Privacy Policy

1. Introduction

This Privacy Policy explains how Breakout Strategies (“Breakout”, “we”, “us”) collects, uses, shares and protects personal data when you visit our website, create an account, use the Breakout platform or work with our strategists (together, the “Services”).

The data controller is Breakout Strategies Ltd, registered office La Tourelle Lodge, La Rue D’Aval, St Martin, Jersey, JE3 6ER, Channel Islands. You can reach us about anything in this policy at david@breakoutstrategies.ai.

We are committed to handling personal data in accordance with applicable data-protection laws, including the Data Protection (Jersey) Law 2018, the UK GDPR, the EU GDPR, the California Consumer Privacy Act (CCPA) and other laws that may apply where you live.

2. Information we collect

Information you give us

• Account details: name, email address, password, company name, job role and profile information.
• Project information: the businesses, channels, goals, briefs and other material you add to the platform.
• Communications: messages, support requests, call notes and feedback you send to our team, including refund requests.
• Marketing preferences and responses to surveys or forms.

Information from connected accounts

• Google account: when you sign in with Google or connect a Google account, we receive your name, email address and profile picture.
• YouTube data: if you choose to connect a YouTube channel, we access channel and video information and analytics for that channel, limited to the permissions you grant. We only read this data; we do not post, edit or delete anything on your channel. See section 5 for how YouTube data is handled.

Information collected automatically

• Breakout platform usage data: which areas of the Breakout platform you visit, which features you use, actions you take within the platform, timestamps and your consumption of metered features. This relates only to your activity inside Breakout, not your browsing elsewhere.
• Device and log data: IP address, browser type, operating system, referring URLs and error logs.
• Cookies and similar technologies as described in section 8.

Information from third parties

• Payment and order data from Paddle, our Merchant of Record, such as transaction status, plan purchased, billing country and the last four digits of a card. We never receive or store full card numbers.
• Publicly available YouTube data about channels and videos, obtained through the YouTube API Services, which we use to power research and benchmarking features.

3. How we use information

We use personal data to:

• provide, operate, secure and maintain the Services and your account;
• process orders, subscriptions, credits and refunds, and keep billing records;
• provide strategist support, respond to enquiries and send service messages such as receipts, renewal reminders and security notices;
• understand how the Services are used so we can improve them and develop new features;
• send marketing communications where you have agreed to receive them or where we are otherwise permitted. You can opt out at any time using the link in any marketing email or by contacting us;
• detect, prevent and investigate fraud, abuse and security incidents;
• comply with legal obligations and enforce our terms.

Legal bases (Jersey, UK and EU). We rely on performance of a contract (providing the Services you signed up for), our legitimate interests (improving and securing the Services, and running our business), consent (where required, for example for non-essential cookies or certain marketing), and compliance with legal obligations.

AI processing. Some features of the platform use third-party AI model providers. These features operate on publicly available YouTube data and on the business inputs you provide in the platform. We do not send personal data to AI providers, and personal data is not used to generate outputs. We use providers that contractually commit not to train their models on data we send them.

4. How we share information

We do not sell personal data. We share it only as follows:

Service providers act on our instructions under data-processing agreements and may only use personal data to provide services to us.

5. Google and YouTube data

Breakout uses YouTube API Services. By connecting a YouTube channel or using features that draw on YouTube data you also agree to the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.

• What we access. For channels you connect: channel metadata, video metadata and channel analytics, read-only. We also access publicly available YouTube data about other channels and videos.
• How we use it. To provide the research, benchmarking, strategy and reporting features you use, and to show your own channel’s performance within the platform. We do not use YouTube data for advertising or sell it to third parties.
• Storage. We store authorised YouTube data to provide the Services and refresh it periodically. Authorised data is refreshed or deleted in line with YouTube’s API policies, and we delete it when you disconnect your channel or close your account, subject to section 7.
• Revoking access. You can disconnect a channel from your account settings at any time, and you can revoke Breakout’s access to your Google account at https://myaccount.google.com/permissions.
• Limited Use. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International transfers

We and our service providers may process personal data in countries other than the one you live in, including the United States. Where data is transferred out of Jersey, the UK or the European Economic Area, we rely on appropriate safeguards such as adequacy decisions, the UK International Data Transfer Agreement, or the European Commission’s Standard Contractual Clauses, and we take steps to ensure the data remains protected.

7. Data retention

We keep personal data only for as long as needed for the purposes described above:

• Account and project data: for the life of your account and for 30 days after closure, after which it is deleted or anonymised, unless we need to keep it longer to resolve disputes or comply with law.
• Billing records: for six years after the end of the financial year they relate to, as required by tax and accounting law.
• Support communications: for up to three years after the matter is closed.
• Usage logs: typically up to 12 months, unless needed for security investigations.

Aggregated or anonymised data that cannot identify you may be kept indefinitely.

8. Cookies and similar technologies

We use cookies and browser storage to keep you signed in, remember your preferences, secure the Services and understand how they are used.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies will prevent you from using parts of the Services. Where the law requires, we will ask for your consent before setting non-essential cookies.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, authentication, logging and regular review of our providers. No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data we will notify you and any relevant regulator as required by law.

10. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (subject to legal retention requirements);
• restrict or object to certain processing, including direct marketing;
• port your data to another provider in a structured, machine-readable format;
• withdraw consent at any time where processing is based on consent;
• complain to a supervisory authority. Our lead regulator is the Jersey Office of the Information Commissioner (jerseyoic.org). UK residents may contact the Information Commissioner’s Office (ico.org.uk) and EU residents the authority in their member state.

California residents have the right to know what personal information we collect, use and disclose, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

To exercise any of these rights, email david@breakoutstrategies.ai. We may need to verify your identity before acting. We will respond within one month, or within any shorter period required by law.

11. Children

The Services are for businesses and professionals and are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new effective date and, for material changes, notify you by email or in the platform. Please review this page periodically.

13. Contact us

Questions, requests or complaints about this policy can be sent to:

Breakout Strategies Ltd
La Tourelle Lodge, La Rue D’Aval, St Martin, Jersey, JE3 6ER, Channel Islands
Email: david@breakoutstrategies.ai