Privacy Policy

This Privacy Policy explains how Tourn Media AB ("Tourn", "we", "us") collects and uses personal data in connection with Nagato, our YouTube multi-channel network management platform at nagato.io.


DATA CONTROLLER

Tourn Media AB is the data controller responsible for the personal data we process. Our contact details and those of our data protection contact are at the end of this Privacy Policy.


WHAT IS PERSONAL DATA?

Personal data is any information that can be used to identify a living person, directly or indirectly. Examples include name, email address, phone number, IP address and payment details. "Processing" means anything we do with personal data — collecting it, storing it, transferring it, deleting it and so on.


WHOSE PERSONAL DATA WE PROCESS

We process personal data primarily about:

  • Creators — YouTube channel owners who join the Nagato network. The categories we typically process include your name, contact details, address, payment information, and tax or registration number where required. The YouTube channel data we access on your behalf is covered in detail in the YouTube API Services section below.
  • Visitors to nagato.io — basic technical information such as IP address and browser data, collected via cookies and analytics.


HOW WE COLLECT PERSONAL DATA

We collect personal data that you provide directly — for example when you register, complete your profile, set up payment details or correspond with us. Once your YouTube channel is connected, additional records (such as revenue calculations and payment history) are generated within the Service.

We may also receive information from third parties: from YouTube via the YouTube API Services described below, from credit reference agencies where credit checks are required, and from public registers.

We collect technical data via cookies when you visit our websites.


HOW WE USE YOUR PERSONAL DATA

We only process personal data when we have a lawful basis under the GDPR. The main purposes for which we process personal data are:

  • Providing the Service to Creators — managing your Nagato account, displaying your channel statistics and revenue, calculating your revenue share, and processing payouts. Lawful basis: performance of our contract with you.
  • Complying with our legal obligations — bookkeeping, tax reporting, and responding to lawful requests from authorities. Lawful basis: legal obligation.
  • Customer support — responding to enquiries, handling complaints and providing technical assistance. Lawful basis: performance of contract and our legitimate interest in providing good support.
  • Marketing our services — sending information about our services and using cookies on our website for analytics and remarketing. Lawful basis: legitimate interest. You can object to marketing at any time.
  • Protecting our rights — investigating fraud, enforcing our Terms, and defending legal claims. Lawful basis: legitimate interest.


WHO WE SHARE PERSONAL DATA WITH

We share personal data only where necessary and with the following categories of recipients:

Companies within the Tourn group — where group functions support the operation of the Service, we may share personal data with affiliated Tourn companies.

Public authorities — including the Swedish Tax Agency (Skatteverket), the Swedish Enforcement Authority (Kronofogdemyndigheten), the Swedish Social Insurance Agency (Försäkringskassan) and the police, where required by law. Once shared, those recipients process the data under their own policies.

Service providers acting on our instructions (data processors) — providers of IT infrastructure, payment processing, accounting and customer support. We have written agreements in place with each of them requiring that they process personal data only on our instructions and for the purposes for which it was collected.

Transfers outside the EU/EEA — we try to keep personal data within the EU/EEA. Where we transfer personal data to a country outside the EU/EEA, we put in place appropriate safeguards — such as the European Commission's Standard Contractual Clauses — to ensure your data continues to be protected.


YOUTUBE API SERVICES

Nagato uses YouTube API Services to provide its network-management features to creators. By using Nagato, you also agree to the YouTube Terms of Service. Google's own handling of your YouTube data when accessed through these APIs is described in the Google Privacy Policy.


Information we access through YouTube API Services

When you connect your Google account, Nagato accesses the following information on your behalf:

  • YouTube Data API v3 — your YouTube channel's public information: channel ID, channel name, channel description, thumbnail and banner images, subscriber count, total view count, total comment count, and video count. For videos on your channel: video ID, title, description, thumbnail, publish date, and aggregated counts of views, likes, dislikes, comments and favorites.
  • YouTube Analytics API — estimated revenue figures for your channel, attributed per day and per channel under the Nagato content owner account.
  • YouTube Content Owner / Partner API — the list of channels currently managed by the Nagato content owner, used to determine whether your channel is linked to the Nagato network and to compute the revenue owed to you.

We also store the OAuth refresh token issued by Google so that we can continue to access this data on a recurring basis on your behalf.


How we use this information

We use YouTube API data to: (a) display your channel statistics, video performance and revenue in your Nagato dashboard; (b) calculate and disburse the share of YouTube revenue owed to you under your network contract; (c) verify that your channel is correctly linked to the Nagato content owner so that you receive partner status and payouts; and (d) produce internal reports for Nagato administrators and partner managers regarding channel performance across the network.

We do not sell YouTube API data.


Who we share this information with

Within Nagato, YouTube API data about your channel is accessible to the partner managers and administrators of the department or community to which your channel is assigned. Aggregated revenue figures are shared with our payment processor for the sole purpose of issuing payouts to you. We do not share your YouTube API data with any other third party except as required to operate the service or as required by law.


Data retention and refresh

We retain YouTube API data about your channel for as long as your channel is connected to Nagato and for as long as required to fulfil our payment, accounting and tax obligations toward you. In line with the YouTube API Services Developer Policies, non-statistical data — such as channel names, channel descriptions, video titles and thumbnails — is refreshed from YouTube at least every 30 calendar days. Aggregated public statistics and revenue figures may be retained for up to 36 months, after which they are deleted or further aggregated.


Revoking Nagato's access

You may revoke Nagato's access to your YouTube data at any time, in addition to deleting your Nagato account, via the Google security settings page at https://security.google.com/settings/security/permissions.

If you revoke Nagato's access directly from within Nagato, we will delete the YouTube API data we have stored about you within 7 calendar days. If you revoke access via the Google security settings page above, we will delete it within 30 calendar days. Upon termination of Nagato's access to the YouTube API Services, we will delete all YouTube API data in our possession.


EU users — Google EU User Consent Policy

If you are located in the European Union, your use of Nagato in connection with YouTube API Services is also subject to Google's EU User Consent Policy.


Contact for YouTube data requests

For any request relating to the YouTube API data Nagato has stored about you — including requests to access, correct or delete that data — please contact: gdpr@tourn.se. We will respond without undue delay and within the timelines described above.


HOW LONG WE RETAIN PERSONAL DATA

We retain personal data for as long as it is needed to fulfil the purposes for which it was collected, and to comply with our legal obligations (for example, Swedish bookkeeping law typically requires accounting records to be retained for seven years). When personal data is no longer needed for an active purpose, we delete or anonymise it.


HOW WE PROTECT PERSONAL DATA

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, destruction or other damage. Only employees and contractors who need access to perform their role have access to personal data, and their handling is governed by internal policies.


YOUR RIGHTS

You have the following rights in relation to the personal data we process about you. We will respond to your request without undue delay and normally within one month. We may need to ask for additional information to confirm your identity before we respond.

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate personal data or complete data that is incomplete. You can also update much of your information directly in your Nagato account.
  • Erasure — ask us to delete personal data where it is no longer needed for the purpose for which it was collected, where you withdraw consent that was the only basis for the processing, or where you successfully object to processing. Some retention obligations under law may prevent immediate deletion.
  • Restriction — ask us to limit how we process certain personal data, for example while we investigate an accuracy claim.
  • Objection — object to processing we carry out on the basis of our legitimate interests. You may object to direct marketing at any time, and we will stop processing your data for that purpose.
  • Portability — for data you provided to us that we process on the basis of consent or contract, request a copy in a structured, commonly-used, machine-readable format, or ask us to transmit it to another controller.

Where we share corrected or deleted data with third parties, we will notify them of the change unless doing so is impossible or requires disproportionate effort.


COMPLAINTS

If you believe we process your personal data in violation of applicable law, you have the right to complain to us at gdpr@tourn.se or to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).


CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. The latest version is always published on our website. If we make changes that materially affect how we process your personal data, we will provide reasonable notice — typically by email — before the changes take effect.


COOKIES

A cookie is a small text file stored on your browser or device when you visit a website. We use cookies on nagato.io to improve your experience, analyse how the Service is used, and for limited marketing purposes. You can read more about cookies on the Swedish Post and Telecom Authority's website at www.pts.se.


CONTACT

For questions about this Privacy Policy or requests relating to your personal data, please contact:

Tourn Media AB
Sturegatan 4
114 35 Stockholm
Sweden
Organisation Number: 556972-1821
Email: gdpr@tourn.se / support@tourn.se