Who Says So, Privacy Policy

Privacy collection statement (short version)

This statement is a quick summary. The full policy is below.

Who Says So (Avtext Pty Ltd, ABN 88 116 839 037) collects your name and email address when you sign in with Google, and a payment record when you buy a report. The service uses YouTube API Services: when you run a search, your browser reads public YouTube comments on your own API key, and we classify them to build your report. Comment text is sent to OpenAI to be classified, payments are taken by Stripe, and sign-in is provided by Google; some of those providers store data overseas. Comment text and video details are kept for 30 days and then removed. We use Google Analytics, the Meta Pixel, the LinkedIn Insight Tag and the X Pixel to measure visits to our pages and to show our own ads to people who have visited. Both use cookies. We show no advertising on our pages. You can delete any report yourself, and you can ask us about your information or make a complaint at admin@whosaysso.app. The full policy explains all of this in detail.

1. About this policy

This Privacy Policy explains how Avtext Pty Ltd trading as Who Says So ("we", "our", "us") handles your personal information. It applies to the Who Says So website and service at whosaysso.app. By using the service you agree to your personal information being handled as described in this policy. This policy forms part of our Terms.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we handle your personal information in accordance with them.

Who Says So uses YouTube API Services. By using the service you agree to be bound by the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.

2. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not. For this service it means your name, your email address and your payment record.

3. What personal information we collect

• Sign-in information. When you sign in with Google, Google gives us your name and email address and nothing else. We ask for no other permission and never for access to your YouTube account.
• Payment information. When you buy a report, Stripe takes the payment. Your card details go to Stripe and never touch our server. We receive the fact of the payment, its amount and a payment reference, and keep those as our record of the sale.
• Communications. Emails you send us.

Some things you give the service are not personal information but are yours, and we treat them that way: your YouTube API key, your keyword, the words you exclude, and what you tell us you expect to find. Section 4 says where each of them goes.

You do not have to give us your personal information, but without signing in you cannot build a report, and without paying you cannot receive one.

4. How we collect information, and where it stays

• Directly from you, when you sign in, run a search, buy a report or contact us.
• In your browser, not on our server. Your name and email address, your API key, your settings and the list of your reports are kept in your own browser's local storage. Your API key is never sent to our server: every request to YouTube goes straight from your browser to YouTube on your key.
• From YouTube, on your behalf. When you run a search, your browser asks YouTube, on your key, for the videos that match your keyword and for the public comments on the most-viewed ones. That is public data about videos and their comments, not information about you.
• Not by logging. Our server does not log searches. The phrase you typed is yours.

5. Why we collect and use your information

We use your information to:

• know who is signed in, so the service works;
• build your report: read the comments, classify them, count them, and give you the report page and the downloadable file;
• take and record your payment;
• respond to your questions and provide support;
• protect the service and detect and prevent fraud and abuse; and
• meet our legal obligations.

We do not use it for anything else, and we do not build a profile of you.

6. When we share information

• With OpenAI. The text of the comments, your keyword, and what you told us you expected to find are sent to OpenAI's API to be classified and grouped. No name, email address, API key or payment detail goes with them.
• With Stripe, which takes your payment.
• With Google, which provides sign-in, and YouTube, which your browser reads from on your key.
• With our hosting provider, on whose server the report files sit.
• Where required or permitted by law, such as to a regulator, law enforcement, or to protect our rights or the safety of others.
• If our business is sold or transferred, to the new owner, subject to this policy.

We do not sell your personal information. We show no advertising on our pages. Google Analytics, the Meta Pixel, the LinkedIn Insight Tag and the X Pixel collect information about your visit for us, as described in section 9.

7. Is your information disclosed overseas?

OpenAI, Stripe and Google process information in the United States and elsewhere. Where we disclose information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the terms we hold with them.

8. Marketing

We do not send marketing. The only emails you receive from us are about a report you built, a payment you made, or a question you asked.

9. Cookies, device recognition and tracking

We use one cookie of our own to keep you signed in. We also use Google Analytics to count visits and see which pages are used, the Meta Pixel to measure visits and to show Who Says So ads on Facebook and Instagram to people who have been to our site, and the LinkedIn Insight Tag and the X Pixel to do the same on LinkedIn and X. All four place cookies or similar technology in your browser and send Google, Meta, LinkedIn and X information about your visit, such as the address of the page you are on and your browser and device. Google, Meta, LinkedIn and X may process it overseas. They do not receive your API keys or payment details. When you sign up, subscribe or pay for a report, our server also tells Meta and Google Analytics that it happened, so we can see which of our ads led to it. Meta is sent the amount, your IP address and browser, and your email address in a scrambled (hashed) form. Google Analytics is sent the amount and the anonymous ID its cookie gave your browser. We also use Google Analytics remarketing: the Google Analytics cookie and Google's advertising cookies are used together so that Google can show Who Says So ads, on Google and on sites that partner with Google, to people who have visited our site. You can block all of this with your browser settings or an ad blocker. You can turn off personalised ads from Google in Google's Ads Settings (adssettings.google.com), opt out through the NAI consumer opt-out (optout.networkadvertising.org), or stop Google Analytics altogether with Google's Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). You can manage your ad preferences for Facebook and Instagram in your Facebook account settings, for LinkedIn in your LinkedIn settings under Advertising data, and for X in your X account's privacy settings. The service keeps a small amount of data in your browser's local storage so it works: who is signed in, your API key, your settings and the list of your reports. Apart from the Google, Meta, LinkedIn and X cookies described above, nothing is placed on your device by anyone else through our pages. Clearing this site's data in your browser removes all of it.

10. How we store and protect information, and for how long

• The comment text, video titles, channel names and descriptions that make up a report are held on our server so the report page and the download work. They are kept for 30 calendar days from the day they were collected, as the YouTube API Services Terms require, and then removed by an automatic job.
• Our own classifications and counts, the kinds, topics, leans and percentages, are our product and stay with the report after the text has gone, so the counts still stand and each row still links to the comment on YouTube.
• Video statistics, such as view and comment counts, stay with the report for the same period as the classifications.
• Your payment record is kept for as long as the law requires us to keep records of sales.

We take reasonable steps to protect information from misuse, loss and unauthorised access, including access controls on our server and reputable providers for hosting and payments. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond quickly if an issue arises. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

11. Deleting your data, and accessing or correcting it

Every report in your saved list has a Delete control. Deleting a report removes it and its data from our server at once. Deleting the data we hold does not change anything on YouTube; comments and videos on YouTube are YouTube's, and removing them is done on YouTube.

To remove what is in your browser, clear this site's data in your browser settings, or replace the key on the key page.

Because we never ask for access to your YouTube account, there is no authorisation to us to revoke. If you have ever granted a Google application access to your account, you can review and revoke that at Google's security settings page.

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong or out of date, using the details in section 14. We will respond within a reasonable time. There is no fee to ask.

12. Dealing with us anonymously

You can read the website, and any report someone has shared with you, without telling us who you are. To build a report you sign in with Google and pay, so anonymous dealing is not practicable for that.

13. Complaints

If you think we have mishandled your personal information, contact us using the details in section 14 and we will look into it and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.

14. How to contact us

For any privacy question, request or complaint, including about how this service uses YouTube API Services:

• Email: admin@whosaysso.app
• Phone: 1800 889 254
• Attention: Privacy, Who Says So, 27-29 Searl Rd, Cronulla NSW 2230, Australia

15. Changes to this policy

We may update this policy from time to time. The current version is always available on the website, and the date below shows when it was last updated. Continued use of the service after a change means you accept the updated policy.

Last updated: September 2026