This policy explains what personal data lowcycle handles, why, who helps us handle it, how long we keep it, and the rights you have. It covers people who build pages (“publishers”) and people who visit them (“visitors”).
1. Who we are and our two roles
lowcycle is run by:
Rakesh GHyderabad, Telangana 500092, India
Email: rakeshgandla205@gmail.com
We handle personal data in two different roles:
- Controller of account data. For publishers’ accounts, and for the technical and moderation data we need to run lowcycle safely, we decide how and why the data is used.
- Processor of visitor submissions. When a visitor fills in a form on a page, the page’s publisher is the controller of that submission. We store and process it only on the publisher’s behalf and instructions, to run the service. The publisher’s name and their own privacy policy are linked on every page with a form.
2. What we collect
- Account data: your email address, sign-in records, settings, and the terms versions you accepted and when.
- Billing data: if you buy a paid plan, your plan, its status and renewal date, and the customer and subscription IDs from our payment provider. Your card details go to the provider, never to us.
- Page content and media: your pages, their earlier versions, uploaded images and their descriptions, and the publisher details you enter (name, contact email, privacy policy link).
- Instagram data, only if you connect Instagram: your Instagram username and account IDs, an encrypted access token, your profile photo, follower and post counts, per-post insights (reach, views, likes, comments, saves and shares) for your 12 most recent posts, thumbnails of your top 3 posts, and aggregate audience percentages by gender, age and country. Never your messages, comments or anyone else’s account, and nothing about individual followers.
- YouTube data, only if you connect YouTube: your channel details, public stats, your most viewed recent videos and aggregate audience percentages. The YouTube and Google user data section lists exactly what we read and how we handle it.
- Visitor submissions: what visitors type into a page’s form, such as name, email address or message, the consent text they agreed to and when, and whether they confirmed their email.
- Technical data: a keyed hash of the IP address (never the address itself), the browser’s user agent, the referring page and UTM campaign parameters when a form is submitted.
- View counts: pages count views without cookies. To count unique visitors for a day we use a daily-rotating hash, which can’t be linked across days or back to a person.
- Email logs: for every email we send, its type, a hash of the recipient address and whether it was delivered. Not the subject or the content.
- Moderation data: the results of automated checks, abuse reports (with the reporter’s email only if they choose to give it), operator decisions, and evidence copies of removed content.
3. Why we use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Running your account and publishing your pages | Performing our contract with you |
| Showing your Instagram stats on your dashboard and on the media kits you choose to publish | Your consent, given when you connect Instagram; withdraw it by disconnecting |
| Confirming you own your YouTube channel and showing its stats on your dashboard and on the media kits you choose to publish | Your consent, given when you connect YouTube; withdraw it by disconnecting |
| Showing your media kit, stats and audience to signed-in businesses in brand search, and passing on collab requests (your email is shared only with a business whose request you accept) | Your consent, given when you turn on “List me for brands”; withdraw it by turning it off |
| Storing and delivering visitor submissions to the publisher | The publisher’s instructions, as processor; the publisher chooses their own basis, usually consent |
| Confirmation, notification and digest emails | Performing our contract; the visitor’s consent for confirmation emails |
| Spam protection, rate limits and security | Our legitimate interest in keeping lowcycle safe and available |
| Moderation, abuse reports and enforcement | Our legitimate interest in keeping lowcycle safe, and legal obligations |
| View counts for publishers | Our legitimate interest, using no cookies and no identifiers |
| Error monitoring | Our legitimate interest in a working service |
| Keeping evidence and answering authorities | Legal obligations |
4. Sub-processors
These companies process personal data for us, under contracts that protect it:
| Company | What for |
|---|---|
| Supabase | Database, file storage and sign-in |
| Vercel | Hosting and serving pages |
| Resend | Sending email |
| Cloudflare | Turnstile spam protection. Only on pages with forms, and on the report form. |
| Sentry | Error monitoring, with personal data removed before sending |
| Anthropic | Automated content moderation of published pages |
| Dodo Payments | Payments, tax and invoices for paid plans, as merchant of record. Only if you buy a paid plan. |
| Web Risk checks of links on published pages. Only when link checks are enabled. |
If you connect Instagram, we read your data from Meta through the Instagram API, read-only, under Meta’s Platform Terms. We don’t send Meta anything beyond what that connection needs.
If you connect YouTube, we read your channel and its analytics from Google through the YouTube API Services, read-only. See YouTube and Google user data.
We don’t sell personal data, and we don’t use it for advertising.
5. YouTube and Google user data
This section covers the data we receive from Google when you connect a YouTube channel in Settings → Connected apps. Connecting YouTube is optional and separate from how you sign in. We ask Google for read-only access (the youtube.readonly and yt-analytics.readonly permissions, plus your Google account’s email address). We never upload, edit, delete, comment or change anything on your channel.
What we access
- Channel: your channel ID, handle, title and profile picture.
- Channel stats: subscriber count (unless you hide it on YouTube), total views and video count.
- Videos: from your 50 latest uploads, the 12 with the most views: each one’s link, title, publish date, view, like and comment counts, and its thumbnail.
- Audience: aggregate percentages of your viewers by age group, gender and country over the last 90 days, from YouTube Analytics. Nothing about individual viewers.
- Google account: the email address of the Google account you connected, so you can see which account it is.
- Access token: a refresh token from Google, so we can update your stats.
We never download your video files, and we don’t read your comments, messages or watch history.
How we use it
- To prove you own the channel, and to show its stats, videos and audience to you in your dashboard.
- To show the stats, videos and audience you choose on the media kits you publish.
- On your link-in-bio page, only your channel ID and handle are used, to check that the YouTube link on it points to the channel you connected. If it doesn’t, the link is marked as unverified. No stats appear there.
- If you turn on “List me for brands”, your subscriber, view and video counts and your audience are shown to signed-in businesses in brand search. This is off unless you turn it on.
We don’t use YouTube data for advertising, and we don’t use it to train AI models.
Sharing
We don’t sell your YouTube data or share it with third parties. The stats you choose to show on a media kit appear publicly on that page, and, if you turn on “List me for brands”, in brand search. To run lowcycle, the data is stored by Supabase (our database and file storage, in India (Mumbai, AWS ap-south-1)) and served by Vercel (our hosting). Both process it only on our behalf. See Sub-processors.
How we protect it
- All data is encrypted in transit (HTTPS) and at rest.
- The refresh token is encrypted by the app (AES-256-GCM) before it’s stored. Only our servers can decrypt it. It’s never sent to your browser and never logged.
- Database rules let only you reach your connection. Other publishers can’t see it.
Retention and deletion
- We refresh your stats once a day and keep them while YouTube is connected to your account.
- When you select Disconnect next to YouTube in Settings, we withdraw our access at Google and immediately delete the token, your channel details, stats, audience and stored thumbnails.
- When you delete your account, your YouTube data is permanently deleted with it within 14 days.
- You can revoke lowcycle’s access anytime at https://myaccount.google.com/permissions. We stop updating your stats at the next daily refresh. To remove what we stored, disconnect in Settings or email rakeshgandla205@gmail.com. Our data deletion instructions explain each step.
YouTube API Services
lowcycle uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). See also the Google Privacy Policy (https://policies.google.com/privacy).
lowcycle’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. How long we keep data
Scheduled jobs delete data on this timetable:
| Data | Kept for |
|---|---|
| Submissions | Until the publisher or the visitor deletes them, or the publisher’s account is deleted |
| Unconfirmed sign-ups (double opt-in) | 7 days |
| Hashed IP address on a submission | 30 days, then removed |
| Daily unique-visitor hashes for view counts | 24 hours |
| Earlier versions of a page | The last 50 per page |
| Email log (type, hashed address, status) | 90 days |
| Moderation evidence | 1 year, or longer when the law requires it |
| Instagram data (token, stats, thumbnails) | While Instagram is connected, refreshed daily. Deleted at once when you disconnect, remove lowcycle in Instagram, or ask us |
| YouTube data (token, channel, stats, videos, thumbnails) | While YouTube is connected, refreshed daily. Deleted at once when you disconnect in Settings, or ask us |
| Deleted accounts | Everything is permanently deleted 14 days after the request |
Accounts banned under the Acceptable use policy follow the moderation evidence rule instead.
8. How we protect data
- All traffic is encrypted with HTTPS, and data is encrypted at rest by our providers.
- Each publisher can only reach their own data. Database rules enforce this, not just the app.
- Instagram and YouTube access tokens are encrypted by the app (AES-256-GCM) before they’re stored, and never logged.
- IP addresses and email-log recipients are stored only as keyed hashes.
- Passwords are never stored in readable form, only as salted hashes by our sign-in provider, and every account verifies its email address.
- Pages are served with strict security headers, and forms are protected against spam and abuse.
- Only a small number of authorised operators can see moderation data, and every action they take is logged.
9. International transfers
Our database and files are stored in India (Mumbai, AWS ap-south-1). Some sub-processors work in other countries, including the United States. Where data leaves the country it was collected in, we rely on safeguards the law recognises, such as standard contractual clauses or adequacy decisions.
10. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how it’s used, and withdraw consent at any time. You can also complain to your data protection authority.
- Publishers: export your data and delete your account in Settings. Our data deletion instructions explain the steps, including how to remove your Instagram or YouTube data. For anything else, email rakeshgandla205@gmail.com.
- Visitors: every email you get from a page has a link to remove your details. For other requests, contact the page’s publisher first, using the details and privacy policy linked on their page. If you can’t reach them, email rakeshgandla205@gmail.com and we’ll help.
We answer requests within the time the law sets, and may need to confirm who you are first.
11. Children
lowcycle isn’t for anyone under 18, and we don’t knowingly collect their data. If you believe a child has given us personal data, email rakeshgandla205@gmail.com and we’ll delete it.
12. Changes and contact
We may update this policy. For an important change, we’ll tell publishers by email or in the app and ask them to accept the new version. The version number and date are at the top of this page.
For privacy questions, email rakeshgandla205@gmail.com. For complaints, contact our grievance officer:
Grievance officer: Rakesh GHyderabad, Telangana 500092, India
Email: rakeshgandla205@gmail.com
We acknowledge a complaint within 24 hours and resolve it within 15 days of receiving it.