Privacy Policy

1. Introduction

WhitelistVideo ("we," "our," or "us") is committed to protecting the privacy of families using our parental control software. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Chrome extension and Progressive Web App (PWA) dashboard.

This policy applies to:

• WhitelistVideo Chrome Extension
• WhitelistVideo Parent Dashboard (PWA)
• WhitelistVideo Website (whitelist.video)

By using WhitelistVideo, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Parent Account Information

When you create a WhitelistVideo account, we collect:

• Email Address: For account creation, authentication, and notifications
• Password: Securely hashed and stored
• Payment Information: Processed by third-party payment processors (Stripe/PayPal) for paid subscriptions
• Account Settings: Your preferences, subscription tier, and configuration

2.2 Child Profile Information

When creating a child profile, parents provide:

• Profile Nickname: A display name chosen by the parent (real names not required). We encourage using pseudonyms or nicknames (e.g., "Kiddo", "Junior"). Visible only to the parent account holder.
• Age Range: Approximate age for content filtering purposes. Used to ensure age-appropriate content evaluation by AI. Not an exact birthdate; stored as a general age range category (e.g., "8-10", "11-13", "14-15").
• Profile Preferences: Visual customization (emoji, colors) and content filtering rules set by the parent.

2.3 No Child Personally Identifiable Information (PII)

WHITELISTVIDEO DOES NOT COLLECT, STORE, PROCESS, OR TRANSMIT ANY CHILD-SPECIFIC PERSONALLY IDENTIFIABLE INFORMATION. We explicitly do NOT collect:

• Full names, last names, or legal names of children
• Exact birthdates, birth years, or precise ages
• Photographs, images, or biometric data of children
• Physical addresses, school names, or location data associated with children
• Email addresses, phone numbers, or contact information of children
• Social Security numbers, government identifiers, or financial information of children
• Viewing history, watch time, or behavioral tracking data attributable to individual children
• Device identifiers, IP addresses, or persistent identifiers linked to child profiles

The only child-related data elements retained are: (a) a parent-provided nickname or pseudonym, and (b) a generalized age band category. Neither element constitutes personally identifiable information under COPPA, GDPR, CCPA, or other applicable privacy regulations.

2.4 Usage Data

We automatically collect certain information when the extension is used:

• Channel Request Data: Channel access requests submitted by children
• Whitelist Data: Channels you've approved or blocked
• AI Filtering Data: Aggregate counts of videos approved/rejected by AI (Premium tier only)
• Extension Activity: Timestamps, browser version, extension version
• AI Category Preferences: Categories you've enabled for auto-whitelisting (Premium tier only)

Important: To comply with COPPA, we do NOT store or track your child's viewing history. We don't record which specific videos your child watches or how long they watch them.

2.5 Technical Information

• Device type and operating system
• Browser type and version
• IP address (for security and fraud prevention)
• Extension installation ID (anonymous identifier)

3. How We Use Your Information

We use the collected information for the following purposes:

3.1 Service Delivery

• Enable parent-child video approval workflow
• Synchronize whitelists across devices
• Provide real-time notifications for video requests
• Enforce content filtering based on your settings

3.2 AI Features (Premium Tier)

• Analyze video content to auto-approve educational videos in selected categories
• Improve AI accuracy based on your approval patterns (opt-in only)
• Train platform algorithms to show age-appropriate recommendations

3.3 Account Management

• Authenticate your account and prevent unauthorized access
• Process subscription payments and billing
• Send service-related emails (approval requests, subscription updates)
• Provide customer support

3.4 Product Improvement

• Analyze aggregated, anonymized usage data to improve features
• Fix bugs and optimize performance
• Develop new features based on usage patterns

3.5 Security and Compliance

• Detect and prevent fraudulent accounts
• Ensure COPPA compliance
• Protect against security threats

4. COPPA Compliance & Children's Privacy

4.1 No Direct Child Data Collection

WhitelistVideo does NOT collect personal information directly from children. All account creation, settings, and permissions are managed by parents.

4.2 What Children Cannot Do

• Create accounts
• Enter personal information
• Communicate with other users
• Make purchases
• Access the internet without parental oversight

4.3 Parental Control & Consent

Parents have full control over:

• Creating and deleting child profiles
• Reviewing all channel requests
• Deleting any child-related data at any time
• Opting out of optional data collection (AI training contributions)

4.4 Data Minimization

We only collect the minimum data necessary to provide the service. Child profiles contain only:

• A nickname (can be pseudonym) - real names are not required or encouraged
• Age range (for filtering) - not an exact birthdate
• Profile preferences (emoji, colors) - for visual personalization only

4.5 Anonymous Activity Monitoring

For parental oversight and safety assurance, we maintain de-identified activity logs including:

• Videos viewed and blocked
• Watch time summaries
• Content filtering decisions

Critical Privacy Protections:

• No Personal Identifiers: Activity logs contain only the parent-chosen nickname, never real names or identifying information
• Parent Account Association: All data is stored under the parent's account, not linked to any child's personal identity
• No External Sharing: Activity data is never sold, shared, or provided to third parties
• Parent Control: Parents can review, export, or delete all activity data at any time
• Cannot Be Traced: Because profiles use pseudonyms, activity cannot be connected to any specific child's real-world identity

This anonymous monitoring serves exclusively to:

• Enable parents to verify content filtering is working
• Allow parents to see which approved channels their child prefers
• Provide transparency into the protection system's effectiveness
• Help parents make informed decisions about whitelist adjustments

4.6 No Behavioral Advertising or Profiling

• We do NOT use activity data for advertising
• We do NOT create behavioral profiles of children
• We do NOT share data with advertisers or data brokers
• Activity data is used solely for parental oversight within the platform

4.7 Content Safety Limitations and Parental Responsibility

IMPORTANT DISCLOSURE FOR COPPA COMPLIANCE:

While WhitelistVideo is designed to help protect children from inappropriate content, parents must understand the following limitations:

• Best Efforts Only: Our content filtering operates on a "best efforts" basis and cannot guarantee 100% protection from inappropriate content
• Third-Party Content: All video content is provided by third-party platforms (e.g., YouTube). We do not create, host, or control this content
• Content Provider Responsibility: The third-party video platform (e.g., YouTube/Google) bears sole responsibility for content on their platform, including compliance with child safety regulations
• Parental Supervision Required: WhitelistVideo is a tool to ASSIST parental supervision, not REPLACE it. Parents remain fully responsible for monitoring their children's online activities
• No Liability for Content Exposure: We are not liable for any inappropriate content that may bypass our filters or originate from third-party platforms

By using WhitelistVideo for your children, you acknowledge these limitations and agree that any concerns about specific content should be directed to the content provider (e.g., YouTube/Google).

4.8 Parental Consent Verification via OAuth Providers

WhitelistVideo relies on third-party OAuth authentication providers (such as Google and Apple) to verify parental identity and consent. When you create an account using Google Sign-In or Apple Sign-In:

• Identity Verification: We trust the identity verification performed by the OAuth provider (Google or Apple) as sufficient verification that you are an adult capable of providing parental consent under COPPA
• Age Assurance: Google and Apple require account holders to meet minimum age requirements and enforce their own age verification processes. WhitelistVideo relies on these existing verifications rather than implementing a separate age-gating mechanism
• No Additional PII Collection: By relying on OAuth provider verification, we avoid collecting additional personally identifiable information (such as government-issued IDs or credit card numbers) solely for the purpose of verifying parental consent
• Consent Scope: By creating a WhitelistVideo account through an OAuth provider, you represent that you are the parent or legal guardian of any child profiles you create, and you consent to the limited data collection described in this Privacy Policy on behalf of your child

This approach aligns with the FTC's guidance on obtaining verifiable parental consent under COPPA, which recognizes trusted third-party identity verification as an acceptable consent mechanism.

5. How We Share Your Information

We do NOT sell your personal information or your child's data to anyone.

5.1 Service Providers

We share limited data with trusted third-party service providers who help us operate WhitelistVideo:

• Cloud Hosting: Vercel, AWS (for infrastructure)
• Payment Processing: Stripe, PayPal (they never see your full payment details)
• Email Services: SendGrid, Mailgun (for transactional emails only)
• Analytics: Aggregated, anonymized data only (no PII)

All service providers are contractually required to protect your data and use it only for WhitelistVideo services.

5.2 Legal Requirements

We may disclose information if required by law:

• To comply with legal obligations, court orders, or subpoenas
• To protect the rights, property, or safety of WhitelistVideo, our users, or the public
• To prevent fraud or security threats

5.3 Business Transfers

If WhitelistVideo is acquired or merged with another company, your information may be transferred. We will notify you via email and provide options before any transfer of your child's data.

6. Third-Party AI and Large Language Model (LLM) Services

WhitelistVideo utilizes third-party artificial intelligence services, including Large Language Models (LLMs), to provide content analysis and filtering capabilities. By using WhitelistVideo, you expressly consent to the following data processing activities:

6.1 Data Transmitted to AI Services

When utilizing AI-powered content analysis features, we transmit the following limited, non-personally-identifiable information to third-party AI service providers:

• Age Band Information: A generalized age range category (e.g., "8-10", "11-13", "14-15") to enable age-appropriate content filtering. This is NOT an exact age, birthdate, or any information that could identify a specific child.
• Video Metadata: Video titles, descriptions, channel names, and category tags from third-party platforms (e.g., YouTube) for content analysis purposes.
• Parent-Configured Preferences: Content categories and filtering rules configured by the parent.

6.2 Data NOT Transmitted to AI Services

WE DO NOT TRANSMIT ANY CHILD-SPECIFIC PERSONALLY IDENTIFIABLE INFORMATION TO THIRD-PARTY AI SERVICES. The following data is explicitly excluded from all AI service transmissions:

• Child names, nicknames, or profile identifiers
• Parent names, email addresses, or account identifiers
• Device identifiers, IP addresses, or location data
• Viewing history, watch patterns, or behavioral data
• Any data that could be used to identify, contact, or locate a specific individual or child

6.3 Third-Party AI Service Providers

We utilize the following categories of third-party AI service providers:

• Large Language Model Providers: For natural language analysis of video content (e.g., OpenAI, Anthropic, Google Cloud AI)
• Content Classification Services: For automated categorization and age-appropriateness assessment

All third-party AI service providers are bound by data processing agreements that prohibit the use of transmitted data for purposes other than providing services to WhitelistVideo. Third-party AI providers do NOT receive information sufficient to identify any individual user, parent, or child.

6.4 AI Data Retention by Third Parties

Data transmitted to third-party AI services:

• Is processed in real-time for content analysis purposes
• May be temporarily cached by AI providers for performance optimization
• Is NOT used by AI providers to train their models (where such opt-out is available)
• Is subject to the respective privacy policies of each AI service provider

6.5 Consent to AI Processing

BY USING WHITELISTVIDEO, YOU EXPRESSLY CONSENT TO:

• The transmission of age band information and video metadata to third-party AI services for content analysis
• Processing of such data by third-party Large Language Models and AI systems
• The probabilistic and non-deterministic nature of AI-generated content assessments
• Potential variations in AI analysis results over time due to model updates by third-party providers

If you do not consent to AI processing, you may use WhitelistVideo without AI features by disabling AI-powered content analysis in your account settings. Core whitelist functionality remains available without AI processing.

7. Data Security

We implement industry-standard security measures to protect your information:

7.1 Technical Safeguards

• Encryption: All data transmitted is encrypted using TLS/SSL
• Password Security: Passwords are hashed using bcrypt with salt
• Secure Storage: Data stored in encrypted databases
• Access Controls: Strict employee access limits with multi-factor authentication

7.2 Extension Security

• Chrome Enterprise Policies prevent unauthorized uninstallation
• Regular security audits and updates
• Code signed and verified by Chrome Web Store

7.3 Limitations

While we implement strong security measures, no internet transmission is 100% secure. You are responsible for maintaining the confidentiality of your account password.

8. Data Retention

We retain your information only as long as necessary to provide our services:

• Active Accounts: Data retained while your account is active
• Deleted Accounts: Data permanently deleted within 30 days of account deletion request
• Child Profile Deletion: Parents can delete any child profile and all associated activity data instantly. Upon deletion, all activity logs are permanently removed within 30 days.
• Inactive Profiles: Inactive profiles (no activity for 2+ years) are automatically deleted after parent notification
• Channel Request History: Retained for account management; deleted upon account deletion
• Data Export: Parents can request complete data export at any time
• Legal Requirements: Some data may be retained longer if required by law (e.g., billing records for 7 years)

9. Your Rights & Choices

9.1 Parental Rights

As a parent, you have the right to:

• Access: View all data associated with your account and child profiles
• Correct: Update or correct inaccurate information
• Delete: Request deletion of your account and all associated data
• Export: Download a copy of your data in machine-readable format
• Opt-Out: Disable optional features like AI training contributions

9.2 Communication Preferences

• You can opt-out of marketing emails (but not service-related emails)
• Configure notification preferences in your dashboard
• Unsubscribe link provided in all marketing emails

9.3 How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: support@whitelist.video
• Settings: Account settings in your parent dashboard

We will respond within 30 days of your request.

10. International Users

WhitelistVideo is based in the United States. If you access our services from outside the U.S., your information may be transferred to, stored, and processed in the U.S.

10.1 GDPR Compliance (EU Users)

For users in the European Union, we comply with GDPR:

• Legal basis for processing: Parental consent and contract performance
• Data transfers comply with standard contractual clauses
• You have additional rights under GDPR (right to erasure, data portability, etc.)

10.2 CCPA Compliance (California Users)

California residents have additional rights under CCPA. See our CCPA Notice below.

11. Third-Party Platform Services and Content Liability

WhitelistVideo filters content on third-party platforms (YouTube, etc.), but we do not control these platforms' privacy practices or content.

11.1 Third-Party Platform Privacy

• YouTube's Privacy Policy: https://policies.google.com/privacy
• Chrome Web Store Privacy: https://www.google.com/chrome/privacy/

We recommend reviewing these third-party privacy policies.

11.2 Content Provider Responsibility

WHITELISTVIDEO IS NOT A CONTENT PROVIDER. All video content accessible through our filtering service is hosted, created, and distributed by third-party platforms (e.g., YouTube/Google). We expressly disclaim any responsibility for:

• The accuracy, appropriateness, or legality of any content on third-party platforms
• Content that may bypass our filtering systems
• Changes to third-party platform content, policies, or algorithms
• Third-party platforms' compliance with child safety regulations

11.3 Liability for Third-Party Content

TO THE MAXIMUM EXTENT PERMITTED BY LAW:

• The third-party video platform (e.g., YouTube/Google) is solely responsible for all content hosted on their platform
• Any legal issues, claims, or disputes arising from video content must be directed to the content provider, not WhitelistVideo
• We bear no liability for inappropriate, harmful, or illegal content that originates from third-party platforms
• We operate our filtering service on a "best efforts" basis only and cannot guarantee complete content safety

12. Technical Dependencies and Service Availability

IMPORTANT: WhitelistVideo relies on the technical infrastructure, page architecture, and APIs of third-party video platforms to provide our content filtering services. This dependency has important implications for data processing and service availability.

12.1 Platform Dependencies

Our service depends on third-party platforms (including YouTube, Google LLC, and other video hosting services) maintaining their current technical architecture. Changes to these platforms may affect:

• Our ability to filter and analyze content metadata
• The accuracy and effectiveness of content filtering
• Real-time synchronization of approvals and blocks
• Overall service availability and performance

12.2 Data Processing During Service Disruptions

During periods when third-party platform changes affect our service:

• Content filtering may not function as expected
• Previously blocked content may become temporarily accessible
• Your configured preferences and whitelists remain stored securely on our servers
• We do not collect additional data to compensate for service disruptions

12.3 Reporting Issues

Please report any service issues immediately to support@whitelist.video. Your reports help us:

• Identify platform changes quickly
• Prioritize fixes and updates
• Communicate known issues to all users
• Restore full functionality at the earliest possible opportunity

We are committed to addressing compatibility issues as quickly as possible and will keep you informed of progress via email and in-app notifications.

13. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will notify you via email at least 30 days in advance
• We will update the "Last Updated" date at the top
• Continued use after changes constitutes acceptance

14. Contact Us

If you have questions about this Privacy Policy or our data practices:

California Privacy Rights (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA):

Right to Know

You have the right to request:

• Categories of personal information collected
• Sources from which information was collected
• Business purpose for collection
• Categories of third parties with whom we share information

Right to Delete

You can request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out

We do NOT sell personal information. We do not and will not sell your or your child's personal information to third parties.

Non-Discrimination

We will not discriminate against you for exercising your CCPA rights.

Exercise Your Rights

Email: support@whitelist.video with subject line "CCPA Request"