Privacy Policy

1. Who we are

Schalumov Corporation Limited, operating as softstory ("we", "our", "us"), is an influencer-marketing agency.

2. Scope

This policy explains how we handle personal data collected through our website and its contact form. It does not cover information processed when we run campaigns for clients; that processing is governed by separate agreements.

3. Data we collect

Source	Data	Purpose	Legal basis (GDPR)
Contact form (Formcarry)	• Name • Email address • Message content	• Respond to your inquiry • Maintain records of correspondence	Art. 6 (1)(f) – Legitimate interests (efficient communication)
Server logs	• IP address • Browser & device info • Date/time of visit	• Site security • Debugging & analytics (aggregate only)	Art. 6 (1)(f) – Legitimate interests (security & improvement)

We do not use cookies, third-party analytics, or targeted advertising trackers.

4. How we use the data

Reply to questions or quotes you submit.
Keep an audit trail for security or legal purposes.
Improve website stability and user experience (aggregate statistics only).
Send you our newsletter if you opt in (you can unsubscribe anytime).

5. How long we keep it

Contact-form data: deleted 12 months after our last correspondence unless legal obligations require longer retention.
Server logs: automatically purged after 30 days.
Newsletter data: retained until you unsubscribe or after 24 months of inactivity.

6. Sharing your data

We do not sell or rent personal data. Access is limited to:

Formcarry, Inc. – hosts the contact-form submission (EU Standard Contractual Clauses in place).
MailerLite – email service provider managing newsletter subscriptions and delivery (Standard Contractual Clauses in place).
Service providers who supply hosting or security services under confidentiality agreements.
Regulators or law-enforcement agencies where required by law.

7. International transfers

Our providers (e.g., Formcarry for the contact form and MailerLite for newsletters) may process data outside your jurisdiction. Where required, transfers are covered by the EU Standard Contractual Clauses (SCCs) or other appropriate safeguards.

8. Your rights (EU/UK GDPR)

You may request to:

Access, correct, or delete your personal data.
Restrict or object to processing.
Data portability (where applicable).
Lodge a complaint with your supervisory authority.

9. Security measures

We use HTTPS, access controls, and encryption at rest for stored submissions. While no method is 100% secure, we strive to protect your data to industry standards.

10. Children

Our site is not directed to children under 16. We do not knowingly collect data from minors.

11. Changes to this policy

Updates will appear on this page with a new "Last updated" date. Material changes will be announced via a notice on our website.

12. Contact

For privacy questions, write to:

Data Protection Contact

Schalumov Corporation Limited

Email: privacy@softstorymedia.com

YouTube API Services

Schalumov Corporation Limited, operating as softstory, runs an internal creator-research and brand-matching platform (the "Service") used by our team and our brand clients. The Service uses the YouTube Data API v3 to retrieve publicly available information about YouTube channels and videos so brands can identify, evaluate, and work with creators. This section describes how we use YouTube API Services and how we handle data obtained through them, and it supplements the Privacy Policy above.

The Service accesses YouTube data using a server-side API key. We do not ask YouTube users to sign in, and we do not use OAuth or request access to any private YouTube account, private analytics, or any data that is not publicly visible on YouTube. We only process information that is already public on the platform.

Agreement to YouTube and Google terms

Because the Service uses YouTube API Services, by using it you also agree to be bound by:

the YouTube Terms of Service, and
the Google Privacy Policy.

What YouTube data we access

Through the YouTube Data API we retrieve the following public information about channels and their videos:

Channel data: channel ID, title, and description; handle / custom URL; public subscriber count and video count; thumbnail / avatar image URL; country and channel keywords (where public); and the public "uploads" playlist.
Video data: video ID, title, and description; public view count, like count, and comment count; publish date and duration; and whether a video is a live or upcoming broadcast.

We do not access private videos, private playlists, watch history, private account or contact details, monetization data, or any YouTube Analytics that are not publicly displayed.

How we use YouTube data

Display public channel and video statistics to our team and brand clients inside our platform.
Calculate aggregate performance metrics for a channel — such as average views, likes, and comments per recent long-form video, and engagement derived from those values.
Classify channels into content categories (e.g. gaming, tech, lifestyle) using automated and AI-assisted analysis of public video titles and descriptions.
Evaluate how well a creator fits a given brand ("brand matching"), producing a fit score and a short rationale.
Detect publicly mentioned past sponsors from public video titles and descriptions.
Generate short, personalised outreach messages to creators based on their public content.

To produce category classifications, brand-fit scores, and outreach text, we send the relevant public YouTube data (such as channel and video titles and descriptions) to third-party AI providers acting as our service providers (see "How we share YouTube data" below). This data is sent only to generate the results described above and is not used by us or our providers to train AI models.

Storage, refresh, and retention

Public channel and video statistics, and the metrics we derive from them, are stored in our databases (Google Firebase / Firestore and Airtable) so they can be displayed and refreshed.
Stored YouTube API data is refreshed at least every 30 days while a channel remains in active use, and deleted when it is no longer needed or on request. Derived analytics, AI summaries, and category labels are recalculated on refresh.
We retain data only as long as necessary for the purposes described here or as required by law.

How we share YouTube data

We do not sell YouTube API data. We share it only with:

our brand clients, within the Service, so they can evaluate creators; and
service providers who process data on our behalf under contract, namely Google Firebase / Firestore and Airtable (hosting and data storage) and Anthropic and OpenAI (AI processing of public text for the categorisation, brand-matching, and outreach features above).

These providers may use the data only to provide services to us.

Your choices and data deletion

YouTube account holders can control the data YouTube shares about them through their YouTube and Google account settings. You can:

review or remove the data Google holds about you via the Google security settings page; and
request that we delete the YouTube-derived data we hold about your channel by emailing privacy@softstorymedia.com. On request we will remove the relevant channel and video data and any metrics derived from it from our systems.

Data security

We use access controls and secure, encrypted connections (HTTPS/TLS) to protect the data we store, and we restrict access to authorised personnel and clients.

Changes to this section

We may update this section from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this Privacy Policy.