Data processing addendum
Last updated 14 September 2026
Signing is not required for most accounts. If your legal team needs a countersigned copy, mail privacy@tubeextract.dev and we will return one within two working days. Read the transfers section before you sign: extraction runs outside the EEA, and that is the term most reviews will care about.
Roles
You are the controller of the data you submit. We are the processor and act only on your instructions, which in practice means the jobs you create through the API.
Scope of processing
Video IDs, the schemas you write, the caption text fetched in order to answer them, and the resulting rows. Rows and the submitted URL are deleted on your first successful fetch; job metadata — status, timestamps, character and chunk counts — is kept because usage and billing are calculated from it.
Subprocessors
We give 30 days’ notice before adding one, and you may object in that window.
Where processing happens, and transfers
Storage is in Germany: a server rented from Hetzner holds the database, the job queue and everything in the paragraph above. Extraction is not. The caption text and your schema are sent to a machine of ours in Turkey, which runs the model and returns the rows, holding nothing after the request. Turkey is outside the EEA and has no EU adequacy decision, so this is an international transfer and you should treat it as one. Separately, the video ID (and nothing else) goes to a third-party transcript provider that fetches the caption track.
Security
Encryption in transit between every component. Access to the production server is limited to the operator, over SSH with key authentication. This is deliberately a short paragraph: we do not have a SOC 2 report, a yearly penetration test or a security team, and claiming otherwise on a page a customer relies on would be worse than saying so. Ask before you assume a control is in place.
Breach notification
We notify you without undue delay and in any case within 48 hours of becoming aware, with what we know at that point rather than waiting for a full picture.
Deletion on exit
Close the account and anything still held — unread results, schemas, job metadata — is deleted within 30 days. Billing records are kept as long as tax law requires.
Confidentiality and people
One person operates this service and has access to production. That person is bound to confidentiality about anything seen in the course of it, and the commitment does not lapse when the account does. If that ever becomes more than one person, everyone with access will be under the same obligation in writing before they get it, and this paragraph will say so instead.
Changes to subprocessors
The list on this page is the current one. We give 30 days' notice by email before adding or replacing a subprocessor that touches your data, and if the change is one you cannot accept you may object in that window and close the account without penalty for the unused part of the period you paid for. Notice is on the change, not on your reply — we will not add one quietly and point at this paragraph afterwards.
Helping you meet your own obligations
If one of your users asks you for access, correction, deletion or an export and the answer is in our systems, we help you answer it, at no charge and within the time your own deadline needs rather than a leisurely one of ours. The same applies to a data protection impact assessment or a regulator's question: tell us what you have been asked and we will give you what we actually know. We do not respond to your users directly — you are the controller and that answer is yours to give.
Audits
Ask and we will answer questions about how this runs, in writing, in detail, and we will let you verify what we have said. What we cannot offer is an audit report to hand your procurement team: there is no SOC 2, no ISO 27001 and no yearly penetration test, and the security paragraph above says so on purpose. If your process requires one of those to exist, it does not, and that is better to discover on this page than three weeks into a review.
Term and precedence
This addendum applies for as long as we process data for you and ends with the deletion described above. Where it and the terms of service disagree about personal data, this page wins; on everything else the terms do. If a supervisory authority or a court finds part of this unenforceable, the rest of it stands.