Privacy Policy

Topicx (“Topicx”, “we”, “us”) is a service that generates AI summaries of public YouTube channels, grouped by topics the user chooses. The service is operated by Ultrix BV, a Belgian besloten vennootschap registered at Guido Gezellestraat 20, 9300 Aalst, Belgium, with enterprise number BE 0797.795.009 (the “data controller” under the GDPR).

For any privacy question, request, or complaint you can reach us at operations@ultrix.be.

We keep the dataset small on purpose. We collect:

• Account data. If you sign in with Google or Facebook: your name and email address. Those providers also return a profile picture URL with their sign-in response; we discard it immediately and never store it. We do not request any other information from Google or Facebook. If you create an email/password account: the email address and display name you provide, plus a hashed password (never stored in plain text). We send transactional emails to verify your address and to reset your password when you request it.
• Product data you create. The topics you define, the YouTube channels you add to them, your optional channel weights, and the summaries we generate for you.
• Subscription data from Stripe. Your subscription tier, status, and current billing period. Payment-card details are entered directly into Stripe and never touch our servers.
• Optional digest email sign-up. If you subscribe on a free digest page without creating an account, we store your email address, the niche you chose, and (when provided) campaign attribution parameters. We use double opt-in: we send a confirmation link before any digest emails go out.
• Operational logs. Minimal request information used for security, abuse prevention, and debugging. Sensitive fields (passwords, tokens, secrets) are never logged.
• First-party product analytics. Page path, time on page, how far the page was scrolled, named button or link targets you click, and (when present) campaign parameters from a tracked visit. Events are tied to a random session id and, if you are signed in, to your account id. We do not store IP addresses or browser user-agent strings in this pipeline.

We do not sell personal data, and we do not use Google or Facebook user data for advertising or training third-party AI models.

We use the Google account data we keep (name, email) only to:

• Authenticate you and create or recognise your Topicx account.
• Display your name inside Topicx.
• Contact you about your account or service-critical changes.

Topicx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use the Facebook account data we keep (name, email) only to authenticate you, create or recognise your Topicx account, and display your name inside Topicx. We do not post on your behalf, read your friends list, or access any other Facebook data.

• Performance of a contract — to create your account, generate the summaries you request, and provide the subscription you paid for.
• Consent — to send optional niche digest emails when you sign up on a free topic page or enable digest notifications in your profile. You can withdraw consent anytime via the unsubscribe link in every email or in your account settings.
• Legitimate interests — to keep the service secure, prevent abuse, and improve the product through aggregated first-party analytics (pages viewed, time on page, and campaign performance).
• Legal obligation — to keep records required by tax, billing, and consumer-protection law.

We share personal data only with the third-party service providers we need to run Topicx, and only the data each of them needs to do its job. The categories of recipients are:

• Identity providers — Google LLC and Meta Platforms, Inc., used when you choose to sign in with your existing Google or Facebook account. Email/password accounts are authenticated by Topicx directly (passwords hashed on our servers).
• Payment processor — Stripe, Inc., used for subscription billing. Card details are entered directly into Stripe and never reach our servers.
• Cloud hosting and database provider — runs the application servers, PostgreSQL database, and object storage that hold your account and summaries.
• Large-language-model (AI) provider — generates topic summaries from public YouTube transcripts. We do not send your name, email, or other account data to the model; only the public transcripts we are summarising and an anonymous topic context.
• Email delivery — Resend, Inc., used to send confirmation, welcome, and digest emails you opted into, plus account verification and password-reset messages for email/password accounts. Messages are sent from our dedicated mail subdomain (e.g. mail.my-topicx.com).
• Operational tooling — error tracking and log retention used to operate and support the service.

We do not sell personal data and we do not use Google or Facebook user data for advertising or to train third-party AI models. The current named list of sub-processors is available on request at operations@ultrix.be.

We set a first-party session cookie so that you stay signed in, plus a small temporary cookie used during sign-in to protect against cross-site request forgery. We also set two first-party cookies used for marketing measurement: tx_sid (a random session id for on-site analytics, 30 days) and tx_attribution (campaign parameters from a tracked click such as a paid ad redirect, 30 days). We do not use third-party advertising or analytics cookies or vendors.

Your account, product data, and generated summaries are hosted in the European Union. Stripe stores billing data in accordance with its own privacy policy.

• Account & product data — kept while your account is active and for up to 30 days after you delete it (to allow for accidental restore), then permanently removed.
• Billing records — kept for the period required by applicable tax and accounting law (typically 7 years in the EU).
• Operational logs — kept for up to 30 days.
• Product analytics events — kept for up to 90 days, then deleted.

Under the GDPR and similar laws you can:

• access the personal data we hold about you,
• correct it if it is wrong,
• delete it (see “Deleting your account” below),
• object to or restrict processing,
• port your data to another service,
• lodge a complaint with your national data-protection authority.

To exercise any of these rights, email operations@ultrix.be. We respond within 30 days.

You can delete your Topicx account and all associated personal data in two automated ways:

• From your profile page, using the “Delete my account” button.
• For Facebook users: by removing the Topicx app from Facebook's Settings > Apps and Websites screen.

See our data deletion page for the full walkthrough. Deletion cancels any active subscription and removes your account and the content you created. Anonymous usage statistics and the invoice records we are required to keep for accounting may remain.

Topicx is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.

We protect your data with industry-standard security practices, including HTTPS everywhere, hardened session cookies, protection against cross-site request forgery, and restricted access to production credentials.

When we make material changes we update the “Last updated” date and, when required, notify you by email or in-product banner before the change takes effect.

Privacy questions, data requests, and complaints: operations@ultrix.be.