Privacy Policy

1. What we store

Account: email, display name and (optionally) phone number. With Google sign-in we receive only your email and display name.

Usage: wallet transactions, orders, the research runs you saved (archive), channels you follow and your settings.

Product analytics (PostHog): which pages are used and where people get stuck, linked to an account ID only — emails are not sent and form inputs are masked in session recordings.

2. Your API keys

Keys you enter on the Connect API page stay in your browser by default; our server only forwards them with each request and does not keep them.

If you turn on “Save to account”, keys are encrypted with AES-256-GCM before storage, the decryption key is kept separately on the server, and only the last 4 characters are ever shown. Delete them any time; deleting your account deletes them too.

3. Platform data

NicheLens only reads public platform data (videos, channels, view counts) through Google’s official API and third-party data providers. We never log in to your social media accounts.

4. Connecting YouTube (optional)

On My Channel you can connect a YouTube channel with read-only scopes (youtube.readonly, yt-analytics.readonly) to see watch time, retention, traffic sources, countries and devices. NicheLens never posts, edits or deletes anything on your channel.

NicheLens uses YouTube API Services. By connecting you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy).

Access tokens are encrypted, used only to show data to you, never shared, and cached for at most 3 hours. Disconnect any time or revoke access at https://myaccount.google.com/permissions.

5. Payments

Card and PayPal payments are processed by Lemon Squeezy (merchant of record) and its payment partners. NicheLens never sees or stores your card number; we receive the order status, amount, country and email needed to credit your account.

Vietnamese bank transfers are confirmed automatically through SePay. We never ask for your bank login.

6. Who processes data for us

Supabase (database and login), Vercel (hosting), Google (YouTube API, Gemini AI), DeepSeek and Groq (AI text), TikHub (public platform data), PostHog (analytics), Lemon Squeezy (payments), Gmail (transactional email). Each receives only what it needs for its task.

Data may be processed outside your country. Where the law requires it, we rely on the providers’ standard contractual safeguards.

7. Email

We send account verification, password reset, receipts and a weekly digest. Unsubscribe from the digest with the link in each email or on your Account page.

8. Retention and your rights

We keep account and billing records while your account is active and as long as tax law requires afterwards. Cached platform data expires automatically.

You can ask to access, correct, export or delete your data at any time using the contact below. We reply within 7 working days. If you are in the EU/UK you may also complain to your data protection authority.