Privacy Policy

Block or delete cookies in your browser settings. Strictly-necessary storage is limited to your theme choice and dismissed banners; blocking it costs you nothing but those preferences.

Opt out of Google Analytics with the Google Analytics opt-out browser add-on.

Opt out of Microsoft Clarity by enabling Global Privacy Control or your browser's Do Not Track signal, both of which we honour, or by blocking `clarity.ms`.

Ask us to erase the analytics data associated with you at hello@degird.com. Providing your Clarity or GA identifier makes this faster, but is not required.

Contact, support, and enquiry forms send their contents to us by email over an authenticated SMTP relay. We hold the resulting correspondence in our mailbox.

Newsletter subscriptions record your email address, the date, and the source page in a private Google Sheet accessed by a restricted service account. We use it to send product news, and for nothing else.

Every marketing email carries a one-click unsubscribe link, and unsubscribing is honoured immediately. Transactional messages — licence delivery, receipts, security notices, and end-of-life warnings — are not marketing and continue regardless, because you need them.

Forms are rate-limited by IP and email address to stop abuse. Those counters hold an IP address transiently and are not used for profiling.

Tubeup's API mode uses YouTube API Services. By using it you are also bound by the YouTube Terms of Service, and Google's handling of your data is governed by the Google Privacy Policy.

Authorisation uses Google OAuth. You sign in to Google directly — Tubeup never sees or stores your Google password. The resulting access and refresh tokens are stored locally on your device only.

Tubeup requests the narrowest scopes that its features need: uploading and managing videos on channels you authorise, and reading analytics for those channels. It does not request access to your Gmail, Drive, Contacts, Photos, or any other Google service.

API data retrieved from YouTube — channel lists, video statuses, analytics figures — is stored locally so the interface can display it, and is refreshed from YouTube rather than accumulated by us.

You can revoke Tubeup's access to your Google account at any time at myaccount.google.com/permissions. Revocation is immediate and takes effect regardless of anything stored locally.

To delete locally stored Google data, sign out of the channel inside Tubeup or uninstall the application and remove its application-data folder. Because the data is local, deletion is entirely under your control.

When you ask Tubeup to generate metadata, it sends only the text needed for that request — such as a working title, filename, topic, or description you provide — to Google Gemini, and returns the suggestion to your machine.

Video files are never sent to the AI provider. Only text you have chosen to submit leaves your device, and only when you trigger generation.

Neither Degird nor the provider uses your prompts or outputs to train models. See Section 17.

If you would rather nothing left the machine at all, simply do not use the AI features — every other function of Tubeup works without them.

Tubeup contacts the licence service operated by our merchant of record to validate activation and entitlement. That exchange carries the licence key, a hashed device identifier, the product version, and the OS platform.

It does not carry your video files, metadata, channel names, Google tokens, or any content. Its only purpose is confirming that the seat you are using is one you paid for.

Our WordPress plugins execute within your own WordPress installation, on hosting you choose and control. They write to your database and read from it. They do not transmit site data, user data, post content, or analytics to Degird.

GuestDock stores guest submissions, contributor details, and editorial state in your database. Those contributors are your data subjects and you are their controller; Degird is not involved in that processing.

AuthDock stores authentication events, failed-login records, lockout state, and IP addresses in your database for security purposes. IP addresses are personal data in many jurisdictions, so configure retention to match your own policy — the plugin gives you that control precisely so the decision stays yours.

SyncDock stores API credentials and publishing logs in your database. Content flows between your site and whichever client you authorise. Degird operates no relay in that path and holds no copy.

Plugin updates are delivered through the WordPress.org directory. Update checks are made by your WordPress installation to WordPress.org, under WordPress.org's own privacy policy, not to us.

Because we hold no data from these plugins, a data-subject request about a WordPress site must go to the site's operator. We will help that operator technically, but we cannot answer for data we have never had.

Extensions request only the permissions their stated features require. Where an extension needs host access to function on a page, that access is used for the feature and nothing else — not for reading, logging, or transmitting page content.

No Degird extension collects browsing history, keystrokes, form contents, or page text, and none sells or shares data with anyone. This is also a condition of remaining listed under Chrome Web Store user-data policies, against which our listings are auditable.

Domain Checker queries public domain-registration data. Those lookups reveal to the queried endpoint which domains you are checking, in the same way any WHOIS or RDAP lookup does. They do not identify you to Degird, because they do not pass through us.

Uninstalling an extension removes its local data. Where you want a clean slate without uninstalling, each extension offers a reset in its own settings.

Where you sign in to a browser profile with sync enabled, your browser vendor may sync extension storage across your devices under its own policy. That is your browser's behaviour, not ours, and you control it in your browser settings.

Dormefy is a hosted platform used by dormitories, hostels, universities, and mess committees to manage rooms, residents, meal schedules, and billing. The institution operating a tenant is the controller; Degird is its processor.

A tenant may contain resident names, contact details, room assignments, guardian contacts, meal records, attendance, and payment history. That data is entered and governed by the institution, and we process it only to run the service and only on the institution's documented instructions.

Degird does not sell tenant data, does not use it for marketing, does not use it to train AI models, and does not share it between tenants. Tenants are logically isolated from one another.

Residents and guardians: direct access, correction, and deletion requests to the institution that operates your dormitory's account. They hold the relationship and the authority. If you cannot reach them, contact us and we will do our best to route your request to the right person.

Institutions: a Data Processing Agreement with the EU Standard Contractual Clauses, a current subprocessor list, and a security overview are available on request from hello@degird.com.

We notify a controller without undue delay, and in any event within 72 hours of becoming aware of a personal-data breach affecting their tenant, with the information needed for their own regulatory notifications.

On termination, tenant data is available for export for 30 days and is then deleted per Section 14.

Pulse and Caster will be added to this section with their actual data behaviour before they become generally available.

During an agency engagement you may give us brand assets, footage, copy, analytics access, staging credentials, or datasets. We use them solely to deliver the agreed scope.

Credentials you share are stored in access-controlled systems, limited to the team members working on your engagement, and revoked or rotated at project close. We will always tell you when we no longer need access.

Where project materials contain personal data — customer lists, testimonial footage, user research — you are the controller and we act as your processor under a DPA available on request.

We retain project files for 12 months after delivery so we can support handover and reissue deliverables, then delete them unless you ask us to keep them longer or a retainer is ongoing.

Portfolio use is governed by Terms §19. Where an engagement is under NDA, or where you simply ask us not to, nothing about it is published — including in this context.

Contract, invoice, and tax records are kept for the statutory period under Section 14, as controller, regardless of project deletion.

Legal requirements. We may disclose data where compelled by a valid legal process. We check that a demand is valid and proportionate, we disclose only the minimum required, and we notify you unless legally prohibited from doing so.

Rights protection. We may disclose data where necessary to investigate suspected fraud, licence circumvention, or a threat to the safety or rights of any person — the enforcement route described in Terms §12.

Corporate transaction. If Degird is involved in a merger, acquisition, or asset sale, data may transfer as part of it. You will be notified before your data becomes subject to a materially different policy, and this policy continues to apply until then.

With your direction. Where you connect a Degird product to a third-party service, data flows to that service because you asked it to, under that service's own policy.

Degird operates from Dhaka, Bangladesh, and our providers operate infrastructure in several regions. Personal data may therefore be processed outside your country, including outside the EEA and the UK.

Bangladesh has not received an adequacy decision from the European Commission or the UK government. Where we transfer personal data from the EEA, the UK, or Switzerland, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) and the UK International Data Transfer Addendum, supplemented where needed by additional technical and organisational measures.

We carry out transfer impact assessments where required, and apply encryption in transit and at rest, access controls, and data minimisation so that the volume of personal data crossing borders is as small as the service allows.

Where a customer requires data residency in a specific region, contact us before purchase — we will tell you honestly whether we can meet it rather than after the fact.

A copy of the transfer mechanism relevant to your data is available from hello@degird.com.

In transit: all connections to our websites, hosted platforms, and APIs use TLS 1.2 or higher, with modern cipher suites and HSTS.

At rest: hosted data is encrypted with AES-256 or equivalent, and secrets and credentials are held in dedicated secret storage rather than in code or configuration files.

Access control: least privilege throughout. Production access is limited to the people who need it for a stated role, protected by multi-factor authentication, and reviewed periodically.

Isolation: hosted tenants are logically separated. Development and staging environments do not use production personal data.

Minimisation by architecture: the strongest control we have is not collecting data in the first place. Local processing in Tubeup, in-browser storage in extensions, and in-database storage in WordPress plugins mean most of our products create no central store to attack.

Monitoring: systems are monitored for anomalous access, rate-limit abuse, and error patterns, with alerting to on-call staff.

Dependencies: third-party libraries are tracked and patched, and we accept vulnerability reports under the safe harbour in Terms §25.

Breach response: where a personal-data breach is likely to result in risk to your rights, we notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk is high. We tell you what happened, what we did, and what you should do.

Honesty about limits: no system is perfectly secure. We do not claim certifications we do not hold, and we do not describe controls we have not implemented. Where you need a specific compliance artefact, ask and we will tell you plainly whether we have it.

Email hello@degird.com describing what you want. There is no form to fill in and no fee.

We verify identity proportionately — usually by confirming you control the email address on the account. For a broad request we may ask for more, and we will explain why.

We respond within 30 days. Where a request is genuinely complex we may extend by a further 60 days, and we will tell you within the first 30 that we are doing so, and why.

An authorised agent may act for you with written authorisation, subject to the same verification.

Where we hold your data as a processor — Dormefy tenants, agency project files — we will route your request to the controller and support them in answering it, because they hold the authority to decide.

Where a feature calls a third-party model provider — Google Gemini for Tubeup metadata today — we use API configurations under which submitted data is not retained for provider model training. That is a condition of our using a provider, not an assumption we make about them.

Only the text needed for the specific request is transmitted. Video files, media, credentials, and unrelated project data are never sent to an AI provider.

AI features are opt-in by action: nothing is sent until you trigger generation. Products remain fully functional if you never use them.

Providers may retain prompts briefly for abuse monitoring under their own policies. We link those policies in Terms §17 so you can read the actual terms rather than our summary of them.

We do not build behavioural profiles of you, and we do not use AI to make decisions about your account.

This is reciprocal with Terms §13, where we reserve our own content against AI training. We ask for that protection, so we extend it.

Degird products are intended for adults and for professional use. You must be at least 16 years old — or the minimum digital-consent age in your country, if higher — to create an account or buy a licence in your own name.

We do not knowingly collect personal data from children. If we learn we have, we delete it promptly.

Dormefy may contain records of residents who are minors, entered by the institution operating the tenant. That institution is the controller and is responsible for the lawful basis, parental or guardian consent where required, and the notices given to residents and guardians. Degird processes those records only on the institution's instructions and never for its own purposes.

If you believe a child has provided us with personal data, contact hello@degird.com and we will investigate and delete it.

We update this policy when we launch products, change providers, or improve our practices. The version and effective date at the top of this page always identify the operative revision.

For material changes — a new category of data, a new purpose, a new processor, or a reduction in your controls — we give at least 30 days' notice before they take effect, and notify account holders by email or in-product notice.

Clarifications, corrections, and structural edits take effect on publication.

New products are documented here before general availability, so this policy describes what ships rather than catching up with it.

We will never apply a materially different use to data already collected without a fresh lawful basis, which for consent-based processing means asking you again.

Previous versions are available on request. If a change is one you cannot accept, exercise your rights under Section 16 — including deletion.

Tell us first. Most complaints come from a gap in explanation rather than a gap in practice, and we would rather fix it directly and quickly.

EEA residents may lodge a complaint with the supervisory authority in their country of residence, workplace, or the place of the alleged infringement. UK residents may complain to the Information Commissioner's Office at ico.org.uk.

Canadian residents may complain to the Office of the Privacy Commissioner of Canada. Australian residents may complain to the OAIC. US state residents may contact their state Attorney General.

You retain every right to a judicial remedy, and nothing in this policy or in our Terms of Service limits it.