Privacy Policy · BRU Revenue

1. Introduction

Bru Network S.L. («Bru Network», «we», «our» or «us») is a company incorporated in Spain under VAT ID ESB70831581, with registered office at C/ Joan Güell 131-133, 4º 3ª, 08028 Barcelona, Spain.

Bru Network operates the BRU Revenue application (the «Application»). We use it to manage the YouTube channels and Content ID assets that we represent as a certified Multi-Channel Network (MCN), to calculate revenue share, and to prepare reports for our clients on their YouTube channels and social media accounts.

This Privacy Policy describes how we access, use, store and protect data obtained through the Application, including data from Google and YouTube, Meta (Facebook and Instagram), TikTok, X and LinkedIn. By authorising the Application to access your data on any of these platforms you agree to the practices described here.

2. Scope and Users

The Application is operated only by authorised personnel of Bru Network S.L. It is not offered to the general public and cannot be downloaded by third parties.

Our clients are the rights holders, clubs, federations, media companies and creators that have signed an agreement with Bru Network. They receive the reports we produce with the Application and, where we enable it, can sign in to a private client area that shows only their own data.

3. Data We Access via Google and YouTube APIs

When an authorised user signs in through Google OAuth 2.0, the Application requests the following scopes:

We only access data for the YouTube Content Owner accounts controlled by Bru Network and for the channels that have signed a valid MCN partnership agreement with Bru Network.

4. Data We Access from Other Platforms

We access a client's accounts on these platforms only when the client authorises it, and only for the accounts it authorises:

The Application only reads data from these platforms: it does not publish, edit or delete anything on them. Where a platform's terms restrict how data about other users may be stored or shown, as LinkedIn's do for its members, we follow those restrictions.

5. How We Use the Data

The data we retrieve through the Application is used exclusively for:

• Calculating the revenue share owed by Bru Network to each partner channel
• Producing the monthly reports we deliver to each client about its own YouTube channels and social media accounts
• Monitoring channel performance and the status of Content ID claims, references and disputes
• Meeting tax, accounting and statutory reporting obligations under Spanish and EU law

We do not:

• Sell, rent or license data to any third party
• Use data for advertising or marketing purposes
• Share data with anyone other than the client it belongs to and the service providers listed in Section 7, except as strictly required by applicable law or by a valid court order
• Use the data to train machine-learning, generative-AI or similar models

6. Storage and Security

Data retrieved through the Application is stored in databases operated by Bru Network on (a) devices of authorised Bru Network personnel and (b) a dedicated server hosted by Hetzner Online GmbH in Falkenstein, Germany. Backups of that server and of those devices are stored in Google Drive.

The access tokens granted by each platform are kept on these same systems and are used only by the Application. Access to the Application, the server and the client area is restricted to authorised people, and connections to the server and to the client area are encrypted (HTTPS).

7. Service Providers

We use the following providers, which process data on our behalf and only for the purposes described here:

• Hetzner Online GmbH (Germany): hosting of our server
• Google (Google Drive): storage of backups
• Clerk, Inc.: sign-in to the client area

8. Compliance with the Google API Services User Data Policy — Limited Use

The Application's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are prominent in the Application's user interface
• We do not transfer Google user data to third parties except (a) as necessary to provide or improve user-facing features, (b) for security purposes, or (c) to comply with applicable law
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data except (a) with explicit affirmative consent from the user, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and used only for internal operations and in accordance with applicable privacy and other jurisdictional legal requirements

We follow the developer terms and policies of Meta, TikTok, X and LinkedIn for the data we obtain from each of them.

9. Data Retention

We retain data for as long as necessary to fulfil the purposes described in Section 5 and, for each client, while its agreement with Bru Network is in force. Data from each platform is never kept longer than that platform's terms allow: for example, LinkedIn Page data is kept for no more than twelve months. Monthly revenue and billing records are retained for a minimum of six (6) years in accordance with Spanish tax law. Data that is no longer required is deleted during routine housekeeping.

10. Your Rights Under GDPR

If you are resident in the European Economic Area, the General Data Protection Regulation (EU 2016/679) grants you rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal.

You can revoke the Application's access at any time: for Google, at Google Account Permissions; for Meta, by removing Bru Network as a partner in Meta Business Suite; and for TikTok, X and LinkedIn, by removing the Application from the connected apps in each platform's settings. Complaints can be lodged with the Spanish Data Protection Authority at www.aepd.es.

11. Children

The Application is not directed at children under 16 and we do not knowingly collect personal data from children.

12. International Transfers

We process data on devices in Spain and on our server in Germany, within the European Economic Area. Google and Clerk may process data outside the EEA; where they do, they rely on the transfer safeguards set out in their data processing terms, such as the European Commission's Standard Contractual Clauses.

13. Changes to This Policy

The most current version will always be posted at https://bru.network/legal-privacy with an updated «Last updated» date.

14. Contact

Bru Network S.L.
C/ Joan Güell 131-133, 4º 3ª
08028 Barcelona, Spain
Email: privacy@bru-network.com
VAT ID: ESB70831581