Privacy Policy

Awesome Creator Academy LLC ("TitleScoreCard," "we," "us," or "our") operates https://titlescorecard.com and related services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, APIs, and any related services (collectively, the "Service").

We are committed to protecting your privacy. This policy is designed to comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable data protection laws.

1.1 Information You Provide

• • Account Information: When you create an account via OAuth, we receive your display name, email address, and a unique identifier from the authentication provider.
• • Title Submissions: YouTube video titles you submit for analysis. These are processed in real-time and are not stored permanently unless you explicitly save them to your history.
• • Payment Information: When you purchase reports or subscriptions, payment is processed by Stripe. We do not store credit card numbers, CVVs, or full card details. We retain only Stripe customer IDs and transaction identifiers.

1.2 Information Collected Automatically

• • Usage Data: Pages visited, features used, timestamps, and interaction patterns to improve the Service.
• • Device Information: Browser type, operating system, and screen resolution for responsive design optimization.
• • Cookies and Session Data: We use essential cookies for authentication and session management. We do not use advertising or tracking cookies.

1.3 Information from Third-Party Sources

• • YouTube Data API: We access publicly available YouTube video metadata (titles, view counts, video duration, category information) through the YouTube Data API v3 for benchmarking and analysis purposes. This data is publicly available and does not include any private user data from YouTube.

2. How We Use Your Information

We use collected information for the following purposes:

3. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data under the following legal bases:

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• • Service Providers: With trusted third-party service providers who assist in operating our platform (hosting, payment processing, AI model inference), bound by contractual obligations to protect your data.
• • Legal Requirements: When required by law, regulation, legal process, or governmental request.
• • Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
• • Aggregated Data: We may share anonymized, aggregated statistical data (e.g., "titles with questions get 23% more views") that cannot be used to identify any individual user.

5. Third-Party Services and APIs

Our Service integrates with the following third-party services:

Our benchmarking corpus consists of publicly available YouTube video metadata collected through the YouTube Data API v3. This data is retained in aggregated, statistical form for benchmarking purposes. Individual video metadata snapshots are retained for a maximum of 180 days, after which they are either refreshed or purged in accordance with YouTube API Terms of Service requirements for data freshness.

All payment processing is handled by Stripe, Inc. When you make a purchase, your payment information is transmitted directly to Stripe's PCI DSS Level 1 certified infrastructure. We never receive, store, or process your full credit card number, CVV, or expiration date.

We retain only: Stripe Customer ID, Subscription ID, Payment Intent ID, and transaction metadata (amount, date, status) necessary for order fulfillment and customer support. For Stripe's data practices, see Stripe's Privacy Policy.

8. Data Retention

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, use the Data Deletion feature in your account settings, or contact us at [email protected]. We will respond within 30 days (GDPR) or 45 days (CCPA).

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• • Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• • Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• • Right to Opt-Out of Sale: We do not sell personal information. This right is satisfied by default.
• • Right to Correct: You can request correction of inaccurate personal information.
• • Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by the CPRA.

Do Not Sell or Share My Personal Information: We do not sell or share (as defined by the CCPA/CPRA) your personal information for cross-context behavioral advertising purposes.

Categories of Personal Information Collected: Identifiers (name, email), commercial information (purchase history), internet activity (usage data), and inferences drawn from the above.

11. International Data Transfers

Your data may be processed in the United States and other countries where our service providers operate. For transfers from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure adequate protection of your data.

We implement industry-standard security measures to protect your data, including:

• • TLS/HTTPS encryption for all data in transit
• • Encrypted database connections with SSL/TLS
• • Rate limiting and DDoS protection on all API endpoints
• • Content Security Policy (CSP) headers to prevent XSS attacks
• • Role-based access control for administrative functions
• • Regular dependency auditing and vulnerability patching
• • API key rotation and pool management for third-party integrations

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users in the event of a data breach, as required by applicable law.

13. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website with a new "Effective Date" and, where required by law, by email notification. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about our data practices, please contact us:

For EEA residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.