Privacy policy

Who we are

Video Performance Pro is run by Offside Projects Ltd, a company registered in England and Wales (company number 13110296), whose registered office is 18 St Cross Street, London, EC1N 8UN. You can reach us at hey@videoperformancepro.com.

This policy covers our customers and the visitors to our customers’ websites. We are the controller of our customers’ data. For visitors’ data, each customer is the controller and we process it on their behalf.

Our customers

We keep your email address to sign you in and to send you account emails. We don’t store passwords.

Payments are handled by our payment processor. We don’t see or store your card details; we keep which plan you’re on.

We keep your settings and what you set up in the app: your sites, tracking links, thank-you pages and any sales you add by hand. If you connect a checkout, we store its key encrypted and use it only to receive your sales and refunds. If you import past leads or sales, we receive only the columns you choose.

We hold this to provide the service you signed up for, which is our legal basis for it. Our hosting providers keep standard security logs, including IP addresses, under our legitimate interest in protecting the service. We keep your data while you have an account; deleting your account deletes it all straight away.

YouTube data

Video Performance Pro uses YouTube API Services. When you connect a channel, you give us read-only access. We read your channel’s name and its videos’ titles, thumbnails, publish dates and views, to show them beside the leads and sales each video produced. We store these and Google’s access token (encrypted), and refresh them at least every 30 days.

We don’t sell YouTube data, use it for advertising, or share it with anyone except:

• Cloudflare (hosting) and Supabase (database), which process and store it for us only to run the service, under contracts that bar any other use
• Google, when we save a description change you confirm to YouTube
• anyone the law requires us to disclose it to, such as under a court order

We don’t read it ourselves unless you ask us to look into a problem, or the law requires it.

Updating the links in your descriptions, and find and replace, need edit access, which Google asks you for when you connect a channel with description updates allowed, or the first time you use either. Google calls this permission “See, edit, and permanently delete your YouTube videos, ratings, comments and captions”. We only ever change descriptions, and only the changes you confirm. We never delete videos or touch ratings, comments or captions. We stop using edit access 30 days after you allow it; Google keeps the permission until you remove it.

Descriptions we read for a search are deleted within an hour. Before and after copies of each description we change are kept for 30 days, so you can undo the change, then deleted.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By connecting a channel you also agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy.

You can disconnect a channel in the app, or remove our access on Google’s security settings page. Either way, we delete everything we received from YouTube for that channel within 7 days. Its clicks, leads and sales are kept, hidden, until you delete them or reconnect.

Visitors to our customers’ websites

We record nothing about a visitor who didn’t arrive through a customer’s tracking link. For one who did, we record which link they came through and when, the page they landed on and the page that sent them, their country, whether the page saw them scroll, tap, type or move the pointer (only that it happened, so automated visits aren’t counted), whether they reached a thank-you page, the amount of any payment credited to the link, and a code that changes daily so repeat clicks that day count once.

If they give their email address on the customer’s site, when booking or when paying, we keep only an irreversible code made from it, used to recognise the same person on another device, and delete it after 24 months or sooner if the customer chooses. We never store visitors’ IP addresses, names or email addresses.

If you visited one of our customers’ websites, please contact them first about your data; you can also contact us.

Cookies

On this website, one cookie keeps you signed in. On our customers’ websites, two cookies (vpp_click and vpp_vid) connect a later sign-up or payment to the tracking link a visitor arrived through. They last 90 days from the visitor’s last tracked visit, and customers can set them to wait for the visitor’s consent. The tracking script also notes each payment and booking it has reported in the browser’s session storage, which is cleared when the tab closes, so a reload doesn’t count it twice. We don’t use advertising or third-party tracking cookies.

How we protect your data

These protections cover everything we hold, including the YouTube data and access tokens we receive from Google. All data travels between your browser, our servers and our providers over encrypted (HTTPS/TLS) connections, and our database is encrypted at rest (AES-256). Google access tokens and checkout keys are also encrypted individually with AES-256-GCM, using a key held outside the database. Visitors’ email addresses are only ever stored as irreversible codes. Each account can reach only its own data, which the database enforces itself, and access to our systems is limited to us. Data is deleted on the schedules described above.

Who handles data for us

We use a hosting provider, a database provider, a payment processor and an email delivery service. Some may process data outside the UK, with the safeguards UK law requires. Of these, only our hosting and database providers ever receive data from Google.

Your rights

You can ask for a copy of your data, or ask us to correct, delete or limit it, or object to how we use it. Email hey@videoperformancepro.com. You can also complain to the Information Commissioner’s Office.

Changes

If we change this policy, we’ll update the date above and email customers about anything significant.