Privacy Policy

1. Introduction

VidSurge ("we", "us", "our") operates the YouTube promotion platform available at vidsurge.io. We are committed to protecting your personal data and being transparent about how we collect and use it.

This Privacy Policy applies to all users of vidsurge.io, including YouTube content creators who use our platform to create and manage Google Ads campaigns for their videos. By using VidSurge, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you register for a VidSurge account, we collect:

• Full name and email address
• Password (stored as a bcrypt hash — never in plain text)
• Profile photo (if you sign in via Google OAuth)
• Account creation date and role

2.2 Campaign Data

When you create an advertising campaign, we collect:

• YouTube video URL(s) you submit for promotion
• Campaign name and budget amount
• Targeting preferences: target countries, interests, age groups, and device types
• Campaign status and duration settings

2.3 Payment & Wallet Information

Payments are processed securely by DodoPayments We collect and store:

• Wallet balance and transaction history (top-ups, deductions)
• Payment method type (e.g., card, bank) — but not full card numbers, CVV, or sensitive financial details
• DodoPayments customer ID and payment references

2.4 Campaign Performance Data

We retrieve campaign performance metrics from the Google Ads API to display in your dashboard, including:

• Impressions, views, and click-through rates
• Cost-per-view (CPV) and total spend
• Audience reach by country and demographic

2.5 Technical & Usage Data

When you use our platform, we may automatically collect:

• IP address and approximate geographic location
• Browser type and operating system
• Pages visited and actions taken within the platform
• Session timestamps and referral URLs

2.6 Communications

If you contact our support team, we retain records of that correspondence to assist you and improve our service.

3. Use of Google APIs & Google Ads API

3.1 What We Access via Google APIs

VidSurge uses the following Google APIs on behalf of our platform:

• Google Ads API: To programmatically create, manage, and report on video advertising campaigns (Demand Gen and Performance Max campaign types) on behalf of our users. Campaigns are created under our managed Google Ads account (MCC) and run on behalf of our customers' content.
• YouTube Data API v3: To retrieve publicly available metadata about YouTube videos (title, thumbnail, channel name, view count) based on the video URL you provide. We do not access private YouTube account data.

3.2 How We Use Google API Data

Data received from Google APIs is used solely to provide the VidSurge service — specifically to:

• Display video metadata in your campaign creation wizard
• Create and configure advertising campaigns in Google Ads
• Retrieve and display campaign performance metrics in your dashboard
• Manage campaign budgets and targeting settings on your behalf

We do not use Google API data for advertising to users, for profiling, or for any purpose unrelated to operating your VidSurge campaign.

3.3 Google's Terms & Policies

Our use of Google Ads API services is subject to the Google Ads API Terms of Service and Google Ads Policies. Users of VidSurge must also comply with these policies. We reserve the right to suspend accounts that violate Google's advertising policies.

4. How We Use Your Information

• Service Delivery: To create, manage, and report on your Google Ads campaigns via the Google Ads API.
• Account Management: To authenticate your identity, manage your account, and provide role-based access.
• Payment Processing: To process wallet top-ups and deduct campaign spend via DodoPayments.
• Transactional Emails: To send verification codes, payment receipts, campaign status updates, and support responses.
• Customer Support: To respond to support tickets and live chat inquiries.
• Platform Improvement: To analyze usage patterns and improve our features and user experience.
• Legal Compliance: To comply with applicable laws, regulations, and Google API policies.
• Fraud Prevention: To detect and prevent fraudulent transactions and policy violations.

We do not use your data for automated decision-making that produces legal effects, for selling to data brokers, or for any purpose beyond operating and improving the VidSurge platform.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only as necessary to operate the platform:

5.1 Service Providers

• Google LLC — Google Ads API (campaign management) and YouTube Data API (video metadata). Subject to Google's Privacy Policy.
• DodoPayments — Payment processing. Subject to DodoPayments' Privacy Policy.
• Resend — Transactional email delivery (verification, receipts). Emails sent from donotreply@vidsurge.io.
• Railway — Cloud hosting for our API server and PostgreSQL database. Data is stored in secure cloud infrastructure.
• Hostinger — Web hosting for the vidsurge.io frontend. Subject to Hostinger's data processing terms.

5.2 Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of VidSurge, our users, or the public.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. You will be notified via email or a prominent notice on our site.

6. Cookies & Tracking

VidSurge uses the following types of cookies and local storage:

• Authentication Tokens: JWT tokens stored in browser memory or secure storage to keep you logged in during a session.
• Theme Preference: A vidsurge_theme key stored in localStorage to remember your light/dark mode preference. This is purely functional and contains no personal data.
• Session Cookies: Temporary cookies used to maintain your session state. These expire when you close your browser.

We do not use third-party advertising cookies, tracking pixels, or behavioral profiling technologies. We do not use Google Analytics or similar analytics platforms that track users across websites.

7. Data Security

We implement industry-standard security measures to protect your data:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Passwords are hashed using bcrypt before storage — we never store plain text passwords.
• API secrets and credentials are stored as environment variables — never hardcoded in source code.
• Our PostgreSQL database is hosted on secure, isolated cloud infrastructure with restricted access.
• Access to production systems is limited to authorized personnel only.

While we take reasonable precautions, no internet transmission is 100% secure. In the event of a data breach that affects your rights, we will notify you as required by applicable law.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide our services. Specifically:

• Account data: Retained for the lifetime of your account plus 30 days after deletion.
• Campaign data: Retained for 12 months after campaign completion for reporting purposes.
• Transaction records: Retained for 7 years for financial and tax compliance.
• Support communications: Retained for 2 years.

You may request deletion of your account and associated personal data at any time by contacting customerservice@vidsurge.io. Transaction records may be retained longer where required by law.

9. Your Rights (GDPR / Data Subject Rights)

Depending on your location, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to Restriction: Request that we limit how we process your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at customerservice@vidsurge.io. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Children's Privacy

VidSurge is not directed at children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly. If you believe we have inadvertently collected such data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will notify you by email or by displaying a prominent notice on vidsurge.io before the change takes effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

Continued use of VidSurge after the effective date of an updated Privacy Policy constitutes your acceptance of the changes.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

VidSurge
2nd Floor, 9-4-134/73, Aruna Colony, Tolichowki
Hyderabad - 500008, Telangana, India
Email: customerservice@vidsurge.io
Website: https://vidsurge.io