Privacy Policy

• •Google account information when you sign in, such as your name, email address, profile image, and Google account identifier.
• •Google OAuth tokens, including refresh and access tokens, when you connect Google or YouTube to enable ongoing authorized access.
• •YouTube data that you choose to connect to Criblate, such as your channel information, playlists, videos, caption tracks, subtitle text, and localized title or description metadata needed to import videos and publish updates on your behalf.
• •Content and activity you create in Criblate, such as translation edits, transcript revisions, comments, settings, followed creators, publication history, and usage of workflow features.
• •Billing and transaction information processed in connection with paid plans or credits.
• •Basic technical and product analytics information, such as sign-in events and product usage, to operate, secure, and improve Criblate.

• •To create and secure your account and keep you signed in.
• •To let you connect your YouTube channel and import channel, playlist, video, and caption data into Criblate.
• •To display videos, subtitles, and translation work inside Criblate so creators and translators can collaborate through the product.
• •To generate, review, revise, and manage subtitles and translations.
• •To upload captions and, if you choose, localized video metadata back to YouTube on your behalf.
• •To provide billing, customer support, abuse prevention, debugging, security monitoring, and legal compliance.

Criblate uses Google Sign-In so users can authenticate with Google accounts. When a creator connects YouTube, Criblate requests access to the Google and YouTube data needed for visible, user-facing features such as importing videos, reading existing captions, preparing translation workflows, and publishing updated captions or localized metadata to YouTube.

Criblate requests only the permissions it needs to provide these features. Read-only YouTube access may be requested first for importing channel or video data and syncing metadata. If you later choose a feature that writes to YouTube, such as downloading caption tracks that require additional access or publishing captions or localized metadata, Criblate may prompt for an additional YouTube permission at that time.

If Criblate changes how it uses Google user data in a material way, we will update this Privacy Policy and ask for consent as required before using the data for a new purpose.

For data received from Google APIs, including YouTube scopes subject to Google's additional requirements:

• •We use Google user data only to provide or improve user-facing features that are visible and prominent in Criblate.
• •We do not sell Google user data.
• •We do not use Google user data for advertising, marketing profiling, retargeting, or interest-based advertising.
• •We do not use Google user data to determine credit-worthiness or for lending purposes.
• •We do not use Google user data to train generalized AI or machine learning models.
• •We do not allow humans to read Google user data except with your affirmative agreement for support or troubleshooting, when necessary for security or abuse prevention, or when required by law.

We do not share personal information except as described in this policy.

• •Google and YouTube, when you direct Criblate to read from or write to your connected account.
• •Other Criblate users, to the extent needed for the collaboration features of the product. For example, creator video metadata, subtitles, translation drafts, and review history may be shown inside Criblate to participating translators and reviewers.
• •Service providers that help us operate Criblate, such as payment, analytics, hosting, and infrastructure providers.
• •Translation providers that process text on our behalf when you use machine translation features. Today these may include OpenAI and DeepL.
• •Law enforcement, regulators, courts, or other parties when required by law or when necessary to protect rights, safety, or the security of the service.
• •A successor entity in connection with a merger, acquisition, or sale of assets, subject to applicable law and, where required for Google API data, explicit prior user consent.

• •Google and YouTube for authentication, read-only channel and video access, and additional YouTube publishing access only when you choose features that require it.
• •Stripe for billing and payment processing.
• •PostHog for product analytics and event tracking.
• •OpenAI and DeepL for optional machine translation features.

These providers process information under their own terms and privacy practices when acting as independent controllers, and under our instructions when acting as our service providers.

We retain information for as long as reasonably necessary to operate Criblate, maintain your account, provide the features you request, comply with legal obligations, resolve disputes, and enforce our agreements. Google OAuth tokens and connected YouTube data are retained until they are no longer needed for the connected features, the connection is revoked, or deletion is requested, subject to backup and legal retention needs.

When you revoke Criblate's Google access, disconnect a connected feature, or request deletion, we will stop using the affected Google user data for that feature and delete or de-identify retained copies within a reasonable period, except where retention is required for security, fraud prevention, legal compliance, or limited backup restoration workflows.

• •You can revoke Criblate's access to your Google account at myaccount.google.com/permissions.
• •You can stop using YouTube-connected features by disconnecting access or contacting us.
• •You can request access to or deletion of your account data by emailing support@criblate.com.

We maintain a secure operating environment for personal information, Google user data, and data derived from Google APIs. We use reasonable administrative, technical, and organizational safeguards designed to protect data against unauthorized or unlawful access, use, destruction, loss, alteration, or disclosure.

• •We transmit data over modern secure transport protocols such as HTTPS/TLS.
• •We protect Google user data in transit and at rest, including storing OAuth credentials such as access tokens and refresh tokens using encryption or equivalent safeguards at rest.
• •We limit access to Google user data to authorized personnel, processors, and subcontractors who need that access to operate the requested user-facing features and who are subject to confidentiality and security obligations.
• •We apply access controls, logging, and monitoring designed to detect and help prevent abuse, unauthorized access, and security incidents.
• •We take steps to manage encryption keys and credentials securely and to keep client credentials confidential.
• •We require service providers that process Google user data on our behalf to protect it under appropriate security and confidentiality obligations.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a security incident affecting Google user data, we will take appropriate steps to investigate, contain, remediate, and comply with applicable legal and contractual notification obligations.

Criblate is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the service.

We may update this Privacy Policy from time to time. When we do, we will post the updated version here and change the "Last updated" date above. If we make a material change to how we use Google user data, we will provide additional notice and obtain consent where required.

Questions or requests about this Privacy Policy can be sent to support@criblate.com.