Orbikit
Français

Privacy policy

Last updated: November 6, 2026

1. Who we are

Orbikit is published by Thomas Schneider EI, 8 bis rue Abel, 75012 Paris, SIREN 879946069 RCS Paris, the controller of your personal data. For any question: privacy@orbikit.com.

2. What the service does

Orbikit collects every day the statistics of the YouTube channels you connect and shows them to you as history, charts, alerts and reports; it notes the changes to your videos, helps you follow your partnerships with brands, and lets you write to support from the "Help" page. If you allow it, it changes your videos and channel on YouTube, only at your request. The data is only used to provide this service to you: your dashboard, your alerts, your reports and your reminders.

3. Data we process

  • Your account: e-mail address, password (stored only as a hash), language, sign-up and address confirmation dates, the day of your last visit, e-mail preferences; if you turn on two-factor authentication, its secret (encrypted) and your backup codes (hashed). If you sign in with Google: the identifier Google gives your account and the e-mail address Google verified, only to identify you; Orbikit only asks Google for your name, e-mail address and profile picture, and keeps only the identifier and the address. This is not the access to your channel, which is asked separately.
  • Your connected channels: channel id, name and picture on YouTube (the picture's address, which your browser reads from YouTube), access tokens (encrypted), connection dates.
  • Your paid subscription: the plan chosen, its state and dates (start, next payment, cancellation asked, declined payment), your name or your business name, whether you are an individual or a business, the SIREN number of a business registered in France, the billing address, and the ids of your customer account and subscription at Stripe; your invoices and credit notes. Your payment details are entered on Stripe's page: Orbikit neither sees nor keeps them.
  • Your statistics: subscriber count, subscribers gained and lost, views and engaged views, and for your videos their id, date and counters (views, likes, comments); for each video and each day, its views, watch time, likes and comments, subscribers gained, the number of impressions of its thumbnail and its click-through rate, and the impressions and clicks of its end screens, as provided by YouTube; during the 48 hours after a video is published, its view counter read every hour; each week, the YouTube searches that brought views to your channel (the first 25, with their views), as provided by YouTube; the title, length and format (video, Short, live stream) of each video, and, for the calendar, the date of its scheduled publication or of its upcoming live stream or premiere, cleared once past; for the catalogue review, whether it has subtitles, a custom thumbnail, chapters (and whether they follow YouTube's rule) and tags, the number of hashtags, whether the "Paid promotion" box is ticked and whether the description mentions a partnership, the links of its description with the result of their check, and the restrictions and settings YouTube gives for each video (age limit, number of countries where it is blocked, "made for kids" declaration, whether an audio language is set, whether embedding is allowed, a rejected upload and its reason, whether the video is vertical or square), as yes or no answers; for the channel review, its settings (description, keywords, trailer, country, language, translations, home page sections) are read when the page opens, kept 6 hours at most for display, never stored. To pin automatic notes on your charts when a video changes (title, description, tags, chapters, subtitles, custom thumbnail, visibility), we also keep the visibility of each video, a fingerprint of its description and tags from which their text cannot be recovered (the thumbnail image is never downloaded), and, for 30 days at most, the previous title of a renamed video. We store neither the description nor the content of your videos.
  • Your dated notes: the day and text you add on your charts, until you remove them.
  • Your sign-ins: for each sign-in to your account, the moment, the kind of browser and system (never the browser's details nor the IP address) and how you signed in, for 90 days, so you notice a sign-in that is not yours; an e-mail warns you of a sign-in from a kind of browser and system you have not used in the last 90 days. To slow down password guessing, failed sign-ins on an address are counted as a fingerprint, without the IP address, for 48 hours at most; past a few failures, an e-mail tells you, at most once a day, and past 100 in a day, sign-in by password is stopped until you choose a new password, or for 24 hours at most; a browser you marked as trusted for two-factor authentication still signs in.
  • Your device notifications: if you turn notifications on in a browser, the address and keys that browser gives us to receive them, and its kind, until you remove them, change your password or the browser cancels them; an e-mail tells you of each browser added; each notification holds only the kind of alert, the channel's name and a link, never a figure; it goes through the browser's notification service (Google, Apple or Mozilla depending on the browser), encrypted for it alone.
  • Your calendar: built on display from your partnerships, the changes Orbikit has scheduled and the dates YouTube gives for your videos; the .ics file you download holds your partnership deadlines and your scheduled changes only. If you add your deadlines to your phone's calendar, a secret address of your own is created, kept encrypted like your YouTube access and shown on the Calendar page when you are signed in with your password; you can replace or delete it at any time, and a new password deletes it too; your phone reads your partnership deadlines and your scheduled changes there, with nothing that comes from YouTube (no title, no channel name, no date taken from your videos), and we keep no record of its readings.
  • Your series: the series or format label you give a video, until you remove it or the video is deleted.
  • Your goals: the measure, value and date you choose, and the date the goal is reached, until you remove it.
  • Your followed sponsored videos: the video, the brand name and the sponsored segment (start and end) if you enter them, and the reports already sent, until you stop following it or the video is deleted.
  • Your media kit: the statistics you choose to show in it and the texts you enter (presentation, topics, partnerships, formats, rates, contact).
  • Your partnerships, Orbikit links and collaborators: what you enter about your partnerships with brands and the proposals received, the links you create and their clicks per day, the address of the people you invite and their rights; details and retention in section 6.
  • Your activity, if you answer these optional questions: your partnerships with brands and how many a year, how you handle them, your networks and what would help you, as choices only; kept with your account and deleted with it, changeable or erasable in the settings, they are only used in totals to improve Orbikit, never read person by person.
  • Your help requests: the subject and the messages you write to support from the "Help" page, our answers, their dates and their status.
  • Pre-registration (before the opening, without an account): the e-mail address you leave, the language of the page, and the dates of pre-registration and confirmation.
  • Technical data: server logs needed for security and operation.
  • Visits of the website (orbikit.com): for each page requested, its address, the time, the name of the site you came from (not the page), your browser's language and type; never an IP address or a cookie. Each night these lines are turned into totals per day (page views, referring sites, languages, requests of declared robots, addresses that do not exist). Opening the pre-registration from the website is counted the same way, per day and language. No third-party analytics tool. The website also carries a small audience measurement script (the open-source software Umami), hosted on our own server, without cookie or storage in your browser: it sends us the page address (without what follows the "?", except the "utm" parameters of our own links, which tell which social network the visit comes from), the site you came from, the language, the screen size and the kind of device, and clicks on the sign-up, pricing and language buttons. Your IP address and your browser's name only serve to compute a fingerprint, renewed every day, which cannot identify you, and the country; the IP address is not kept. The script honours your browser's "Do Not Track" signal. If you use the website's offer checker, without an account, the message you paste is read in memory, the result is sent back to you and nothing is saved, neither the text nor the result; your IP address only serves, for an hour at most, to limit the number of checks; to know whether a site named in it is recent, Orbikit asks the public registry of its extension (RDAP) for its creation date, sending only the domain name, and keeps the answer for a day; we count, per day and with no link to you, the number of checks, of results by level and of signs found. The pages of the application itself carry no measurement script: we only count, per day and with no link to your account, how many times each page is opened and each action done, and each account keeps the day of its last visit.

We store no data about your individual subscribers or viewers, nor about any channel other than yours. The names of comment and Super Chat authors are read on YouTube when you open the page that shows them, and never stored.

4. Purposes and legal bases

  • Providing the service you asked for: performance of the contract.
  • Securing the service and preventing fraud: legitimate interest.
  • Measuring visits of the website, without cookie or IP address kept, to know which pages are read and where visitors come from, and the use of the application in numbers only, to improve it: legitimate interest.
  • Telling you when Orbikit opens, if you pre-registered: your consent, given by ticking the box and then confirming from the e-mail you receive. You can withdraw it at any time with the link on the confirmation page or by writing to us.
  • Meeting our legal obligations, for example accounting once paid subscriptions are in place.

Your data is never sold, rented or used for advertising, profiling or training artificial intelligence models.

5. YouTube

The service uses the YouTube API Services. By connecting a channel, you agree to the YouTube Terms of Service. Google's processing of your data is governed by the Google Privacy Policy.

  • Access requested: read-only access to your channel (youtube.readonly) and its analytics (yt-analytics.readonly). Only if you open the "Revenue" page and accept it: read-only access to its estimated revenue (yt-analytics-monetary.readonly). Only if you subscribe and click "Allow Orbikit to change my videos": management of your channel (youtube.force-ssl), asked separately, for the changes and comments described below.
  • Revenue: estimated revenue, CPMs, monetised playbacks, their split by country and by format, ad impressions and their CPM by ad type, and the videos that earned most are read from YouTube when you open the "Revenue" page, kept 6 hours at most for display, never stored, and visible to you only, and to the collaborators you expressly give this right to. If you receive alerts, the revenue of the last two weeks is also read every Wednesday to tell you of a sharp fall, and the total revenue of the last 31 days to warn you of an activity too low for the Partner Program rules, then forgotten. To take this access back, disconnect the channel in Orbikit, or use your Google account: Google removes Orbikit's access as a whole.
  • We keep your channel statistics as long as the channel stays connected, and check at least every 30 days that your authorisation is still valid.
  • With the Free plan, if nobody comes to Orbikit for 30 days, nothing more is read on YouTube for your channels; collection starts again at the next visit, and the missing history is read again from YouTube. This is what the day of your last visit is for, besides deleting an unused account.
  • At least every 25 days, we read each of your stored videos again from YouTube: its counters, title, length and date are updated, and a video deleted on YouTube is deleted here too. A title or length that could not be read again for 30 days is erased, like the catalogue review answers. To find dead links, our server opens each link of your descriptions about once a week, sending nothing but the request for the page. Your channel's name and picture are refreshed on every collection.
  • To know without delay that a video has just been published, we subscribe your channel to YouTube's new video notifications (a Google service called "PubSubHubbub"): only the public id of the channel is sent to it, with the address where to notify us. The subscription is removed when the channel stops being collected.
  • To record impressions, click-through rate and end screens, and since 14 October 2026 impressions by source and device, views by detailed source (name of the external site, hashtag, sound page, video of your channel suggesting another, playlist), by playback place and by site embedding your videos, the languages of the subtitles shown and shares by service, we create reporting jobs for your channel with the YouTube Reporting API; each figure is summed per day for the whole channel (a video of another channel suggesting yours is never named), kept while the channel is collected, and the jobs are deleted when you disconnect the channel.
  • For the media kit, the sponsored video report, the check of the promo code and the brand's link in the description of your partnerships' videos (only the yes or no answer is kept, 6 hours at most), the titles and descriptions backup and the traffic source, audience and retention pages, we read from YouTube, when you ask for them, your video titles, countries, traffic sources and the YouTube searches that led to your videos, viewer age group and gender (percentages provided by YouTube), devices and playback places, the share of subscribers, the retention of each video, cards, live stream viewers, playlists, their titles and the videos they hold, watch time, the Super Chats of your live streams of the last 30 days (amount, viewer's name, message), and for the backup the titles, descriptions and tags of your videos. This data is only used to produce the document or page you view and is not stored; it is kept 6 hours at most in a cache so as not to ask YouTube on every view, and that cache is emptied as soon as the channel is disconnected. For a sponsored video you follow, we read it the same way at each date (D+7, D+30, D+90) and e-mail the report to you alone.
  • You can revoke access at any time from the app, or from the permissions page of your Google account.

Orbikit's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Retention

  • Account: as long as it is active. You can delete it at any time from the settings.
  • Data of a connected channel: deleted at the latest 7 days after it is disconnected, your account is deleted, the authorisation is revoked or a deletion is requested.
  • Unused account: if nobody signs in to your account for 24 months, it is deleted with your channels and their data (the authorisation is revoked with Google), after a warning e-mail a week before. When a subscription ends, nothing is deleted: your account goes back to the Free plan, one channel is still collected and the others are paused.
  • Backups: an encrypted copy of the database is made every night and kept for 31 days. Deleted data therefore leaves the backups at the latest 31 days after its deletion; a backup is never used to bring it back.
  • Deletion journal: when your account or a connected channel is deleted, we note a one-way encrypted fingerprint of the e-mail address or id, with the date, for 40 days. It is used to delete that data again if a backup ever had to be restored.
  • Deletion log: the date and reason of each deletion, with no personal data, so that we can prove it.
  • Visits of the website: log lines are deleted at the latest 4 days after the visit; the totals per day, which are about no one in particular, are kept; in the audience measurement tool, a visitor's fingerprint lasts one day and visits are kept as totals. Usage counters of the application: 2 years; day of an account's last visit: deleted with the account.
  • Help requests: read by the publisher of Orbikit, or by a person in charge of support bound to confidentiality, to answer you; deleted with your account, and at the latest 12 months after their last message. The e-mail telling you of an answer does not contain its text.
  • Pre-registration: an unconfirmed address gets a single reminder after 3 days and is deleted after 7 days; a confirmed address gets a single e-mail on opening day and is then deleted, and at the latest 12 months after pre-registering.
  • Address confirmation: at sign-up, an e-mail holds a link valid for 48 hours; no token is kept; a sign-up with Google needs none, the address being the one Google verified. Until the address is confirmed, the account can do nothing and gets no other e-mail; it is deleted 7 days after the sign-up if it was never confirmed.
  • Forgotten password: a token (hashed) and the date of the request; the link is valid for one hour, deleted once used and at the latest the next day.
  • Invitations sent by Orbikit (while sign-up is closed): the invited e-mail address and the dates it was sent and used, deleted 7 days after sending, whether the link was used or not.
  • Collaborators: the e-mail address of the people you invite to see your channels and the rights you give them (notes and goals, media kit and sponsored reports, exports, revenue), as long as their access exists; an unanswered invitation is deleted after 7 days. The log of rights given and taken back (address, right, date), which proves your approval, is kept until your account is deleted.
  • Paid subscription: the state of the subscription is kept with your account; invoices and credit notes for 10 years, as the law requires (French commercial code, article L123-22), even after your account is deleted, with the billing details they carry.
  • Document checks: for each PDF report or media kit, a code printed in the document, its kind, its date and a fingerprint of the file (SHA-256), without any figure, so that a brand can check on our public page that the file was not edited; deleted with the channel. A file sent for a check is compared, then forgotten.
  • Changes on YouTube: only if you subscribe and allow Orbikit to make changes on YouTube, a permission asked separately, on your click, after a page that says everything it allows, which you withdraw at any time by disconnecting the channel in Orbikit, or in your Google account (Google removes Orbikit's access as a whole). Orbikit only changes what you ask for: in descriptions, replacing a link, dead or with an Orbikit link, in those that have it, adding a disclosure, chapters, a common block or a campaign's text, removing or replacing a brand's link at the end of a contract, putting a title or description suggested by the assistant that you approve; adding or replacing the translation of a title and description you write (the video's language is then set if it is missing); putting a title test's titles online in turn, then the original title or the one you keep. Just before each change, it reads YouTube again, changes nothing you modified in the meantime, and sends the video's title, tags, category and language back unchanged. At your request, Orbikit can also add tags to a video that has none, change a video's settings (video and audio track language, category, visibility, with your confirmation, scheduled publication date, licence, embedding, public statistics, made for kids, altered or synthetic content, recording date), those of the channel (description, keywords, trailer, country, language, translations, home page sections, made for kids), your playlists and the watermark; these settings are read on YouTube when shown, never stored, and so are the existing translations, kept 6 hours at most in a cache. A thumbnail, a subtitle file or a watermark you send goes through Orbikit to YouTube without being kept. Orbikit never deletes a video, a comment or subtitles; it only removes a video from a playlist, a home page section or the watermark when you ask. A change you schedule is made without another click, unless you have stopped it: the common block at once on your click, then a few videos each morning; a campaign, a title test or an end of contract on the morning of the planned days; an e-mail then tells you what was changed. If you disconnect the channel, remove the access in your Google account or your access to Orbikit ends, what was scheduled stops and nothing is put back on YouTube; Orbikit tells you beforehand, or by e-mail, what stays there. The same permission lets Orbikit read the recent comments of your videos and those held for review, with the video's title, read on YouTube if missing: read when shown, kept one hour at most in a cache, never stored; an answer written in Orbikit is posted on YouTube as your channel and is not kept, and a held comment is published or rejected on your click. When you mark a comment as read, only its thread's id is kept, 30 days at most. We keep the trace of each change (video, kind of change, date, person who asked for it), without YouTube's text, 3 years at most, deleted with the channel. To be able to undo a description change, the video's previous description is kept 30 days at most, then deleted. We also keep what you write yourself for Orbikit: the text of your common block and the list of videos where Orbikit put it, your saved answers to comments, and, for a campaign, your text, the chosen videos and the dates, until the channel is deleted; the end-of-contract links and their date, until you stop following the video or the channel is deleted. For a title test: the titles, the original one included, and the days each was online, deleted 30 days after the test ends.
  • Partnerships: what you enter about your partnerships (brand, contact, brand website, status, amount, deposit, value of the products received, deliverables, dates, follow-ups, usage rights, exclusivity, place and length of the mention, views guarantee, promo code, payment method, invoice reference, video, notes), including the name and address of the brand's contact you choose to enter, until you delete them or the channel is deleted; used only to show them to you and send you reminders. If you open a page to receive proposals, what a brand sends there (brand, name, e-mail address, website, budget, message) becomes a partnership the same way; its IP address only serves, for one hour at most, to limit the number of sends, and is not recorded with the proposal. If you paste a brand's message to check an offer, the message is not saved, and the result (view, signs and quoted excerpts) only waits until it is shown to you once, five minutes at most, then is deleted; to tell whether a site it names is recent, Orbikit asks its creation date from the public registry of its extension (RDAP), sending only the domain name, and keeps the answer for a day.
  • Announcements in Discord or Slack: if you give a webhook address, we keep it as long as you leave it in your settings, and at each alert we send there only the kind of alert, the channel's name and a link to Orbikit, never a figure; the service you chose handles that message under its own rules.
  • Tracked links and Orbikit links: for each link you make, its name, the destination address, the result of the daily check of that destination (made only with a Creator subscription or above) and the number of clicks per day; nothing is kept about the people who click (no IP address, cookie or device); deleted with the link or the channel.
  • Export log: the date and format of each export you request (CSV or PDF file, media kit, sponsored video report), with the channel fingerprint instead of its id, for 3 years, so that we can show that the data left the service at your request.

7. Recipients

Your data is not shared with any third party. Only our technical providers access it to run the service, under contract: hosting (netcup GmbH, Nürnberg), e-mail delivery and encrypted backups (OVH SAS), and, for the writing assistant, Mistral AI (France), to which we only send the text you type in the assistant or the facts of a partnership you ask it to draft (brand, deliverable, dates, status, amount, deposit, usage rights, exclusivity, place and length of the mention, views guarantee, the brand's brief or last message if you paste it, and what you type that you want to tell it), or a brand's message you paste to fill in a partnership or check an offer, from which Orbikit first takes out e-mail addresses and phone numbers, never your YouTube data nor the e-mail address or phone number of the brand's contact; Mistral processes them in the European Union to answer you, deletes them right away and does not use them to train its models. We only keep the number of requests and tokens per day, for 13 months, and, for payments, Stripe (Stripe Payments Europe, Ireland), which receives your name, your e-mail address, your billing address, a business's SIREN number and your payment method, entered on its page; Stripe also processes them on its own behalf, to prevent fraud and meet its legal obligations, under its privacy policy, and may transfer them outside the European Union with the safeguards the GDPR provides. The data is hosted in the European Union. The people you invite as collaborators see your statistics, at your request, with only the rights you give them, until you remove their access, and get your monthly report if you chose so; each of them can stop their own copy, from the e-mail or their settings.

8. Security

Traffic is encrypted (HTTPS), passwords are hashed and YouTube access tokens are encrypted in the database. Each user can only access their own channels, and the ones shared with them, with the rights their owner gave them. To report a security vulnerability: abuse@orbikit.com.

9. Cookies

We only use strictly necessary cookies: sign-in session, the "keep me signed in" option and form protection. Your light or dark theme choice is kept in your browser. No analytics or advertising cookies.

10. Your rights

You have the right to access, rectify, erase, restrict, object to and port your data. From your settings, you can download at any time a file of everything you wrote or chose in Orbikit, and delete your account. Write to us at privacy@orbikit.com. You can also lodge a complaint with your data protection authority, in France the CNIL (cnil.fr).

11. Changes

We will inform you of any significant change to this policy before it takes effect.

Privacy Terms of use Terms of sale Orbikit