpus, a general-purpose model, or a third-party model. Its use is limited to the organization-facing features and consulting services the client authorized.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can review theGoogle Privacy Policyand manage connected applications inGoogle Account security settings.

4. Access and sharing

Organization members see only data belonging to organizations in which they hold a membership. Authorized Addictd personnel may access a client's data when necessary to deliver the consulting engagement, answer a support request, investigate a security issue, or comply with law. Those personnel are expected to use the data only for that purpose and under applicable confidentiality obligations.

We use infrastructure and service providers to host the Enterprise application, authenticate invited users, store tenant data, and operate background jobs. They may process data only as needed to provide those services to us and under contractual or comparable confidentiality and security obligations. We may also disclose information when required by law, to protect the service or its users, or as part of a corporate transaction subject to appropriate notice and safeguards.

5. Retention, revocation, and deletion

While an engagement and its authorization remain active, we retain imported YouTube data only as needed to provide the authorized workspace and consulting service. We periodically revalidate the Google authorization and stop provider access when it is no longer valid.

  • An organization owner or administrator can disconnect YouTube in the workspace. The service first asks Google to revoke the credential and then deletes the local connection, encrypted credentials, imported videos, snapshots, retention curves, and sync history.
  • If access is revoked through Google, becomes invalid, or a client requests deletion, related Authorized Data is deleted as soon as possible and within seven calendar days.
  • If an engagement ends without an earlier revocation or deletion request, its client workspace data will be deleted within 30 days unless a signed engagement agreement requires a shorter period. This is an operating commitment: the current pilot does not automatically infer workspace deletion from a change to an engagement status. Addictd confirms and performs the closure process with the client. The earliest applicable deadline controls.

Deleting data from Addictd Enterprise does not delete videos or other information held by YouTube. Clients must use YouTube itself to delete content from their channel. Limited account, security, tax, payment, and contractual records may be retained where reasonably necessary to comply with law, resolve disputes, or enforce an agreement, but revoked YouTube Authorized Data is not retained for those purposes.

6. Security

Enterprise uses a dedicated application deployment, Google project and OAuth client, identity and database project, background worker, credentials, and tenant data model. Google tokens are encrypted with authenticated encryption before database storage, tenant tables enforce row-level security, browser roles cannot select credential ciphertext, and provider failures remain visible without logging secret values. More detail is available on our Security page.

No method of transmission or storage is perfectly secure. If we learn of a security incident affecting client data, we will investigate, contain it, and provide notice as required by applicable law and the relevant engagement agreement.

7. Your choices and rights

Depending on location, an individual may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information. An organization owner or administrator can disconnect YouTube directly. Other requests can be sent to support@addictd.ai. We may verify the requester's identity and authority before acting on a request.

8. International processing

Addictd is based in the United States. Data may be processed in the United States and in other locations where our service providers operate, subject to the protections described in this policy and any safeguards required by applicable law or contract.

9. Changes to this policy

We may update this policy when the Enterprise service or legal requirements change. If a change materially expands how Google user data is used, we will update the disclosure and obtain any renewed consent required before using that data for the new purpose.

10. Contact

Questions, complaints, export requests, and deletion requests can be sent tosupport@addictd.ai or mailed to addictd, Inc., 1451 SW 52nd Way, Plantation, Florida 33317, United States.