Privacy Policy
This Privacy Policy explains how Mister Group s.r.o. (“Mistergroup”, “we”, “us”) handles information on the website inboxmg.com (which embeds YouTube videos) and in inBOX, our business operations platform, including the inBOX YouTube integration, which uses YouTube API Services.
1. Who we are
Data controller: Mister Group s.r.o., Lidická 700/19, Veveří, 602 00 Brno, Czech Republic, Company ID (IČO) 03676838. Contact: kontakt@mistergroup.org.
2. The inBOX YouTube integration
inBOX is an internal platform used by Mistergroup staff and AI assistants working on their instructions. Its YouTube integration lets an authorized person connect a YouTube channel that Mistergroup operates (or that a client has explicitly asked us to manage) and then upload and manage videos on that channel.
2.1 What we access
Only after the channel owner signs in with Google and grants access (OAuth scopes youtube.upload and youtube.force-ssl), inBOX uses the YouTube Data API to:
- read basic information about the authorized channel (channel ID, title, uploads playlist, public statistics);
- upload videos and read and update their metadata (title, description, tags, category, languages and translations, privacy and scheduled publication time, audience and licence settings, recording date);
- set custom thumbnails, add or remove videos in the channel’s playlists, and upload and list caption tracks;
- read the list of video categories and supported languages.
We do not use the YouTube API to read, post or moderate comments, to access subscribers or subscriptions, YouTube Analytics or monetary data, and we do not delete videos through the API.
2.2 How we use it
We use this access solely to carry out uploads and changes that an authorized person requested for the connected channel (for example a task such as “upload this video with this title and publish it on this date”). We do not use YouTube data for advertising, profiling, or any other purpose, and we do not sell it.
2.3 What we store and for how long
- Authorization tokens issued by Google are stored encrypted in our secrets vault and are used only by the inBOX integration. They are never displayed to users or AI assistants. They are kept until the access is revoked or the connection is removed, and are then deleted within 7 days.
- Video files and upload progress: files to be uploaded are processed on our servers; while an upload is in progress we keep its technical state (upload session and number of bytes sent) so it can resume after an interruption. This state is deleted once the upload is finished or cancelled, and no later than 30 days after it was created.
- Work records: the inBOX task that requested an upload keeps the resulting video ID, link and the metadata we set, as a record of the work done. We do not keep copies of other YouTube data; any YouTube API data we hold is refreshed or deleted at least every 30 days.
2.4 Sharing
We share YouTube data only with Google/YouTube, as needed to perform the requested actions. Our infrastructure providers (servers we operate, and our encrypted secrets vault provider) process data on our behalf under confidentiality obligations. We do not disclose YouTube data to any other third party unless required by law.
2.5 Cookies and devices
The inBOX YouTube integration does not place cookies or similar technologies on the devices of YouTube viewers or channel owners.
2.6 Revoking access and deleting data
The channel owner can revoke inBOX’s access at any time on the Google security settings page: https://security.google.com/settings/security/permissions. After revocation inBOX can no longer access the channel. You can also ask us at kontakt@mistergroup.org to remove the connection and delete stored authorization data and YouTube API data; we do so within 30 days (tokens within 7 days).
3. The inboxmg.com website
The website presents inBOX and shows our videos through the embedded YouTube player. Until you click play, the page only shows the video’s preview image (loaded from YouTube’s image server i.ytimg.com); the player itself is then loaded from youtube-nocookie.com (YouTube’s privacy-enhanced mode). When you play a video, YouTube/Google may process data and set cookies under the Google Privacy Policy and the YouTube Terms of Service. We receive no personal data from the player.
The website itself does not use analytics or advertising cookies and has no forms or accounts. It is hosted on Vercel, which processes technical request data (such as IP addresses in server logs) to deliver the site.
An earlier version of the site offered a vote on logo animations. Browsers that voted may still hold the cookies ilp_voter (random anonymous ID) and ilp_choice (the chosen option); they are no longer read and expire within one year. The related anonymous vote records stored with Upstash (Redis) expire within 400 days.
4. Legal basis and your rights
We process data on the basis of our legitimate interest in operating our business and the website, and to perform actions requested by the channel owner who authorized access. Under the GDPR you have the right to access, rectify, erase or restrict the processing of your personal data, to object to processing and to data portability. Contact us at kontakt@mistergroup.org. You may also lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).
5. Security
Access to inBOX is limited to authorized team members. Authorization tokens are encrypted at rest and transmitted only over TLS to Google.
6. Changes
We may update this policy. The effective date above shows the latest version; significant changes will be announced on this page.