Privacy Policy — InCharacter Agency Creator Portal

The InCharacter Agency Creator Portal is operated by ICA Media Ltd, trading as InCharacter Agency ("ICA", "we", "us" or "our").

ICA Media Ltd is a private limited company registered in England and Wales under company number 14437649.

Registered office:

The InCharacter Agency Creator Portal is provided to creators represented by ICA and allows authorised creators to securely connect services such as YouTube so ICA can access verified creator, channel and audience information used in connection with creator representation and relevant commercial opportunities.

When a creator connects a Google/YouTube account, the Creator Portal may access information authorised by the creator through Google OAuth.

This may include:

• YouTube channel identity and channel information
• Subscriber and channel statistics
• Video and channel performance information
• Audience geography
• Audience age ranges
• Audience gender information
• Information necessary to identify and maintain the authorised YouTube connection

Only information made available through the permissions granted by the creator is accessed.

The Creator Portal uses read-only Google and YouTube permissions to access information authorised by the creator.

This allows InCharacter Agency to access:

• YouTube channel information
• channel and video performance data
• subscriber information
• audience geography
• audience age ranges
• audience gender information

These permissions are read-only.

They do not allow InCharacter Agency to:

• upload creator content
• edit creator content
• delete creator content
• publish creator content
• change YouTube channel settings
• post or modify content on the creator's behalf

Google and YouTube user data accessed through the Creator Portal is used only for purposes related to creator representation by InCharacter Agency.

This includes:

• Maintaining accurate creator records
• Accessing verified YouTube channel information
• Accessing verified audience demographics
• Preparing creator profile information
• Supporting commercial opportunities and brand enquiries relevant to the creator
• Reducing the need for creators to manually provide analytics screenshots

Google user data is not used for unrelated purposes.

Authorised YouTube information and analytics may be stored within the ICA BrainGain system so ICA can maintain current creator records and previously retrieved analytics snapshots.

This may include:

• Creator and channel identifiers
• Retrieved channel information
• Audience demographic snapshots
• Connection status
• Last-sync information
• OAuth connection information required to maintain the authorised integration

Creator information held within BrainGain is intended for authorised InCharacter Agency personnel who require access for creator management and commercial representation.

A Creator Portal account is linked to one creator. The portal shows that creator their own profile and their own YouTube connection, and nothing belonging to another creator.

Creator Portal accounts have no access to ICA's internal BrainGain tools, and creator accounts cannot create, list or revoke portal invitations: those actions are available only to authorised InCharacter Agency personnel.

The Creator Portal is not intended to expose one creator's information to another creator.

ICA may use relevant creator channel and audience information when communicating with brands, agencies, publishers or other potential commercial partners in connection with creator representation and potential commercial opportunities.

Where ICA provides creator audience information to a brand, agency or publisher, it does so in connection with a specific enquiry or opportunity relevant to that creator, and provides only the information relevant to that enquiry. ICA does not give brands, agencies or publishers access to a creator's Google account or YouTube connection.

We also use service providers that host and operate the Creator Portal and its database, and professional advisers where necessary. They act on our instructions and are subject to confidentiality obligations.

ICA does not sell Google user data.

Section 12 explains which information comes from Google and which is ICA's own business record, and section 15 lists recipients and international transfers.

InCharacter Agency's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

Google's own handling of your information is described in the Google Privacy Policy. You can review or remove the access ICA holds at any time from your Google Account permissions.

Creators may disconnect their YouTube account from the Creator Portal using the available disconnect functionality.

When disconnected:

• ICA will stop making new authorised YouTube Analytics requests using that connection
• The stored Google authorisation for that connection (access token and refresh token) is deleted, so no further data can be retrieved
• The creator may reconnect later if appropriate

Disconnecting also asks Google to revoke the authorisation itself, and then deletes the YouTube data we retrieved: stored channel information, YouTube statistics, the derived average-view figure, and the cached audience demographic snapshots. The creator's InCharacter Agency record is kept, because that is ICA's own roster and commercial record, not Google data.

Where Google confirms the revocation we tell the creator it was confirmed. If Google does not confirm it, we say so rather than implying the grant is gone, and the creator can also revoke access directly at any time from Google's permissions page. Once access is revoked, ICA can no longer retrieve data through that connection, and reconnecting requires the creator to authorise the Creator Portal again.

Creators may contact InCharacter Agency to request deletion of Creator Portal information associated with their account, subject to any information ICA is required or legitimately entitled to retain for legal, contractual, accounting or business-record purposes.

A deletion request covers the stored Google authorisation and every item of Google/YouTube API data we hold for that creator: retrieved channel information, YouTube statistics, the derived average-view figure and the audience demographic snapshots. Where a deletion request still has a live connection behind it, we revoke that authorisation at Google as well, so deleted data cannot be retrieved again afterwards.

Deletion requests are actioned as soon as possible and within seven calendar days. Each one is recorded in an internal deletion log — request date, policy deadline, what was deleted and any error — so authorised InCharacter Agency staff can review its status. You can also stop us retrieving data at any time by disconnecting YouTube in the Creator Portal.

Requests may be made by email to icabraingain@Incharacteragency.com or by post to:

Company number: 14437649

This section explains the technical and organisational measures InCharacter Agency uses to protect the Google and YouTube data accessed through the Creator Portal.

Encrypted connections

The Creator Portal is served only over HTTPS. All requests between your browser and the Creator Portal, and all requests made from our servers to Google's APIs, are made over encrypted HTTPS connections. We never ask for, receive or store your Google account password: access is granted only through Google's own authorisation screen.

Server-side handling of Google authorisation

The Google authorisation exchange is completed on our servers. Our Google OAuth client credentials (client ID and client secret) are held as server-side secrets and are never sent to, or stored in, the Creator Portal in your browser.

The access and refresh tokens Google issues are stored in a server-only credential record, together with the connection status. Creator Portal accounts cannot read that record at all. Within ICA, access to it is limited to the server-side processes that retrieve your YouTube data and to authorised InCharacter Agency administrators; the refresh token is used only to obtain a new access token for your own channel, to reconfirm your authorisation, and to revoke the authorisation when you disconnect.

Separation of internal and creator accounts

Every account is explicitly classified as either an InCharacter Agency internal staff account or a creator portal account. Being signed in is not by itself permission to see data: internal BrainGain tools are unavailable to creator accounts, and creator records, invite records, stored YouTube credentials and retrieved audience snapshots are restricted to authorised ICA access.

Creator account separation

A creator portal account is linked to a single creator and is shown only that creator's own profile and YouTube connection. Portal accounts cannot view, invite or manage other creators.

This is enforced at the database level, not only on screen. Creator records are restricted to authorised InCharacter Agency access, so a signed-in creator cannot list, create, edit or delete creator records, and cannot reach another creator's data by changing an identifier in a request. Anonymous visitors cannot read creator records at all. Your own creator information reaches your portal through a server-side request that identifies you from your own account and returns only the creator-facing fields you are allowed to see — the browser never supplies the creator identifier we use to look a record up.

Invitations and portal access

Creator Portal invitations are deliberately narrow:

• each invitation is a single-use link containing an unguessable randomly generated token that encodes no creator information
• invitations expire after 7 days and can be revoked by ICA at any time
• a claimed invitation cannot be used again, and can only be claimed by the signed-in Google account that claims it
• an InCharacter Agency internal staff account cannot be used to claim a creator invitation
• invite records are never readable from the browser: they are handled only by our server, and creator accounts cannot create, list or revoke them

Protection against unauthorised disclosure

Retrieved channel data and audience snapshots are held within the internal ICA BrainGain system, restricted to authorised InCharacter Agency access. They are not published, are not sold, and are not made available to other creators. We do not disclose Google user data to third parties except as described in section 7, and connections are made only over encrypted HTTPS.

Revocation, retention and deletion

You can disconnect YouTube in the Creator Portal at any time (section 9). Disconnecting stops retrieval immediately, asks Google to revoke the authorisation, and deletes the stored Google authorisation and the YouTube API data we retrieved. Deletion requests made by email (section 10) are actioned within seven calendar days.

We also check whether each connection is still authorised. A nightly automated check revalidates every stored connection, so each creator's authorisation is reconfirmed at least every 30 days while we retain their analytics. Where Google reports that a creator has revoked access, the stored YouTube data for that connection is deleted. Transient failures, such as a network error or a temporary Google outage, are treated as temporary and do not cause deletion.

We do not claim encryption of stored data at rest, nor any security certification, and we do not apply a fixed retention period to retrieved analytics. Deleted data cannot be automatically restored from a cache: once the stored authorisation is removed there is no connection left to retrieve it again, and reconnecting requires the creator's fresh authorisation.

We hold two distinct kinds of information about a creator. It is important not to confuse them, because different rules apply to each.

Information derived from Google APIs

This is information we obtain through the YouTube connection you authorise: your YouTube channel identifier and channel information, channel and video statistics, the average-view figure we derive from those statistics, and the audience geography, age and gender snapshots we retrieve. It also includes the OAuth access and refresh tokens that maintain the connection. This information exists only because you granted the connection, and it is deleted when you disconnect, when Google reports that access has been revoked, or when you request deletion (sections 9 and 10).

ICA's own business records

This is information InCharacter Agency holds in its own right as your representative, independently of YouTube: your roster identity and contact details, your representation and agreement details, agreed or estimated commercial rates, campaign and contractual records, invoicing and accounting records, and internal commercial notes and assessments. These records exist whether or not a YouTube account is connected, and disconnecting YouTube or deleting your YouTube API data does not delete them. They are governed by your agreements with ICA and by applicable law, and are kept as described in section 14.

UK data protection law requires us to have a lawful basis for each purpose for which we use personal information. The bases ICA has identified for the processing described in this policy are set out below.

Consent

For the YouTube connection itself: it is your decision whether to authorise it, and you choose the read-only permissions on Google's own authorisation screen. You can withdraw it at any time by disconnecting in the Creator Portal (section 9) or from your Google Account permissions page. Withdrawing it stops the Google-derived processing described in section 12.

Performance of a contract

For maintaining your creator record, providing the Creator Portal, and supporting your representation and relevant commercial opportunities, where you have an agreement with ICA.

Legitimate interests

For operating the Creator Portal securely, keeping creator records accurate, preventing misuse and unauthorised access, and responding to brand, agency and publisher enquiries relevant to creators ICA represents, where those interests are not overridden by your rights and freedoms.

Legal obligation

For retaining records where we are required to do so by law, for example accounting and tax requirements.

ICA is confirming the basis recorded for each purpose with its legal advisers. This section does not create any new use of your information: it records the basis for the processing already described in sections 2 to 12, and it applies to information about creators and about people who contact ICA about a creator. Section 16 explains your rights, including the right to object to processing based on legitimate interests.

We keep Google-derived information and ICA business records on different timelines.

Google-derived information

• while YouTube stays connected: your channel information and statistics are refreshed on sync, and the 30-day and 90-day audience snapshots stored for your channel are replaced on each sync rather than accumulated
• authorisation is reconfirmed at least every 30 days while we retain your analytics; where Google reports the authorisation has been revoked, the stored YouTube data for that connection is deleted
• on disconnection: the stored OAuth tokens and the YouTube API data we retrieved are deleted when you disconnect (section 9)
• on request: deletion requests are actioned as soon as possible and within seven calendar days (section 10)

We do not apply a fixed retention period to retrieved analytics: they are kept for as long as the connection you authorised remains active, and deleted when it ends.

ICA business records

Roster, representation, contractual, campaign and accounting records are kept for the duration of your relationship with ICA and afterwards for as long as needed for the purposes in section 13, including any statutory record-keeping period that applies to accounting and tax records, and in line with any agreement you have with ICA. ICA is confirming the specific retention period that applies to roster and contract records and will update this section when that is settled.

Recipients

• Google: as the provider of the APIs you authorise, when you connect your account, when we reconfirm the authorisation, and when we ask Google to revoke it
• our hosting and technology providers, who operate the Creator Portal, its database and its file storage on our instructions
• professional advisers, such as legal and accounting advisers, where necessary
• brands, agencies, publishers and other potential commercial partners, as described in section 7
• courts, regulators or law enforcement, where we are required by law to disclose information

Any provider acting for us is required to keep information confidential and to handle it only on our instructions. We do not sell Google user data.

International transfers

Google operates globally, and our hosting and database providers may process information in countries outside the United Kingdom. Where information covered by this policy is transferred outside the UK, ICA must ensure an appropriate safeguard is in place for that transfer.

ICA is confirming which specific safeguard applies to each provider. This section will be updated to name the mechanism relied on; we do not wish to state a safeguard we have not yet verified.

Subject to applicable law, you have the right to:

• be informed about how your information is used, which is the purpose of this policy
• request access to the information we hold about you
• ask us to correct information that is inaccurate or incomplete
• ask us to delete information, as described in section 10
• ask us to restrict what we do with your information while a concern is looked into
• object to processing we carry out on the basis of legitimate interests
• receive information you provided to us in a portable format, where that right applies
• withdraw consent for the YouTube connection at any time, without affecting processing that already took place

These rights are not absolute. Some information may be exempt, and we may need to keep records where the law requires it, or where they are needed to establish, exercise or defend legal claims, or to perform an agreement with you. Where that applies we will explain it when we respond.

To exercise any of these rights, contact us using the details in section 19. We will respond within one month, and will tell you if we need to extend that period.

If you have a concern about how we have handled your information, please contact us first using the details in section 19 so we have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at any time:

ico.org.uk/make-a-complaint

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

Helpline: 0303 123 1113

ICA may update this Privacy Policy from time to time as the Creator Portal develops or applicable requirements change.

The latest version will be published at https://icabraingain.com/privacy and will display the most recent update date.

For questions regarding the InCharacter Agency Creator Portal, our use of Google or YouTube data, this Privacy Policy, or requests relating to Creator Portal data, please contact InCharacter Agency using ICA's official contact details.

Email: icabraingain@Incharacteragency.com

Postal correspondence may be sent to:

Company number: 14437649