Privacy Policy – YouTube Operator

Effective date: 22 October 2026

This policy explains how we collect, use and protect personal data when you visit youtubeoperator.com, buy one of our products, join our email list or community, and how our internal YouTube tool uses YouTube API Services. We've tried to keep it short and plain.

1. Who we are

YouTube Operator is made by Alan Graf, trading as AlanNotion, based in Stockholm, Sweden. Alan Graf is the data controller for the personal data described here.

Privacy questions or requests: [email protected]

2. What we sell and where

• YouTube Operator – a Notion template ($50).
• YouTube Operator Academy Lifetime – the template plus access to our Academy community on Skool ($147).

Both are sold through ThriveCart checkout. Some of our Notion templates are also sold on Gumroad and the Notion Marketplace. Academy Lifetime buyers are invited to the Skool community by email.

3. Data we collect

When you visit the website

• Usage data collected by Google Analytics 4 (for example pages viewed, scrolling, clicks, approximate location, device and browser type, and how you arrived at the site). See section 6.
• Referral and campaign tags in links you click, such as ?ref= tags and UTM parameters, plus your Kit subscriber ID if you came from a link in one of our emails. When you click through to checkout, the site passes these and your Google Analytics client and session IDs to ThriveCart. Our n8n automation then records the purchase in Google Analytics, so we can see which link, video or email led to a sale. Checkout buttons also carry a fixed ?ref= label.

When you fill in a form

• If you take our YouTube Operator Assessment quiz (a Typeform form we link to, for example from social media; it isn't embedded on the site), Typeform collects your multiple-choice answers, one free-text answer, your email address and hidden fields showing which link or channel brought you there (UTM and entry-channel tags). Typeform may save partial answers before you submit.
• Our n8n automation then adds your email to Kit with a tag and fields based on your result, and creates a lead record in Alan's private Notion leads database.

When you buy

• ThriveCart runs our checkout. It collects your name, email address, billing address (country, state and zip/postal code), IP address, browser details, a Meta browser identifier (fbp), your order and payment details and any coupon used.
• Payments are handled by ThriveCart and its payment processors (such as Stripe). Your card details stay with them and never reach us.
• What we keep from your order:
• Notion sales records: your email, the product, price, coupon, store, source, locale or country, and the time. No name, address or IP.
• Kit: your email, tags showing where you bought, that you're a customer and any upsell, plus the price, product name and purchase date.
• Google Analytics: the order ID, value, currency, tax, coupon, items, your Google Analytics client ID and, if you came from one of our emails, your Kit subscriber ID as the user ID. No email, name or IP.
• If an automated order step fails, technical logs that may include your order details (name, address, IP) are kept for up to 14 days so we can fix the problem, then deleted automatically.
• If you buy on Gumroad or the Notion Marketplace, that platform runs the checkout under its own policy, and we keep the same kind of order record in Notion. For Gumroad, this includes your country.

When you join our email list

• We send email through Kit. You get emails from us after you opt in or buy one of our products, and you can unsubscribe at any time. Kit stores your email address and the tags and fields described above. The site itself has no email signup form today.

When you join the Academy community

• The Academy community is hosted on Skool, under Skool's own privacy policy. Academy Lifetime buyers are invited to it by email. We don't send your order data to Skool.

When you email us

• Your email address and whatever you include in your message.

4. How we use your data and our legal bases (GDPR)

We do not sell your personal data, and we do not use it for third-party advertising.

5. Who we share data with

We only share data with the services we use to run the business, acting as our processors or as independent controllers under their own terms:

• ThriveCart – checkout and order processing.
• ThriveCart's payment processors (such as Stripe) – payments are handled by ThriveCart and its payment processors.
• Gumroad and Notion Marketplace – other stores where some of our templates are sold.
• n8n – our automation tool n8n, self-hosted on a server rented from Hostinger. It moves order and quiz data into Notion, Kit and Google Analytics.
• Notion – our private workspace where sales records, leads and working data are stored.
• Kit – email list and email delivery.
• Google – Google Analytics, plus the YouTube API Services described in section 8.
• Cloudflare – hosts the site on Cloudflare Pages and delivers it through Cloudflare's global network. It processes visitor IP addresses to deliver and protect the site, under its own privacy policy: https://www.cloudflare.com/privacypolicy/.
• Framer – the site builder. The site uses Framer's code and files.
• Senja – the testimonials widget on the website.
• Typeform (which may process data outside the EU/EEA) – our assessment quiz.
• Make (EU) – an automation platform we have an account with. It isn't currently used for any data.

We may also disclose data if the law requires it.

6. Cookies and similar technologies

The site uses Google Analytics 4: one Google tag on the site (G-HJSZ8N2LWK) sends data to one Google Analytics 4 property (G-41WE76Q234), where purchases are also recorded. It's the only analytics or advertising tag on the site. It measures page views, scrolling, outbound clicks, site search, video plays, file downloads and form interactions.

• Cookies: only _ga and _ga_41WE76Q234. These first-party Google Analytics cookies last up to 2 years.
• Browser storage: if your link includes UTM parameters, we keep them in your browser's session storage (yto_utm_*) for that visit, so a later purchase can be credited to that link. If you arrive from a link in one of our Kit emails, we store your Kit subscriber ID in your browser's local storage (yto_kit_sid) and use it as your Google Analytics user ID. This shows us which emails lead to visits and sales.
• IP addresses and emails: Google Analytics 4 doesn't log or store IP addresses, and email addresses are automatically redacted from analytics data.
• Retention: Google Analytics keeps event and user data for 14 months.
• Consent: we don't currently show a cookie banner or use Google Consent Mode. We use analytics on the basis of our legitimate interest in understanding how the site is used and which links lead to sales (see section 4).

To opt out, you can block or delete cookies in your browser settings, or use Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout. Google's use of this data is described in the Google Privacy Policy: https://www.google.com/policies/privacy.

Third-party content and ads: there are no ads on the site. YouTube and X appear only as plain links, with no embedded players or feeds. The site is built with Framer and uses Framer's code and files from framer.com and framerusercontent.com. It's a static site hosted on Cloudflare Pages and served from Cloudflare's global network. Cloudflare adds a small script that hides email addresses from spam bots, and it logs network errors. Our fonts are self-hosted, but fonts may be loaded from Google Fonts by Framer's code. A Senja testimonials widget (widget.senja.io) loads in its own frame, so Senja sees your IP address and browser details. Inside that frame, Senja loads Cloudflare Web Analytics, Google Fonts and images from imagekit, mux and cdn.senja.io. Senja sets no cookies.

7. Emails and unsubscribing

You get email from us only after you opt in or buy one of our products. Every email has an unsubscribe link, and you can also unsubscribe by emailing [email protected].

8. YouTube API Services

YouTube Operator uses YouTube API Services in an internal tool that helps Alan run his own YouTube channels. By using any part of our service that relies on YouTube API Services, you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms. Google's handling of data is covered by the Google Privacy Policy: https://www.google.com/policies/privacy.

Who it's for. The tool is internal and single-owner. It's only connected to Alan Graf's own four channels: GrunfWorks, AlanNotion, YouTube Operator Academy and Survival Joe. No outside users sign in with Google, and we don't access anyone else's YouTube account.

What it can access (Google OAuth scopes):

• youtube.readonly – read channel and video data.
• youtube.force-ssl – edit video titles, descriptions and tags; manage comments, including pinned comments and replies; manage playlists.
• youtube.upload – upload videos. Uploads are always set to private.
• yt-analytics.readonly (optional) – read YouTube Analytics reports.

It has no access to delete channels or change monetization.

What data this involves:

• Channel and video metadata (titles, descriptions, tags, playlists, upload details).
• Comments on Alan's videos. These include the public display name and comment text of the viewers who posted them.
• Channel analytics, if the analytics scope is granted.

How it's used. Only to run and report on Alan's own YouTube workflow, for example drafting video metadata, replying to and pinning comments, organizing playlists, uploading private drafts and preparing performance reports. Nothing on a live video is published or edited without Alan's approval for that video.

What we don't do. YouTube API data is not sold, not used for advertising, not shared with data brokers, and not used to train generalized AI or machine-learning models.

Where it's stored. The tool isn't connected to the YouTube API yet, so no YouTube API data is stored today. Once it's live, OAuth credentials and access tokens are kept as encrypted secrets on a private, access-controlled computer used only by our assistant tools, and never in Notion. Raw API data (video and channel metadata, comments, analytics and stats) is held only in temporary working files on that private computer or in Alan's private Notion workspace. Only summaries that Alan writes or approves, such as performance notes and decisions, are kept long-term. We don't keep raw API exports or comment dumps. Notion and Google/YouTube are the only third parties involved. The data isn't shared with anyone else.

Revoking access. Access can be revoked at any time through Google's security settings: https://security.google.com/settings/security/permissions (also available at https://myaccount.google.com/permissions). If access is revoked, the tool stops using the API and cached API data is deleted. You can also ask us to delete stored data by emailing [email protected] (see section 9).

9. How long we keep data and how to delete it

• Order and sales records: kept in Notion for as long as we need them for the purposes above, or until you ask us to delete them. Accounting records such as orders and invoices are kept for 7 years under Swedish bookkeeping law (bokföringslagen), even after a deletion request. Your email marketing data is still deleted.
• Email list data: kept in Kit for as long as we need it for the purposes above, or until you unsubscribe or ask us to delete it.
• Analytics data: Google Analytics keeps event and user data for 14 months. Its cookies last up to 2 years.
• Website logs: we run no server and keep no access logs. Cloudflare processes visitor IP addresses under its own privacy policy.
• Automation logs: if an automated order step fails, technical logs that may include your order details (name, address, IP) are kept for up to 14 days so we can fix the problem, then deleted automatically. Other n8n data tables (such as a purchase ledger with no emails) are kept until deleted.
• Quiz leads and other Notion working data: kept for as long as we need them for the purposes above, or until you ask us to delete them or unsubscribe.
• YouTube API data: none is stored today, because the API isn't connected yet. Once it's live, raw API data (video and channel metadata, comments, analytics and stats) is refreshed with a fresh pull or deleted within 30 days of retrieval. A recurring 30-day check re-pulls or deletes anything older. Only summaries that Alan writes or approves are kept long-term. Analytics and stats access is re-authorized at least every 30 days. If access is revoked, use of the API stops and cached API data is deleted. Deletion requests cover OAuth tokens and cached API data.

Deletion requests: email [email protected]. We delete YouTube API data within 7 days of a revoke or deletion request, and other personal data within 30 days of a verified request, except records we must keep by law (see the accounting records above). Your email marketing data is always deleted.

10. Security

• All traffic is served over HTTPS.
• Access is limited to Alan and his private assistant tools. Credentials are stored as encrypted secrets, and our tools use access-controlled accounts.
• We rely on established providers (ThriveCart, Stripe, Kit, Notion, Cloudflare, Google) that run their own security programs.

No system is perfectly secure. If a breach affects your data, we'll follow GDPR notification rules.

11. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify data that's wrong or incomplete.
• Erase your data ("right to be forgotten").
• Restrict how we process it.
• Object to processing based on legitimate interest, and to direct marketing at any time.
• Port your data to another service in a common machine-readable format.
• Withdraw consent at any time, without affecting processing that already happened.

To use any of these rights, email [email protected]. If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) at https://www.imy.se, or to the data protection authority where you live.

12. International transfers

Some providers process data outside the EU/EEA, mainly in the US. Where they do, they rely on legal safeguards such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses, as described in each provider's own privacy policy.

13. Children

Our products and site are meant for adults and are not directed at children. We don't knowingly collect data from children under 16. If you think a child has given us data, email [email protected] and we'll delete it.

14. Changes to this policy

We may update this policy when our tools or practices change. We'll post the new version on this page with a new effective date. For significant changes, we'll also let customers and subscribers know by email.

15. Contact

Alan Graf / AlanNotion / YouTube Operator, Stockholm, Sweden – [email protected]