Privacy Policy
1. Controller
The data controller is TAG INSIGHT, 66 avenue des Champs-Élysées, C/O OCP Business Center 4, 75008 Paris, France, reachable at support@feedtomind.com. This policy explains what personal data FeedToMind collects, why, and what your rights are.
2. Data we collect
- Account data: email address, name if you provide it, and the identifier of the sign-in provider you use (Google, GitHub, X, or email and password). Authentication is operated by Clerk; passwords are never stored by us.
- Billing data: your Stripe customer and subscription identifiers, plan, billing period and invoice history. Card details are entered on Stripe's pages and never reach our servers.
- Library and generated content: the YouTube videos and channels you add, their transcripts, breakdowns, summaries and action plans, your folders and credit ledger, and the briefs, ideas, posts, scripts, skills and books you create with the Service.
- Keys: the API keys you create (stored as a one-way hash) and, if you use "bring your own key", your AI provider keys, stored encrypted and never displayed again in full.
- Connected assistants: OAuth authorizations for assistants you connect, including the application identifier, permissions and token hashes. The assistant receives the data requested through the tools you authorize, under that provider's own terms and privacy policy.
- Product events: a small number of events tied to your account (signup, checkout started, checkout succeeded, first video) used to understand how the Service is used. No advertising trackers, no third-party analytics scripts.
- Sign-up source: how you first and last reached FeedToMind before creating your account (campaign tags in the link such as utm_source, the name of the referring website, the landing page and the date). It is stored with your account to understand which channels bring new users. No IP address or visitor identifier is kept.
- Technical data: IP address, browser and request logs kept by our hosting provider for security and debugging, for a short period.
3. Why we use it and on what legal basis
- To provide the Service you subscribed to, including archiving, generating breakdowns and billing (performance of the contract).
- To secure the Service, prevent abuse and fix problems (legitimate interest).
- To measure which channels bring new users, using the sign-up source (legitimate interest).
- To send essential account and subscription notices (performance of the contract). The Service also sends account-activity tips and reminders. [BEFORE PUBLICATION: validate the legal basis for each lifecycle message, the consent or applicable exception, and an effective opt-out process. Do not describe all reminders as essential transactional emails.]
- To keep invoices and accounting records (legal obligation).
4. Who processes your data for us
- Cloudflare, Inc. (USA): hosting of the application and database, technical logs and backups on Cloudflare's network.
- Clerk, Inc. (USA): sign-up, sign-in and account security.
- Stripe, Inc. (USA and Ireland): payments, invoices and subscription management.
- TranscriptAPI: retrieval of YouTube transcripts. We send it the URLs of the videos you add, not your identity.
- DeepSeek (China) and Anthropic, PBC (USA): generation of written content. They receive the source text and instructions needed for your request, including any personal information you put into those texts. The standard model is configured with DeepSeek and an Anthropic fallback. If you use your own AI key, processing happens under your provider account instead.
- Cloudflare Workers AI: image generation when the image-generation fallback is used. It receives the generation prompt.
- Google / YouTube: retrieval of channel and video metadata. API requests contain the channel or video identifiers needed for the request.
- Brevo (France): sending of transactional emails.
Some providers process data outside the European Economic Area. [BEFORE PUBLICATION: verify and document the applicable transfer safeguards for each enabled provider, especially DeepSeek. Provider location alone does not establish a lawful transfer mechanism.]
5. How long we keep it
- Account and library data: for as long as your account exists. When account deletion completes, the account's active library records, generated content, API keys and OAuth authorizations are removed from the application database, the Clerk identity is deleted and any subscription is cancelled. Subscription-cancellation and identity-deletion failures are reported so you can retry. Backup copies and provider records follow their separate retention periods. [BEFORE PUBLICATION: verify media erasure and recovery when object-storage deletion fails.]
- Invoices and payment records: 10 years, as required by French accounting law, kept by Stripe and in our accounting.
- Technical logs and backups: [CONFIRM THE CONFIGURED RETENTION PERIODS AND THE PROCESS FOR REAPPLYING ERASURE AFTER A RESTORE].
6. Cookies
Clerk uses essential cookies to keep you signed in. We set one first-party cookie, to_src, shared by feedtomind.com and app.feedtomind.com: it holds only the source of your first and last visit (campaign tags, referring website, landing page, date), contains no identifier, is read by us only when you create an account, and expires after 90 days. We do not add advertising cookies or third-party analytics. Hosting and security providers may use technical cookies needed to protect and operate the Service.
7. Your rights
You can access, correct, export or erase your data, object to or restrict certain processing, and withdraw consent where processing is based on it. Most of this is available directly in the app (your library, your keys, "Delete account"). For anything else, write to support@feedtomind.com; we answer within one month. You can also lodge a complaint with the CNIL (cnil.fr).
8. Security
Data travels over HTTPS only. API keys are hashed, AI provider keys are encrypted with a key held outside the database, and access to production systems is restricted to the people who operate the Service.
9. Children
The Service is not intended for people under 18. We do not knowingly collect their data; if you believe a minor has created an account, contact us and we will delete it.
10. Changes
We may update this policy. Material changes are announced by email or in the app before they take effect.