Privacy Policy

1. Use of YouTube API Services

Clonio uses the YouTube API Services to allow users to connect their YouTube accounts and access specific data (such as channel details, video analytics, and publishing information). By using Clonio, you also agree to be bound by the YouTube Terms of Service.

2. Data We Access and Collect

When you authorise Clonio via Google OAuth, we may access limited information from your YouTube account, including:

• Channel name, ID, and statistics
• Video metadata (titles, descriptions, view counts, engagement metrics)
• Upload and publication data

We may also collect:

• Account details you provide directly (e.g. email address, username, subscription or payment data where applicable)
• Technical and usage data (browser type, device information, IP address, cookies, referring URLs)

We do not access private video content or personal data beyond what is authorised by you through Google's OAuth consent screen.

3. How We Use Your Data

We use collected information to:

• Provide, operate, and improve the Clonio platform
• Display YouTube analytics and insights within your dashboard
• Automate content creation, scheduling, and optimisation
• Deliver customer support and communicate service updates
• Detect, prevent, and address fraud, abuse, or technical issues
• Comply with applicable legal obligations

We never sell user data. We do not use YouTube data, or any user data, to train or improve machine learning or AI models.

4. Use of Google User Data (Limited Use Disclosure)

Clonio's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. We only access, store, and use Google user data for the purpose of operating the Clonio platform as described above.

Clonio does not transfer Google user data to third parties except:

• To provide core functionality via secure sub-processors (e.g. hosting, storage, analytics) under written data processing agreements
• When required by law, regulation, or valid legal process
• With the user's explicit prior consent

All transfers occur under confidentiality and data-processing agreements and within compliant jurisdictions. Clonio does not allow humans to read Google user data except where (a) we have the user's affirmative consent, (b) it is necessary for security purposes, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymised.

5. Data Storage and Security

All user and API data are stored securely on encrypted servers located within the European Union or on Google Cloud Platform (GCP) infrastructure. We apply technical and organisational measures, including encryption at rest and in transit, role-based access controls, and firewalls, to safeguard all data against unauthorised access, alteration, disclosure, or destruction.

In the event of a data breach that poses a risk to the rights and freedoms of data subjects, we will notify affected individuals and the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR.

6. Third-Party Content, Advertising, and Analytics

Clonio may display embedded third-party content, such as YouTube videos, which may contain advertisements as part of YouTube's native platform. Clonio itself does not independently serve or sell advertisements to users.

We may use anonymised analytics tools (e.g. Google Analytics) to understand aggregate usage patterns. No personal or YouTube-derived data are shared with advertisers or used for marketing profiling.

7. Cookies and Tracking Technologies

Clonio and its service providers may store or access information on your device using cookies or similar technologies to:

• Maintain session tokens, OAuth state, and authentication credentials
• Analyse usage patterns to improve the platform
• Enhance performance and security

You may manage cookie preferences through your browser settings. Disabling certain cookies may limit your ability to use specific features of the platform.

8. Data Retention and Deletion

We retain authorised YouTube and user data only for as long as your Clonio account is active, as necessary to provide services, or as required to comply with our legal obligations (including tax and accounting requirements). You can:

• Revoke Clonio's access to your YouTube data at any time via Google's security settings
• Request deletion of your Clonio account by contacting support@clonio.io

Upon revocation or deletion request, all associated data will be permanently removed from Clonio's active systems within 30 days. Residual copies in encrypted backups will be overwritten within 90 days.

9. GDPR Compliance and Data Controller Role

MSCOMMERCE Ltd trading as Clonio acts as both a data controller and data processor under the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018 with respect to personal data processed through the Clonio platform.

If you are located in the EU, UK, or EEA, you have the right to:

• Access your personal data (Article 15 GDPR)
• Rectify inaccurate personal data (Article 16 GDPR)
• Request erasure of your personal data (Article 17 GDPR)
• Restrict processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Object to processing, including profiling (Article 21 GDPR)
• Withdraw consent at any time without affecting the lawfulness of prior processing (Article 7(3) GDPR)

You may exercise these rights by contacting support@clonio.io. We will respond to data subject requests within 30 days. You also have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK).

10. Legal Bases for Processing

We process personal data on the following legal bases under Article 6(1) of the GDPR:

• Consent — where you have granted explicit permission (e.g. connecting your YouTube account via OAuth)
• Contractual necessity — where processing is required to perform our contract with you (e.g. providing platform access)
• Legitimate interest — where processing is necessary for our legitimate business interests (e.g. fraud prevention, service improvement), balanced against your rights
• Legal obligation — where processing is necessary to comply with applicable laws or regulatory requirements

11. Limitation of Liability

To the fullest extent permitted by applicable law, Clonio and MSCOMMERCE Ltd shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or goodwill, arising out of or in connection with your use of the platform, even if we have been advised of the possibility of such damages.

Our total aggregate liability for any claims arising from or relating to this Privacy Policy or your use of the platform shall not exceed the total amount you paid to Clonio in the twelve (12) months immediately preceding the event giving rise to the claim, or fifty pounds sterling (£50), whichever is greater.

Nothing in this policy excludes or limits liability that cannot be excluded or limited under applicable law, including liability for fraud or fraudulent misrepresentation.

12. Indemnification

You agree to indemnify, defend, and hold harmless MSCOMMERCE Ltd (trading as Clonio), its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with: (a) your use of the platform in violation of this Privacy Policy or applicable law; (b) any content you upload, publish, or transmit through the platform; or (c) your violation of any third-party rights.

13. Governing Law and Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Before initiating formal proceedings, the parties agree to attempt to resolve any dispute through good-faith negotiation for a period of not less than thirty (30) days.

14. Children's Privacy

Clonio is not intended for use by individuals under the age of 13 (or 16 in the EEA/UK where applicable). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete such data promptly.

15. International Data Transfers

Where personal data is transferred outside the EU/EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision, to ensure your data receives an equivalent level of protection.

16. Changes to This Policy

We may update this Privacy Policy periodically to reflect service changes or legal updates. The updated version will be posted on this page with a new “Last Updated” date. Where changes are material, we will make reasonable efforts to notify you (e.g. via email or an in-platform notice). Continued use of Clonio after updates constitutes acceptance of the revised policy.

17. Contact Information

For privacy inquiries, data subject requests, or complaints, contact:
Email: support@clonio.io
Company: MSCOMMERCE Ltd trading as Clonio

18. Google and YouTube Policies

This Privacy Policy supplements:

• YouTube Terms of Service
• Google Privacy Policy
• Google API Services User Data Policy