Privacy Policy

Last updated: September 21, 2026
Back to home

Overview

RippleFlow is a YouTube automation tool for creators. This Privacy Policy explains what personal information we collect, how we use and share it, how long we keep it, and the rights and choices you have. It applies to the website at rippleflow.pro, the RippleFlow application, and our related emails and support channels (together, the “Service”).

This policy does not apply to third-party services you use alongside RippleFlow, such as YouTube or Google. Those services have their own privacy policies, which we encourage you to read.

Who we are

RippleFlow (“RippleFlow”, “we”, “us”, or “our”) operates the Service. For the purposes of the EU and UK General Data Protection Regulation (GDPR), we are the data controller for the personal information described in this policy. You can reach us for any privacy question or request at support@rippleflow.pro or through our contact page.

Information we collect

We collect the following categories of information:

  • Information you give us. Your name, email address, and password (stored in hashed form), your profile and workspace details, and the content you create — rules, keywords, blocklists, prompts, and reply templates.
  • Google sign-in data. When you sign in with Google (openid, email, profile), we receive your verified email address, name, and profile photo. We use these only to create and authenticate your RippleFlow account.
  • YouTube data you authorize. When you connect a channel through Google OAuth (the youtube.force-ssl scope), we access your channel and video metadata (titles, privacy status), video transcripts used to match your tone, your own past replies used for personalization, the comments on your videos, and their moderation status. We use this to display comments, draft replies, hide comments that match your rules, and post the replies you explicitly approve.
  • Payment information. Paid plans are processed by our payment provider, Razorpay. We receive limited billing details such as your plan, payment status, amount, currency, and a transaction reference. We do not receive or store full card numbers.
  • Usage, device, and log data. IP address, browser and device type, the pages and features you use, the actions you take (approvals, hides, and replies), timestamps, error logs, and API quota usage.
  • Communications. The messages you send us through the contact form or support email, and our replies.
  • Cookies and similar technologies. As described in the “Cookies” section below.

We do not ask for special-category data such as health or political information, and we ask that you do not include it in your rules or messages.

How we use information

  • To provide the Service — connect your channel, read comments, draft replies, apply your rules, and post the actions you approve.
  • To personalize your drafts — learn from your past replies and video transcripts so replies sound like you.
  • To keep the Service safe — detect abuse, prevent spam and fraud, enforce our rules, pace actions, and protect your API quota.
  • To communicate with you — send transactional email, service notices, and support replies.
  • To improve the Service — debug issues, secure our systems, and develop features.
  • To process payments — manage subscriptions and billing for paid plans.
  • To comply with the law — meet legal obligations and enforce our Terms of Service.

Legal bases for processing (EEA and UK)

Where the GDPR applies, we rely on the following legal bases:

  • Performance of a contract — to provide the Service you have asked for.
  • Legitimate interests — to secure, improve, and prevent abuse of the Service, balanced against your rights.
  • Consent — where required, such as for non-essential cookies or marketing. You can withdraw consent at any time.
  • Legal obligation — to comply with applicable law and valid legal requests.

Google and YouTube API Services

RippleFlow uses YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We only use YouTube data to provide the user-facing features you see inside RippleFlow. We do not sell it, we do not use it for targeted advertising or retargeting, and we do not use it to train generalized or third-party AI models. Personalization is limited to your own channel — your tone profile is per-channel inference memory, not model training. Comment text sent to Google's Gemini API is processed for inference-only drafting and is not used to train models; we transfer Google user data to no other third-party AI service. We do not transfer Google user data to data brokers or advertisers, and human access occurs only with your consent, for security or abuse prevention, or to comply with applicable law. The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke RippleFlow's access to your Google account at any time at myaccount.google.com/permissions.

Cookies

We use essential cookies to keep you signed in and to protect against cross-site request forgery. These cookies are required to operate the Service; disabling them may prevent you from signing in. We may also use privacy-respecting analytics to understand aggregate usage of the Service. We do not use cookies to serve third-party advertising. You can control cookies through your browser settings.

How we share information

We do not sell your personal information, and we do not share it with third parties for their own advertising. We share it only with service providers (“subprocessors”) that help us run the Service, under contracts that limit their use of your data:

  • cloud hosting and infrastructure providers;
  • email delivery providers, for transactional and support email;
  • our payment provider (Razorpay), for paid plans and billing;
  • Google, for YouTube API Services and for the AI services used to draft replies.

We may also disclose information when required by law, to protect the rights, property, or safety of RippleFlow, our users, or the public, or as part of a merger, acquisition, or sale of assets, in which case we will notify you before your information is transferred and becomes subject to a different privacy policy.

International data transfers

We may process and store information in countries other than your own, including the United States and India. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

Data retention

We keep personal information for as long as your account is active and for as long as needed to provide the Service. When you disconnect a channel, we delete the data associated with it — comments, queue items, rules, and moderation logs — within 48 hours, and we do not retain your OAuth tokens after disconnection. When you delete your account, we remove your personal information, except where we must keep it to comply with the law, resolve disputes, or prevent fraud. Aggregated or de-identified data that cannot reasonably identify you may be kept for longer.

Security

We protect your information with technical and organizational measures, including encryption in transit (TLS) and at rest, and encryption of OAuth tokens using AES-256-GCM. Access to production systems is limited to authorized personnel who need it to operate the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to restrict or object to certain processing, and to withdraw consent. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have rights under the CCPA/CPRA to know, delete, and correct personal information, and to opt out of the sale or sharing of personal information; we do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.

To exercise a right, email support@rippleflow.pro or use our contact page. We may need to verify your identity before acting on a request. You can also revoke RippleFlow's access to your Google account at myaccount.google.com/permissions.

Children's privacy

The Service is not intended for children under 13 (or the minimum age in your country), and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party links and services

The Service may link to or rely on third-party sites and services, such as Google, YouTube, and Razorpay. This policy does not apply to them. We encourage you to review their privacy policies.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or in the Service and update the “Last updated” date above. Continued use of the Service after the effective date means you accept the updated policy.

How to contact us

For any question about this policy or your personal information, email support@rippleflow.pro or reach us through our contact page.

Questions about this document? Contact us or email support@rippleflow.pro.