In one sentence. This policy covers both forjacast.com (landing) and app.forjacast.com (the application). The landing is static and does not collect personal data. The application processes the data you authorise when connecting your YouTube channel and the data strictly necessary to operate — detailed in section 7.

1. Data controller

ControllerFabián García de la Vega Hoyo, operating under the trade name Norteworks
Tax ID (NIF)Pending self-employment registration
AddressPending self-employment registration
Contacthola@norteworks.com
Websiteforjacast.com

2. Data we collect

On this Website (forjacast.com) we do not actively collect personal data. This is an informational static landing page that does not include contact forms, registrations or user accounts.

If you contact us via the email address hola@norteworks.com, we will process the data you voluntarily provide (name, email and message content) for the sole purpose of responding to you.

In the application app.forjacast.com we process the account data you provide upon registration and the data necessary to integrate your YouTube channels via Google's APIs — detailed in section 7 of this policy.

3. Purpose of processing

Responding to your enquiries sent by email.
Basic technical operation of the Website (content delivery, language preference persistence).

4. Legal basis for processing

Consent of the data subject (Art. 6.1.a GDPR), when you voluntarily contact us by email.
Legitimate interest of the controller (Art. 6.1.f GDPR), for the technical operation and security of the Website.

5. Retention periods

Data communicated by email is retained for the time necessary to manage your enquiry and, subsequently, for the minimum legal periods required. If you request deletion, your data will be deleted earlier unless legally required to retain it.

6. Data recipients

We do not transfer your data to third parties, except where legally required. Email management is performed through the email hosting provider associated with the norteworks.com domain. No international transfers of data outside the European Economic Area take place in connection with this Website.

7. Use of Google and YouTube APIs

Forjacast uses Google's APIs, including the YouTube Data API v3 and the YouTube Analytics API, to operate the connection and publishing features for YouTube channels. By connecting a YouTube channel to Forjacast, you expressly authorise access to the following data:

Channel identity: channel ID, handle (@), name and avatar. Used exclusively to show you which channel you are connected to inside the application.
Upload capability (youtube.upload): used only to publish on your channel the videos generated by you within Forjacast, with the metadata (title, description, tags, thumbnail, publish date) you have defined in the application. Forjacast does not publish anything without an explicit action from you or a schedule you have configured.
Performance metrics (yt-analytics.readonly): views, watch time, subscribers gained and aggregate metrics for videos published from Forjacast. Used to display your own performance in the application dashboard.

What we store

Forjacast stores in its database: the YouTube channel ID, the handle, the title and the OAuth refresh_token (encrypted at rest with AES-128 via Fernet). We do not store Google passwords, the contents of your inbox, or data from Google products other than those listed above.

Who we share it with

We do not share your YouTube account data with third parties. Data travels exclusively between your browser, Forjacast servers and Google's APIs.

How we use it

Data obtained via the YouTube APIs is used solely to provide you with the service described in these terms. We do not use it to train our own AI models, for advertising profiling, nor do we sell it to third parties.

How to revoke access

At any time you can:

Disconnect the channel from the application itself, at Channels → your channel → Disconnect from YouTube. This action deletes the encrypted refresh_token from our database and revokes the token at Google.
Revoke access directly from your Google account permissions page: myaccount.google.com/permissions.

How we delete your data

When you disconnect the channel, we immediately delete the refresh_token, the channel ID and handle. If you additionally wish to delete your Forjacast account in full, write to hola@norteworks.com and we will erase all your personal and channel data within a maximum period of 30 days.

Compliance

Forjacast's use of information received from Google's APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Information received from the YouTube APIs is additionally governed by the YouTube API Services Terms of Service and by Google's Privacy Policy.

8. Your rights

As a data subject, you have the right to:

Access your personal data.
Rectify inaccurate data.
Erase your data (right to be forgotten).
Object to processing.
Restrict processing.
Data portability.
Withdraw consent at any time.
Not be subject to automated decisions, including profiling, with legal effects.

To exercise these rights, send an email to hola@norteworks.com indicating the right you wish to exercise, and attaching a copy of your national ID, passport or equivalent identification document.

9. Complaints to the supervisory authority

If you believe that the processing of your data does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency through its electronic headquarters (aepd.es/en).

10. Security

The Controller adopts the necessary technical and organisational measures to ensure the security of personal data and prevent their alteration, loss, processing or unauthorised access, considering the state of technology, the nature of the data and the risks to which they are exposed.

YouTube access and credential custody

When you connect a YouTube channel, Forjacast never receives or stores your Google account password. The authorisation flow is standard OAuth 2.0 against Google's servers: you approve the requested permissions on Google's consent screen, and Forjacast receives only a refresh_token bound to the authorised channel.

Encryption at rest. The refresh_token is stored encrypted in our database with AES-128 via Fernet. The master encryption key is managed outside the application and is not accessible from client-side code.

Encryption in transit. All traffic between your browser, Forjacast servers and Google's APIs travels over TLS 1.2 or higher.

Minimum scope. Forjacast requests only the strictly necessary permissions: upload videos to the authorised channel (youtube.upload), read the channel's identity (youtube.readonly) and read channel metrics (yt-analytics.readonly). We do not request access to Gmail, Drive, Contacts or any other Google product.

Revocation. You can revoke access at any time from the application itself or from myaccount.google.com/permissions. Revocation is effective immediately and deletes the encrypted token from our systems.

11. Changes to this policy

This Privacy Policy may be updated to adapt to regulatory or functional changes. The version in force is always the one published on this Website, with the last update date visible at the top of the document.