Flowal - YouTube/Google Data Addendum - Income Protection

1. Purpose Limitation

We use YouTube/Google data only to provide income protection features that are visible and prominent in the product (eligibility, pricing, covered income calculation, claims processing, and fraud prevention). We do not sell YouTube/Google user data.

2. Minimum access / scopes

We request the minimum scopes required for the above purpose and use incremental authorization where possible. Google requires minimum relevant permissions and clear disclosures.

3. Limited Use and human access restrictions

We comply with Google’s Limited Use requirements: use is limited to user-facing features; transfers are restricted; and humans do not access the data by default except for support with explicit permission, security investigations, or legal obligations.

4. Revocation and Deletion

Users/admins can revoke access via: https://security.google.com/settings/security/permissions
After revocation, we delete YouTube API data associated with that consent within required timelines.

5. Retention / refresh

Where YouTube policies require it, we refresh/delete stored data and reconfirm authorization at least every 30 days (and keep stored data consistent with current YouTube data).

6. Subprocessors

Hosting: Vercel; Database: Supabase; Integrations/token vault: Nango; Analytics/logging: PostHog; Email: Resend.