1. Who we are

Video Planner (videoplanner.co.uk) is run by EB IT Support Ltd, Boston Enterprise Centre, Boston, Lincolnshire. We are the "data controller" for the personal information described here, under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Questions about this policy or your information: [email protected].

2. What we collect

Your account

• Name and email address — to identify you, sign you in and email you about your account. Both are encrypted.
• Password — we never store it. We keep only a one-way hash (bcrypt), which can't be turned back into your password.
• Account details — your role, plan, account status, when you signed up, when you last signed in, and when you confirmed your email and accepted these terms.
• A YouTube API key, only if you choose to add your own — encrypted.

What you put in your planner

• Videos, scripts and talking points, shot lists, the idea planner, daily vlog topics, title and thumbnail ideas, YouTube descriptions, equipment and locations, team roles and settings.
• Your music library — track titles, artists, sources, links, licence status, credits and private licence notes, and which videos and streams use them.
• Stream plans — your weekly schedule, run of show, checklists, go-live posts and after-stream recaps and figures.
• Sponsor details you add — brand names, contacts, talking points, deals, fees and payment status. If you add a sponsor's contact person, you're responsible for having a good reason to keep their details.
• Thumbnail mock-up images you upload.
• Trending-topic results we look up for you.

Things we record to keep the service safe

• A security log of sign-ins and account changes (for example "changed password", "invited a team member"), including the IP address it came from — the details and IP address are encrypted.
• Failed sign-in attempts, to stop password guessing — stored only as one-way hashes of the email address and IP address.
• If you add a passkey, its public key and a name you choose (encrypted) — never your fingerprint, face or PIN, which stay on your device.
• If you tick "Keep me signed in", a record of that device (for example "iPhone · Safari") so you can see and sign it out from My account — the label is encrypted and only a hash of the sign-in token is kept.
• A record of emails we've sent you (who to, subject, whether it was delivered) — encrypted.
• If our team needs to, notes and warnings on your account — encrypted. Notes are only for our staff. Warnings are shown to you (in My account and by email) and count as strikes for a set time; too many active strikes can lead to your account being restricted or suspended. Any restrictions on your account (for example on messaging) are also recorded, with the reason you're shown. They're kept until we withdraw them or your account is deleted.

If you contact us

Messages sent through the contact form — your name, email address and message — are encrypted and stored so we can reply, and emailed to us. We keep a one-way hash of your IP address to stop spam.

If you buy a plan

Payments are handled by Stripe. You enter your card details on Stripe's secure page — we never see or store your card number. We keep a Stripe customer reference, your plan and subscription status, and a record of each payment (date, amount and a link to Stripe's invoice). Stripe also processes your details under its own privacy policy, including for fraud prevention.

Affiliate programme

Partner brands: if you apply for a sponsor deal from a partner brand that has a login to our brand portal, that brand sees your application message, the name and photo from your welcome page (or your first name and initial), your public links, the public numbers of the YouTube and Twitch channels connected to your workspace, which way you're taking part, and your progress and proof (links and screenshots). They never see your email address. You're told this before you apply.

Getting paid for sponsor deals: if you add payout details in My account (a PayPal address, UK bank details, an IBAN or your own instructions), they're stored encrypted and shown only to a sponsor that has approved you on a deal with a fee, and to our team members running that deal — never on your public pages. When a sponsor pays you, they record the amount, date, method, transaction reference and, if they choose, proof of payment (a statement or screenshot). You, that sponsor and our team can see it. Proof files are kept privately (not on a public link). Payment records stay with the deal so both sides have a record, and are deleted with your account. Remove your payout details any time.

Your welcome page: if you fill in a welcome page for your affiliate link, what you put there — the name you choose, your banner and photo, message, colour and links — is shown publicly to anyone who opens your link (the text is still stored encrypted). We count how many times it's viewed, but not who viewed it. You can change, switch off or remove it any time, and our staff can hide it if it breaks our terms.

If you sign up through someone's affiliate link or code, we record who referred you (in your browser session until you sign up — no tracking cookie — and then on your account). The person who referred you sees only your first name and initial, when you joined and whether you're on a paid plan, plus the rewards it earned them. If you take part as an affiliate, we keep your code, how many people used your link, and the rewards you've earned and been paid.

Discord: if you link your Discord account, we keep your Discord user id and username (the username encrypted) so we can give you roles in our community server that match your account (Verified, your plan, or Sponsor for partner brands). Discord tells us nothing else — not your email, messages or password — and we don't keep the sign-in token. Unlink it in My account any time and the roles are removed. Discord's own privacy policy covers the server itself.

Calendar links: your private calendar link shows your workspace's schedule to anyone who has it, so keep it to yourself (you can make a new one any time). If you switch on a public schedule, it shows only what you choose — streams and/or upcoming videos, with or without titles — on the widget and the public calendar link, and anyone can see it.

Support codes: a support code you create in My account lets our team confirm it's your account when you ask for help. Only a scrambled version is stored; it works once and for 24 hours.

Messages: messages you send through the site — to our team, to a sponsor about one of its deals, or in team chat with people in your workspaces — are stored encrypted and kept until you or we delete your account (our team can delete a conversation sooner). Our team can read conversations with sponsors about deals they look after; team chats are only for the people in that workspace (or the two people in a direct message). Email alerts only say there's a new message; they don't include what it says.

We don't use analytics, advertising or tracking tools.

3. Encryption & security

Your information is encrypted in our database ("at rest") using AES-256-GCM, a modern standard also used by banks and governments. The key that unlocks it is stored separately from the database, on the server, so a copy of the database on its own can't be read.

Information is also encrypted in transit: connections to the site use HTTPS, so what you send and receive can't be read along the way. Other safeguards include protection against password guessing, signing you out after a period of inactivity (unless you chose to stay signed in on a device), protection against cross-site request forgery, and staff permissions so only the right people can see the admin area.

To be clear about what encryption does and doesn't do: it protects your information if the database is ever copied or stolen. When you use Video Planner, the app unlocks your information to show it to you, the people you've invited to your workspace, and — only when needed for support — our staff (see section 5).

4. How we use your information, and why we're allowed to

• To provide Video Planner — your account, your planner, team workspaces, the phone app, and features such as channel insights and trending topics. Legal basis: performing our contract with you (these terms).
• To email you about your account — confirming your email, password resets, team invites and approval notices. We don't send marketing emails. Basis: contract.
• To take payments for paid plans and keep records of them. Basis: contract, and our legal obligation to keep financial records (usually 6 years).
• To keep the service secure — the security log, sign-in protection and spam checks. Basis: our legitimate interest in protecting you and the service.
• To reply when you contact us. Basis: legitimate interest.
• To meet legal obligations, if the law requires it.

We don't sell your information, we don't use it for advertising, and nothing you write is used to train artificial intelligence. The suggestions Video Planner makes (outlines, shot ideas, pacing, idea generator, title helper) are calculated from your own data with plain statistics, inside the app.

5. Who can see your information

• People you invite to your workspace can see everything in it. Their role decides what they can change.
• Our staff (admins and moderators) can see account details to run the service, and an admin can open a read-only "view as user" of an account to help with a problem, or to monitor, moderate and manage content to keep the platform safe (for example checking a report against our Community Guidelines). Encryption protects your data from anyone outside the service, not from this. Every time it happens it is recorded in the security log, and it shows in your Recent account activity in My account.
• Our service providers, only as needed to run Video Planner. They act on our instructions and may not use your information for anything else:
  • Web hosting — the site and its database are hosted by EB IT Support Ltd itself, on servers we manage.
  • Security and delivery — Cloudflare sits in front of the website to protect it from attacks and deliver pages quickly. Every visit passes through it, so it sees your IP address, browser details and the pages you request (but not what's in our database).
  • Sending email — Postmark delivers the emails we send you (confirming your email, password resets, team invites and notices), so it receives your email address and the message, and keeps a copy for a limited time so delivery problems can be looked into.
  • Our mailbox — if you email us, or use the contact form, your message is stored by names.co.uk, who provides our email inbox.
  • Payments — Stripe takes payments for paid plans. It receives your name, email address and billing details.
• Google / YouTube — see the next section.
• The authorities, only if the law requires us to share information.

Some of these providers may process information outside the UK (for example, Cloudflare handles visits at whichever of its data centres is nearest to you). Where that happens, the transfer is protected by safeguards recognised under UK law, such as the UK International Data Transfer Agreement or Addendum, or a UK "adequacy" decision for that country.

If EB IT Support Ltd were ever sold or reorganised, your information could pass to the new owner, who would have to keep looking after it in line with this policy.

6. YouTube and Twitch

Video Planner uses YouTube API Services to read public information about YouTube channels you add (such as video titles, descriptions, publish dates, lengths and view counts) and to look up trending videos. We never ask you to sign in with Google and we never get access to your Google or YouTube account.

By using these features you are also agreeing to the YouTube Terms of Service. Google's use of information is covered by the Google Privacy Policy.

When you refresh Trending topics, topic words taken from your channel and titles (not your name or email) are sent from our server to YouTube search and to Google's public search-suggestion service.

You can remove a channel at any time, which deletes the YouTube information we stored for it. If you added your own YouTube API key you can remove it from My account, and you can also delete or restrict the key in your Google Cloud account.

Twitch

If you connect a Twitch channel, we use Twitch's API to read public information about it: the channel's name and picture, follower count, past broadcasts (titles, dates, lengths, views), clips (titles, view counts, links), its stream schedule and, while it's live, the stream title, category and viewer count every few minutes. We also count how many channels and viewers are live in the categories you stream, without recording who they are. You don't sign in with Twitch and we get no access to your Twitch account.

This information is public on Twitch, so it isn't encrypted. Viewer checks are deleted after 12 months (each stream keeps its totals) and category counts after 120 days. Disconnecting the channel deletes everything we stored from Twitch, except numbers already copied into your own stream recaps. Twitch's handling of information is covered by the Twitch Privacy Notice.

7. Cookies and your device

We use only the cookies needed for the site to work — no analytics or advertising cookies, so there's no cookie banner.

The phone app keeps a copy of the videos you open (and those you're filming or scripting) on your phone so it works without signal, plus any changes waiting to sync. This copy stays on your device and is removed when you sign out of the app. If you use a shared phone, sign out when you're done.

8. How long we keep it

• Your account and planner — until you delete them (or ask us to).
• Security log — 12 months, then deleted automatically. A record that an account was deleted is kept for the same period.
• Failed sign-in attempts — 30 days.
• Records of emails sent — 90 days.
• Payment and subscription records — 6 years after the payment, because UK law requires financial records to be kept. Deleting your account removes them from Video Planner, but Stripe and our accounts keep what the law requires.
• Twitch viewer checks — 12 months; category counts — 120 days.
• Contact form messages — until we've dealt with them, and at most 12 months.
• Password reset and email confirmation links — they stop working after use or within 1–72 hours, and are deleted shortly after.
• Server backups may hold information for a short time after it's deleted, until they're replaced.

9. Your rights

Under UK data protection law you can:

• See and correct your information — most of it is right there in the app, and you can change your name and email in My account.
• Delete your account and everything in it — use My account → Delete my account, or ask us.
• Get a copy of your information in a portable format — just ask.
• Object to or ask us to restrict how we use it.
• Complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to put things right first.

To use any of these rights, contact [email protected]. We'll reply within one month and won't charge you.

10. Children

You must be 13 or older to use Video Planner. If you're under 18, you need permission from a parent or guardian. If we learn that someone under 13 has an account, we'll delete it. If you think a child under 13 is using Video Planner, please contact us.

11. Changes to this policy

We'll update this page if the way we handle information changes, and change the date at the top. If a change is significant, we'll tell you by email or on the site before it takes effect.

12. Contact

EB IT Support Ltd
Boston Enterprise Centre, Boston, Lincolnshire
Email: [email protected]
Or use the contact form

See also our Terms of use.