Privacy Policy · BRU Revenue

1. Introduction

Bru Network S.L. («Bru Network», «we», «our» or «us») is a company incorporated in Spain under VAT ID ESB70831581, with registered office at C/ Joan Güell 131-133, 4º 3ª, 08028 Barcelona, Spain.

Bru Network operates the BRU Revenue application (the «Application»), an internal financial operations tool used to calculate revenue attribution, billing and reporting for the YouTube channels that Bru Network represents as a certified Multi-Channel Network (MCN).

This Privacy Policy describes how we access, use, store and protect data obtained through the Application. By authorising the Application to access your Google and YouTube data you agree to the practices described here.

2. Scope and User Base

The Application is a private internal tool. Access is restricted to authorised personnel of Bru Network S.L. The Application is not offered to the general public and is not available for download by third parties.

3. Data We Access via Google and YouTube APIs

When an authorised user signs in through Google OAuth 2.0, the Application requests the following scopes:

We only access data for the YouTube Content Owner accounts controlled by Bru Network and for the channels that have signed a valid MCN partnership agreement with Bru Network.

4. How We Use the Data

The data we retrieve from YouTube APIs is used exclusively for:

• Calculating the revenue share owed by Bru Network to each partner channel
• Generating monthly financial reports shared with our partner channels and used for internal accounting
• Monitoring channel performance and the status of Content ID claims, references and disputes
• Meeting tax, accounting and statutory reporting obligations under Spanish and EU law

We do not:

• Sell, rent or license data to any third party
• Use data for advertising or marketing purposes
• Share data with entities outside Bru Network, except as strictly required by applicable law or by a valid court order
• Use the data to train machine-learning, generative-AI or similar models

5. Storage and Security

All data retrieved from Google and YouTube APIs is stored locally on authorised Bru Network devices inside an encrypted DuckDB database file. No data is transmitted to any external cloud service. OAuth refresh tokens are stored locally in encrypted form and are never transmitted off-device.

Access to the Application and its underlying database is restricted to authorised Bru Network personnel via operating-system-level authentication. Devices that host the Application use full-disk encryption.

6. Compliance with the Google API Services User Data Policy — Limited Use

The Application's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide or improve user-facing features that are prominent in the Application's user interface
• We do not transfer Google user data to third parties except (a) as necessary to provide or improve user-facing features, (b) for security purposes, or (c) to comply with applicable law
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data except (a) with explicit affirmative consent from the user, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data is aggregated and used only for internal operations and in accordance with applicable privacy and other jurisdictional legal requirements

7. Data Retention

We retain YouTube API data for as long as necessary to fulfil the purposes described in Section 4. Monthly revenue and billing records are retained for a minimum of six (6) years in accordance with Spanish tax law. Data that is no longer required for operational or statutory purposes is deleted from our local database during routine housekeeping.

8. Your Rights Under GDPR

If you are resident in the European Economic Area, the General Data Protection Regulation (EU 2016/679) grants you rights of access, rectification, erasure, restriction, portability, objection and consent withdrawal. You can revoke the Application's OAuth access at any time at Google Account Permissions. Complaints to the Spanish Data Protection Authority at www.aepd.es.

9. Children

The Application is not directed at children under 16 and we do not knowingly collect personal data from children.

10. International Transfers

All data is processed and stored on devices physically located within the European Economic Area (Spain). We do not transfer personal data outside the EEA.

11. Changes to This Policy

The most current version will always be posted at https://bru.network/legal-privacy with an updated «Last updated» date.

12. Contact

Bru Network S.L.
C/ Joan Güell 131-133, 4º 3ª
08028 Barcelona, Spain
Email: privacy@bru-network.com
VAT ID: ESB70831581