Youllab Privacy Notice

Youllab is currently jointly operated by:

Bence Komlódy and Máté Etelaky jointly determine the purposes and essential means of the processing described in this Notice and therefore act as joint controllers for the purposes of the General Data Protection Regulation (“GDPR”).

Our common privacy contact is:

hello@youllab.com

You may exercise your data-protection rights against either joint controller. We coordinate privacy requests internally so that you do not need to decide which operator to contact.

Both operators are jointly responsible for ensuring that appropriate information is provided to users, that data-subject requests are handled, and that the processing of personal data through Youllab is managed in accordance with applicable data-protection law.

This section provides the essence of our joint-controller arrangement.

This Notice applies to personal data processed through the Youllab website and service, including account creation, authentication, profiles, Discovery, Favorites, collaboration requests, private contact exchange, service communications, support, feedback, moderation and related platform operations.

It also covers personal data we may process when contacting potential creators about Youllab using professional or creator contact information that has been made publicly available.

Third-party websites and services that you access through Youllab, such as YouTube, Instagram, TikTok or other external platforms, have their own privacy practices.

Depending on how you use Youllab, we may process the following categories of information:

Account and authentication

Email address, account identifier, authentication provider, verification state, account status and authentication-related timestamps.

Profile information

Display/profile name, social-media platforms and links, audience information, biography, categories, languages, city and country, availability and collaboration intent.

Creator, Brand or Service Provider information

Profile-type-specific details such as services, work mode, turnaround, pricing information or portfolio links.

Profile media

Avatar and banner images.

Private collaboration contact

Your designated private contact method and contact email.

Collaboration activity

Requests sent and received, pitch text, sender/recipient, status, acceptance/decline information, timestamps and related connection state.

Favorites

Profiles that you choose to save.

Communications

Support requests, feedback, replies and other communications you send to us.

Email delivery information

Notification preferences, recipient email address, notification type, delivery status and relevant delivery errors.

Moderation and safety

Reports, moderation decisions, visibility/account restrictions and information needed to investigate misuse.

Technical and session information

Authentication/session information and technical information processed by our infrastructure providers.

Creator outreach information

Public creator/channel name, publicly listed contact address, channel URL or identifier, approximate audience size, creator niche/search category and outreach history.

We do not intentionally ask users to provide special-category personal data such as health information, political opinions, religious beliefs, sexual orientation or similar sensitive information.

Because Youllab contains free-text fields, it is possible for a user to voluntarily include such information. Please avoid submitting sensitive personal information unless it is genuinely necessary.

Create and operate your Youllab account

Performance of our contract with you — GDPR Art. 6(1)(b).

Authenticate you and maintain sessions

Performance of contract.

Create, display and manage your profiles

Performance of contract.

Provide Discovery, Favorites and collaboration functionality

Performance of contract.

Store and exchange designated private contact information after acceptance

Performance of contract and actions requested by users.

Send essential account and collaboration notifications

Performance of contract and, where appropriate, legitimate interests in operating the Service.

Provide support and respond to requests

Performance of contract and legitimate interests.

Protect Youllab against fraud, spam, abuse and security threats

Legitimate interests — GDPR Art. 6(1)(f).

Moderate profiles and enforce our Terms

Legitimate interests and, where applicable, legal obligations.

Process illegal-content notices and other legally required requests

Compliance with legal obligations — GDPR Art. 6(1)(c).

Maintain appropriate operational records and defend legal claims

Legitimate interests and legal obligations where applicable.

Contact potentially relevant creators using publicly available professional/creator contact information

Legitimate interests, subject to applicable electronic-communications and direct-marketing rules.

Send optional Youllab updates where you have chosen to receive them

Consent — GDPR Art. 6(1)(a).

Where processing relies on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing that lawfully occurred before withdrawal.

Some information is necessary to provide particular parts of the Service.

For example, an account needs authentication information, and certain profile or collaboration features require specific profile or contact information.

Fields that are required for functionality will be identified as such in the Service.

You are not required to provide optional information, but certain features may not work if information necessary for those features is not provided.

Your profile is intended to be seen by other eligible Youllab members.

Profile information may include your profile name, linked platforms, audience information, biography, categories, languages, approximate location, collaboration intent and other information that you choose or are required to provide as part of the profile.

At present, Youllab profiles are not intended to function as anonymously accessible public-web profile pages for unauthenticated visitors.

That architecture may change in the future. If we introduce publicly accessible profiles or search-engine indexing of profiles, we will update our privacy information and relevant controls accordingly.

You may upload an avatar and banner to a Youllab profile.

Profile media is stored through our infrastructure and is intended to be displayed as part of your profile.

There is one important technical distinction: although profile pages themselves currently require access to Youllab, stored profile-media files are served through publicly accessible file URLs while those files exist.

This means someone who already has the direct image URL may technically be able to access the image without logging into Youllab.

Deleting the relevant profile or media removes the active stored object through Youllab's deletion process, subject to provider backups and other limited technical retention described below.

Youllab stores your designated collaboration contact information separately from ordinary profile information.

Your private collaboration email is not displayed through Discovery, Favorites or ordinary profile viewing.

When you accept a collaboration request, relevant private contact information may be disclosed to the other party so that you can communicate outside Youllab.

This disclosure is part of the connection functionality that you request by accepting the collaboration request.

Once information has been legitimately disclosed to another user, we cannot guarantee deletion of copies that person has already received or stored outside Youllab.

When you send or receive a collaboration request, we process information necessary to operate the interaction, including the participating profiles, pitch, request status and relevant timestamps.

Decline information and connection restrictions may also be retained where necessary to enforce the user's choices and prevent unwanted repeated requests.

If a profile or account is deleted, associated collaboration information may also be removed from the active platform as part of our deletion processes, subject to information that must or may lawfully be retained separately.

Favorites are private to the user who saves them.

The profile owner is not informed merely because another user has added their profile to Favorites.

We process Favorites to provide this organisational feature.

We may identify creators who appear potentially relevant to Youllab using professional or creator information that has been made publicly available, including contact information published in connection with a creator's channel or professional activity.

Such information may include a channel or creator name, public business/contact email, social-media/channel URL, channel identifier, approximate audience size and broad creator category.

These details may come from publicly accessible creator/channel information and from tools used to organise or extract those publicly available details.

We may use this information to introduce Youllab to potentially relevant creators and to measure whether outreach has resulted in a response or registration.

If you ask us not to contact you, we may retain the minimum information needed on a suppression list so that we can respect that request in the future.

Nothing in this section overrides any additional rules that apply to electronic communications or direct marketing.

Youllab may send operational emails relating to the Service.

These can include account, security, incoming collaboration request, acceptance, expiration and similar service notifications.

Users may have preference controls for certain types of notification.

We currently use Resend to deliver transactional Youllab email.

When an email is delivered, relevant information such as the recipient address, notification category, delivery status or delivery error may be processed by us and the email provider.

Operational/service communications are separate from optional promotional updates.

If we introduce an optional subscription such as “Keep me updated on important Youllab stuff”, joining that list will be voluntary.

Where consent is the applicable legal basis, you will be able to withdraw it and unsubscribe.

Withdrawing optional marketing consent does not prevent us from sending communications that are reasonably necessary to operate your account or the Service.

If you send feedback, contact support or otherwise communicate with us, we process the information you provide so that we can respond, investigate issues and improve the Service.

Feedback can contain free-form text.

Please avoid including personal information about other people unless it is necessary and lawful to do so.

We may process relevant account, profile, connection, communication and technical information when necessary to investigate Terms violations, illegal-content reports, fraud, security incidents, abuse, misuse of private contact information or other threats to users or the Service.

Where required by law, we may retain information concerning a legal report or moderation action for longer than ordinary product information.

Youllab uses Supabase Auth for authentication infrastructure.

Where you choose Google Sign-In, Google authenticates you and supplies the information necessary to create or identify your Youllab account, such as your Google account identifier and email-related identity information permitted by the authentication flow.

Youllab currently requests only basic authentication scopes needed for sign-in rather than access to your Google Drive, Gmail, contacts or unrelated Google account content.

Google also processes information under its own privacy terms when you interact with Google services.

Youllab uses browser storage required to operate the Service.

This currently includes local browser storage for authentication/session functionality, remembering your active Youllab profile and preserving relevant profile-form drafts; temporary session storage for short-lived operational state; and a first-party preference cookie used for interface behaviour such as sidebar state.

These technologies are used for service functionality rather than advertising.

Youllab does not currently use advertising cookies, cross-site advertising trackers or marketing pixels.

We also do not currently operate a general visitor analytics tracking system.

If analytics is introduced, we will update this Notice to explain what is collected, the provider involved, its purpose, legal basis and any user choices that apply.

Other Youllab users

Information included in your profile can be displayed to eligible members, and designated private contact details can be disclosed to a counterpart after an accepted collaboration request.

Youllab operators and authorised administration

Bence Komlódy and Máté Etelaky may access information where necessary to operate, support, secure and moderate the Service.

Infrastructure and service providers

We use third parties that help provide hosting, database, authentication, development/deployment infrastructure, email delivery and related technical services. Current important providers include Supabase, Google, Resend and Lovable or related hosting/deployment infrastructure where applicable.

Outreach/email providers

If specialised software is used to operate creator outreach, the provider may process the recipient information and communication history necessary to provide that service.

Authorities and legal recipients

We may disclose information where required by law, valid legal process or a competent authority, or where reasonably necessary to establish, exercise or defend legal claims.

We do not currently sell users' personal data to advertisers or data brokers.

Some of our service providers operate outside Hungary or the European Economic Area.

Our primary Supabase project data is currently hosted in the London, United Kingdom region.

Other providers may process data in the United States or other countries.

Where personal data is transferred from the EEA to a country that does not benefit from an applicable adequacy decision, we use or rely on appropriate transfer safeguards provided by applicable data-protection law, such as Standard Contractual Clauses, where appropriate.

We keep personal data only for as long as necessary for the purpose for which it is processed, taking into account the operation of your account, safety and abuse prevention, user choices, legal obligations, dispute resolution and the establishment or defence of legal claims.

For active accounts, account and profile information is generally retained while the account or relevant profile remains active.

When you delete a profile or account, Youllab's active deletion process removes the associated information that is designed to be deleted through that process.

Some information may remain temporarily in service-provider backups or technical systems until those copies rotate or are deleted according to the provider's applicable retention process.

Connection restrictions or suppression information may be retained where necessary to remember that one user does not wish to receive further requests or that an outreach recipient has asked us not to contact them again.

Email-delivery records, support communications, feedback, safety records and moderation information are retained according to how long they are reasonably needed for operational, security, legal or dispute-related purposes.

Where law requires a particular retention period, we follow that requirement.

Youllab provides account and profile deletion functionality.

Deletion removes relevant live account/profile information according to the functionality of the Service, including associated profile media where applicable.

Deletion does not:

• make information already disclosed to another user disappear from that person's systems;
• remove information that another party independently controls;
• require immediate deletion of every temporary provider backup; or
• override information that must lawfully be retained.

You may also contact hello@youllab.com regarding deletion or another privacy request.

We use technical and organisational measures intended to protect personal data.

Current controls include authentication, database access policies, server-side authorisation checks, access restrictions, separate handling of private collaboration contacts, storage access controls and encrypted web connections.

Our infrastructure providers also maintain their own security measures.

No online system can guarantee absolute security, so these safeguards reduce risk rather than eliminating it completely.

Youllab does not currently make decisions about users solely by automated processing that produce legal effects or similarly significant effects within the meaning of GDPR Article 22.

The Service may use ordinary technical logic for functions such as filtering, validation, Discovery ordering, security controls and abuse prevention.

Substantive moderation decisions are currently primarily subject to human/administrative review.

If we later introduce materially significant automated decision-making or profiling, we will update our disclosures as required.

Depending on the circumstances and applicable law, you may have the right to:

• access personal data we hold about you;
• receive a copy;
• correct inaccurate information;
• request deletion;
• request restriction of processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• object to direct marketing; and
• withdraw consent where consent is the legal basis.

These rights are subject to the conditions and exceptions in applicable law.

You can make a request by contacting:

hello@youllab.com

We may request information necessary to verify your identity before fulfilling a request.

There is currently no separate self-service privacy-export tool, but this does not affect your right to request access or portability where applicable.

If you have a privacy concern, we would appreciate the opportunity to resolve it directly.

Contact:

hello@youllab.com

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

The Hungarian supervisory authority is:

Email: ugyfelszolgalat@naih.hu

Youllab accounts are intended for users aged 16 or older.

If we learn that an account belongs to someone who does not meet the minimum age requirement, we may restrict or delete the account as appropriate.

Parents or guardians who believe that a child below the minimum age has created an account may contact:

hello@youllab.com

We may update this Privacy Notice as Youllab develops, our processing changes, providers change or applicable requirements change.

The current version and update date will remain available through Youllab.

Where a change materially affects how personal data is processed, we may notify affected users through the Service, by email or through another appropriate method.

If a new activity requires consent, we will request it where required rather than treating a Privacy Notice update itself as consent.

Questions, requests or complaints concerning privacy may be sent to:

hello@youllab.com

Joint controllers:

See also our Terms of Service and Impressum.