Privacy Policy

1. Who we are

This Privacy Policy applies to the website https://mrbonzo.com (and the Cloudflare Pages host mrbonzo-beats.pages.dev), related pages, and the operator tools we use to publish our own music content. The data controller is Alexandros Pilatos, trading as Mr. Bonzo and Purple Sound Studio, based in Athens, Greece. Contact: [email protected].

This policy is written to meet GDPR/EEA requirements and Google Cloud / YouTube API Services disclosure rules. It is not a substitute for independent legal advice.

2. What this site and our tools do

We offer:

• an official artist website with beats, drum kits, discography, contact, and language choice (English / Greek);
• licensing and downloads fulfilled by third-party stores, mainly Beatstars (and Pond5 for stock audio);
• studio services (production, recording, mixing and mastering, sound design, scoring) arranged by enquiry;
• optional newsletter signup (currently paused until the mailing system is publicly reachable);
• internal publishing software (n8n workflows and a private uploader) that posts videos and related assets to channels we own, including YouTube, using Google APIs.

3. Data we collect on the website

We collect as little as possible:

• Language preference: stored in your browser as localStorage['selected-lang'] (en or el). This does not identify you to us.
• Analytics: Google Analytics 4 (measurement ID G-XBS5WKEGPE) records approximate usage (pages, device/browser, coarse location, outbound clicks to stores and socials). GA uses Google cookies/identifiers. Google acts as processor; see Google’s Privacy Policy.
• Technical logs: Cloudflare may log IP address, user-agent, and request metadata to operate the CDN, DDoS protection, and TLS. Logs are retained according to Cloudflare’s policies.
• Contact: if you email us, message Discord, or write on Instagram, we receive whatever you send (name, handle, message, attachments such as receipts for claim clearance).
• Newsletter (when enabled): email address, signup time, and anti-spam honeypot fields. Stored in our self-hosted Plunk instance. Not sold. The public form is off until a stable API hostname exists.
• Purchases: Beatstars, PayPal, Pond5, and similar platforms process payments. We do not receive your full card data. We may see your store username, order ID, or a receipt you forward so we can whitelist a YouTube claim.

We do not run a user account system on this website. We do not sell personal data.

4. YouTube API Services (Google Cloud / n8n publisher)

We operate a private publishing application (“Mr. Bonzo Studio Publisher”) built with n8n and related scripts. It uses YouTube Data API v3 through a Google Cloud OAuth client to manage our own channels, including @mrbonzobeats and @mrbonzomusic.

By using any YouTube-powered feature of our services, you also agree to the YouTube Terms of Service. Information received from Google APIs is used in line with this Privacy Policy and the Google Privacy Policy.

What the application accesses. With OAuth tokens issued to channels we control, the application may:

• upload, update, schedule, list, and delete videos (including Shorts);
• read and write video titles, descriptions, tags, thumbnails, privacy status, and playlists;
• read channel identity needed to confirm the authenticated channel;
• refresh access tokens so scheduled jobs can run without a browser session.

What we do not do. The publisher is not a consumer login for visitors of mrbonzo.com. We do not use YouTube API data to build advertising profiles, sell or transfer YouTube user data to data brokers, or grant unrelated third parties independent access to YouTube API data. We do not use YouTube API data for purposes other than operating, securing, and improving the publishing of content on channels we own.

Storage. Client ID, client secret, and refresh tokens are stored on private operator infrastructure (homelab / self-hosted n8n), not in the public website or in the browser of site visitors. Access tokens are short-lived and cached in memory where the uploader runs.

Revocation. Access can be revoked at any time in Google Account permissions: https://myaccount.google.com/permissions. After revocation, refresh tokens stop working and uploads halt until re-authorised by the channel owner.

This use is intended to comply with the YouTube API Services Terms of Service, Developer Policies, and Limited Use requirements. If Google’s rules change, we will update this section.

5. Other publishing platforms

The same operator tools may post or delete content on Meta platforms (Facebook, Instagram, Stories) and similar channels we own, using tokens stored on the same private infrastructure. Those platforms’ own terms and privacy policies apply to data they process. Site visitors are not required to connect a Meta or Google account to browse mrbonzo.com.

6. Cookies and similar technologies

Strictly necessary: Cloudflare security and load balancing. Functional: language preference in localStorage (not a cookie). Analytics: Google Analytics cookies as described by Google. Third-party embeds (Beatstars player, YouTube if embedded) may set their own cookies. You can block analytics cookies in your browser; the site will still load.

7. Legal bases (GDPR)

• Legitimate interests: running the site, security, understanding aggregate traffic, publishing our own catalogues, clearing copyright claims you ask us to clear.
• Consent: newsletter (when the form is live); non-essential analytics where required by your jurisdiction.
• Contract: performing a licence or studio booking you request.
• Legal obligation: tax, accounting, or lawful requests.

8. Retention

Analytics is retained per our GA4 settings. Emails and claim evidence are kept as long as needed to handle the request and defend rights, then deleted or archived. Newsletter addresses until you unsubscribe or we shut the list. YouTube/Meta tokens until we revoke them or stop the publisher. Cloudflare logs per provider defaults.

9. Recipients and transfers

Processors and independent controllers may include Cloudflare (hosting/CDN), Google (Analytics, YouTube API, Cloud Console), Beatstars, Pond5, Spotify/Apple (public catalogue lookups at build time), Discord, Meta, and email providers. Some are outside the EEA; transfers rely on the provider’s GDPR mechanisms (e.g. SCCs) where applicable.

10. Your rights

If GDPR applies, you may request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent. Email [email protected]. You may complain to the Hellenic Data Protection Authority (www.dpa.gr) or your local supervisory authority.

11. Children

The site is aimed at artists and general audiences. We do not knowingly collect personal data from children under 16. Licensable music use must follow Beatstars’ age and contract rules.

12. Security

TLS on the public site, secrets kept out of the client, newsletter keys only in server environment variables, OAuth secrets only on the publisher host. No method is perfectly secure.

13. Changes

We will update this page and the “Last updated” date when practices change in a material way. Continued use of the site after an update means you have read the new text.

14. Contact

Privacy requests: [email protected]. Related documents: Terms of Service.