iCast · Innovative Studios
Privacy Policy
Effective November 4, 2026 · Provided by Alessandro Mori and the Innovative Studios team
This Privacy Policy explains what personal data iCast collects, why, how long we keep it, who we share it with and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended).
1. Data controller
The controller of your personal data is Alessandro Mori, operating as Innovative Studios, Via Example 1, 00100 Roma (RM), Italy. For any privacy question or request write to admin.icast@gmail.com.
2. Data we collect
| Category | What it includes | Source |
|---|---|---|
| Account data | Name, e-mail address, Google account identifier, whether your e-mail is verified, profile picture URL. We never receive your Google password. | Google Sign-In, with your authorisation |
| Channel data | Channel name, handle, description, links, country, profile picture, banner, date of birth (never shown publicly), acceptance of the Terms. | You |
| Content | Videos, thumbnails, titles, descriptions, hashtags, tags, music credits, comments, playlists, Audio Library submissions, verification requests and the metadata of uploaded files (duration, resolution, codec). | You |
| Activity | Videos you watch, how long and up to which point, where you came from (e.g. Home, search), likes and dislikes, subscriptions and bell settings, saves, shares, searches, "Not interested" feedback, reports you file. | Your use of the Service |
| Settings | Theme, playback, notification, privacy and upload preferences. | You |
| iCast Points | Your points balance, streak and the history of points earned and redeemed (which activity, when). | Your use of the Service |
| Payments | For Premium and tips: Stripe customer, subscription and payment identifiers, plan, amounts, dates, status, tip messages and whether you chose to show your name. Card details are collected and stored only by Stripe. For creators receiving tips: your Stripe account identifier and whether payouts are active — identity documents and bank details stay with Stripe. | You and Stripe |
| Technical data | IP address (used transiently for security and rate-limiting), session cookie identifiers, browser type, request logs. | Your device |
If you watch while signed out, we use a random identifier in our session cookie to count views fairly and, only if you allow it in the cookie notice, to personalise your Home feed.
3. Why we use your data and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account and channel, hosting and streaming videos, comments, subscriptions, playlists, notifications and settings | Performance of the contract — Art. 6(1)(b) |
| Personalised recommendations and search ranking for signed-in users | Our legitimate interest in offering a relevant service — Art. 6(1)(f). You can object at any time by switching off "Personalised recommendations". |
| Personalising Home for signed-out viewers | Your consent — Art. 6(1)(a), withdrawable at any time |
| Creator analytics (aggregated views, watch time, retention, traffic sources) | Legitimate interest — Art. 6(1)(f); creators never see who individually watched |
| Security, fraud and spam prevention, enforcing our Terms and Guidelines, handling reports and appeals | Legitimate interest — Art. 6(1)(f); legal obligations under the DSA — Art. 6(1)(c) |
| iCast Points, Premium, tips and creator payouts; preventing payment fraud and points abuse | Performance of the contract — Art. 6(1)(b); legitimate interest in preventing fraud — Art. 6(1)(f) |
| Keeping accounting and tax records of payments, and tax reporting about creators where required (e.g. DAC7) | Legal obligation — Art. 6(1)(c) |
| Age protections (minimum age, age-restricted content) | Legal obligation and legitimate interest in protecting minors — Art. 6(1)(c) and (f) |
| Responding to lawful requests from authorities, keeping records required by law | Legal obligation — Art. 6(1)(c) |
We do not sell your personal data, we don't share it with advertisers and we don't use it for behavioural advertising.
4. Recommendations and automated processing
Our Discovery Engine processes your activity to predict which videos you'll find worth watching. This is profiling, but it doesn't produce legal or similarly significant effects on you. The main parameters are described in How Recommendations Work. You can pause or clear your watch and search history, give "Not interested" feedback, or switch off personalisation entirely.
5. What is public
Your channel name, handle, picture, banner, description, links, subscriber count, public videos and playlists, comments and replies are visible to everyone. Your subscriptions and likes are private by default and can be made public in Settings → Privacy. Your e-mail address and date of birth are never public.
6. Who we share data with
- Service providers acting as processors under Art. 28 GDPR: hosting and server infrastructure, database hosting, object storage and content delivery for media files, e-mail delivery. They may only process data on our instructions.
- Google, which provides sign-in under its own privacy policy.
- Stripe (Stripe Payments Europe, Ltd., Ireland), which processes Premium payments and tips and, for creators, verifies identity and makes payouts. Stripe acts as an independent controller for its own legal obligations (anti-money-laundering, fraud prevention) under the Stripe Privacy Policy. When you tip a creator, they see the amount, your message and — if you choose — your name.
- Authorities, when required by law, a court order or to protect the rights, property or safety of users and the public — including reporting child sexual abuse material to the competent authorities.
- A successor, if the Service is transferred, with notice to you.
7. International transfers
We prefer providers located in the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses with appropriate supplementary measures.
8. How long we keep data
- Account, channel and Content: until you delete them or your account.
- Watch and search history: until you clear them. After 18 months, watch activity is anonymised and old searches are deleted automatically.
- Notifications: 12 months.
- Payment and tip records (amounts, dates, status and Stripe identifiers): 10 years, as required by Italian accounting law (Art. 2220 of the Civil Code). If you delete your account they are kept without your profile and tip messages, restricted to that purpose.
- iCast Points history: until you delete your account.
- Reports, moderation decisions and appeals: up to 12 months after the decision becomes final, or longer if needed for legal proceedings.
- Security logs: up to 30 days.
When you delete your account, we delete your personal data within 30 days, except data we must keep by law, which we restrict to that purpose.
9. Children
You must be at least 14 to create an iCast account (the age of digital consent in Italy under Art. 2-quinquies of the Privacy Code). If we learn that we hold data of a younger child without parental authorisation, we will delete it. Videos designated as made for kids are served with comments disabled. Accounts of users under 18 can't view age-restricted videos.
10. Security
We protect data with encryption in transit (HTTPS), signed and HTTP-only session cookies, CSRF protection, strict Content Security Policy, rate limiting, least-privilege access for staff and re-encoding of uploaded images to strip hidden metadata such as GPS location.
11. Your rights
You have the right to access your data, obtain a copy in a portable format (Settings → Your data → Download), rectify it, erase it (Settings → Delete account), restrict processing, object to processing based on legitimate interest — including profiling for recommendations — and withdraw consent at any time without affecting earlier processing. Write to admin.icast@gmail.com; we reply within one month. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of your country of residence.
12. Cookies
See our Cookie Policy.
13. Changes
We'll notify you of material changes to this policy in the Service or by e-mail before they apply.