Privacy policy

Last updated 10 August 2026

CreatorFlow operates creatorflow.media, a marketplace that prices YouTube sponsor slots using analytics that creators choose to connect. This policy explains what we collect, why we are allowed to, and what control you keep. We aim for it to be as plain as the product.

Who we are

CreatorFlow is a trading name of NEON ATLAS LTD, a company registered in England and Wales under number 17390701, with its registered office at 61a Bridge Street, Kington, United Kingdom, HR5 3DJ. NEON ATLAS LTD is the controller of the personal data described here.

For anything in this policy, email [email protected] or write to us at the registered office above. We have not appointed a data protection officer, because the scale of our processing does not require one.

What we collect

Account data: your email address, your role (creator or buyer), and the display name and profile picture Google gives us if you sign in with Google. If you set a password we store it hashed, never in a form anyone can read. Buyers also give us a company name and the categories they will not sponsor.

Deal data: the proposals, messages, terms and declared prices that you and your counterparty enter into a deal room, and any problem reports you send us.

Channel data, once you connect a channel: its title, handle, thumbnail, subscriber count and category.

YouTube analytics, for creators who connect a channel: with your consent we read your channel's analytics through Google's read-only permissions. That means audience retention per video, aggregate audience composition (age bands, gender and geography as YouTube reports them), and view counts. Titles, durations and descriptions come from YouTube's public information about your videos rather than from the analytics grant. The permission we ask for cannot upload, change or delete anything on your channel, and it cannot return revenue data at all: the scope that can is one we never request.

Audience composition reaches us only as aggregates. We never receive anything that identifies an individual viewer.

Why we are allowed to use it

Because you asked us to (Article 6(1)(b), contract). Your account, your deal rooms, and the delivery report for a deal you entered. Without this there is no service to provide.

Because you agreed (Article 6(1)(a), consent). Connecting your YouTube channel, and optional analytics cookies. You can withdraw either at any time: disconnect the channel in CreatorFlow or at myaccount.google.com/permissions, and use the analytics link in the footer for cookies. Withdrawing does not undo what we did while the consent stood.

Because we have a reason that does not override yours (Article 6(1)(f), legitimate interests). Keeping the service secure, preventing misuse, keeping a record of concluded deals so both parties hold the same one, and establishing or defending legal claims. Ask us and we will explain how we weighed those interests against yours.

How we use Google user data

CreatorFlow uses YouTube API Services. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google's own privacy policy explains how Google handles your information, and connecting a channel is also governed by the YouTube Terms of Service.

In practice: we use your YouTube data only to provide and improve the features you connected it for, which are your retention curves, forecasts, slot prices and delivery reports. We do not use it for advertising and we do not sell it. We transfer it only where necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you. No human reads it except with your affirmative agreement, for security purposes such as investigating abuse, to comply with applicable law, or where it has been aggregated and anonymised for internal operations.

Who else sees it

A small number of providers process data on our instructions: our hosting and database provider, which runs the application and stores the data; Resend, which delivers the notification emails described here; and Google Analytics, but only if you allowed it on the banner.

Your counterparty in a deal sees what you put in the deal room. A delivery report shows the agreed slot, the declared fee and the measured delivery to both sides of that deal. Your storefront is visible to signed-in buyers. We do not sell personal data and we do not share it for anyone else's marketing.

Some of these providers are outside the United Kingdom, mainly in the United States. Where personal data leaves the UK we rely on the UK Addendum to the European Commission's standard contractual clauses, or on UK adequacy regulations where they apply.

Where it lives

Data is held in a managed database with encryption in transit and at rest, and OAuth refresh tokens are additionally sealed with a separate key held outside the database. If a breach happens that is likely to risk your rights, we report it to the Information Commissioner's Office within 72 hours and tell you without undue delay where the law requires it.

How long we keep it

Account data: while your account is open, and for 12 months after you close it so a counterparty query can still be answered. Deal records and delivery reports: six years from the end of the deal, matching the time limit for a contract claim in England and Wales, after which we delete or anonymise them. Connected analytics: while your channel stays connected, and if you disconnect we delete your tokens immediately and your synced analytics within 30 days. Problem reports and the correspondence about them: two years.

Revoking access

You can disconnect your channel inside CreatorFlow at any time. You can also revoke CreatorFlow's access directly at myaccount.google.com/permissions, which cuts us off regardless of anything on our side.

Cookies and analytics

Two categories, and only one of them is yours to decide. Essential cookies keep you signed in and protect forms against cross-site request forgery. They are required for the site to work and cannot be turned off.

Optional analytics: with your agreement we use Google Analytics to count visits and see which pages people read. Nothing from Google is requested until you press Allow on the banner, so declining means no request is made to their servers at all, rather than a request that says you declined. We enable IP anonymisation.

We do not run advertising cookies and we do not track you across other websites. We do build a statistical picture of a channel's performance in order to forecast and price slots. That is the product, and the methodology explains exactly how it works.

You can change your mind at any time using the analytics link in the footer, which reopens the banner. Clearing your browser storage for this site also resets the choice.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to processing we base on legitimate interests, ask for the data you gave us in a portable machine-readable form, and withdraw any consent you have given.

Write to [email protected]. We answer within one month. If a request is complex we may take up to two further months, and we will tell you why within the first month. If you are unhappy with our answer, tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

We do not make decisions about you by automated means alone that produce legal or similarly significant effects. The price we suggest for a slot is a suggestion: you decide whether to list it and at what price, and a buyer decides whether to propose.