Privacy policy

1. Controller and contact

Glactro Dashboard is the controller of your personal data. For questions, requests and deletion requests regarding this policy: contact@glactro.com. You can also write to us from the Support section of your panel.

2. What data we process

• Identity and contact: full name / company name, e-mail address, phone number, panel language preference.
• Identity verification documents: the ID card or passport image you upload; if the payout account belongs to someone else, the ID document of the account / wallet holder.
• Payout details: account holder name, IBAN / account number, bank name, SWIFT/BIC, bank address, or crypto wallet address, network and currency; invoices you upload and payout records.
• Contract data: contracts, signed copies, contract requests and channel add / leave requests.
• Channel and revenue data: channel name and ID, YouTube's public channel statistics (subscribers, videos, views, channel photo), monthly earnings statements and payout calculations; if you connect your channel, YouTube Analytics reports (detailed below).
• Support correspondence: your support tickets, messages and attached files.
• Security and usage logs: sign-in and action times, IP address, approximate country / city derived from the IP, a summary of browser and device type (e.g. "Chrome · Windows · Desktop"), before and after values of changes you make (account numbers masked), two-step verification status, failed sign-in attempts.

Your password is stored only as an irreversible hash; nobody, including us, can see it.

3. Purposes of processing

• Concluding and performing our agreement with you; calculating your monthly earnings, preparing statements and making payouts.
• Verifying your identity and the payout account holder; preventing fraud and payouts to the wrong account.
• Keeping your account secure: preventing unauthorized access, verifying sign-ins from previously unseen countries with an e-mailed code, new-device alerts, lockouts after failed attempts, blocking bots and automated attacks.
• Sending service e-mails (statement ready, payout sent, contracts, security alerts). You can turn off non-security notifications in the panel.
• Answering support requests; meeting legal obligations (tax, accounting, commercial records).

4. Legal bases

We process your data under Art. 5/2 KVKK and Art. 6 GDPR on these bases: conclusion and performance of a contract (contact, payout, channel and revenue data); legal obligation (keeping invoice and payment records for the statutory period); legitimate interest (account and system security, activity logs, preventing misuse); explicit consent (optional processing such as channel connection and services that require transfers abroad). You may withdraw consent at any time; this does not affect processing before withdrawal.

5. YouTube and Google data

Connecting a channel is optional. When you authorize it with "Connect to Glactro Dashboard", the following data is retrieved through Google API Services with read-only permissions: channel ID and name; YouTube Analytics reports (estimated revenue, ad and YouTube Premium revenue, US revenue, views, watch time, subscriber change, country, device, age/gender breakdown, traffic source, top videos). Your videos, settings and YouTube payments are not accessed; nothing is changed, deleted or published.

Public channel information (name, photo, subscriber / video / view counts) is retrieved with the YouTube Data API v3. Analytics are shown only from the date the channel joined the Glactro Dashboard network.

This data is shown only to you and the Glactro Dashboard administrator to track earnings and calculate payouts under your agreement; it is not sold, not used for advertising, not shared with other users and not used to train AI models. Glactro Dashboard's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Use of YouTube data is subject to the YouTube Terms of Service and the Google Privacy Policy.

You can revoke access at any time in the panel ("Remove connection") or on the Google Account permissions page; no new data is retrieved afterwards. You can ask us to delete stored YouTube data; we will do so within 30 days at the latest.

6. Approximate location and bot protection for security

Approximate location: sign-in and activity logs include an approximate country and city derived from your IP address. For this, the IP address is sent to ipwho.is (ipapi.co as a fallback); the result is cached for 30 days. It is used only to keep your account secure (e-mail verification for sign-ins from unusual countries, admin access restriction, activity log) and does not reveal your exact address. Maps on the administrator's screen are drawn with OpenStreetMap.

reCAPTCHA: sign-in, first sign-in and password reset forms may be protected by Google reCAPTCHA v3. reCAPTCHA collects information from your device and browser (e.g. IP address, browser information, interactions on the page) and sends it to Google to tell humans from bots. This is subject to the Google Privacy Policy and Google Terms of Service.

7. Who we share data with

We do not sell your data. It is shared only as needed to provide the service with:

• Hosting and e-mail providers: the servers running the site and database and sending e-mails.
• Google LLC: YouTube Data API / YouTube Analytics (channel data), reCAPTCHA (if enabled), Google Fonts.
• Location services: ipwho.is and ipapi.co (IP address only).
• Banks, payment and crypto service providers: the payout details needed to pay you.
• Competent authorities: where required by law.

8. International transfers

Google, ipwho.is and ipapi.co may operate on servers outside Türkiye. These transfers rely on the notice you accepted in the panel and your explicit consent under Art. 9 KVKK and the GDPR, the providers' standard contractual terms and appropriate safeguards. You can use the core of the service without connecting a channel or reCAPTCHA.

9. Retention periods

• Account, contract and payout data: for the term of the agreement and afterwards for statutory limitation and tax / commercial record retention periods (generally 10 years in Türkiye).
• Identity documents: for the term of the agreement and the statutory periods after it ends; deleted when the period expires.
• YouTube Analytics data: while the connection is active; after you remove it, no new data is retrieved and stored data can be deleted on request.
• Security logs (sign-in, IP, device): for a reasonable period for security and evidence (generally up to 2 years).
• Backups: encrypted on the server; by default the last 8 weekly backups are kept and older ones are deleted automatically.

10. Security measures

Connections are encrypted with HTTPS. Passwords are stored as one-way hashes; Google access grants and API keys are encrypted with AES-256-GCM. We use two-step verification, new-device and unusual-country alerts, lockouts after failed attempts, cross-site request protection, strict browser security headers (Content-Security-Policy), access restriction for the admin panel and AES-256 encrypted backups. Administrator actions are recorded in an activity log.

11. Cookies and browser storage

No advertising or tracking cookies are used. Only strictly necessary and preference cookies:

• glx_sid — session (ends when the browser closes).
• glxdv — recognized device (for new-device alerts, up to 400 days).
• glx_ctd — "Remember this device for 30 days" (two-step verification).
• glx_pl — language preference.
• Browser storage (localStorage): language, theme (light / dark / automatic), sign-in e-mail and similar display preferences.

If reCAPTCHA is enabled, Google may use its own cookies.

12. Your rights

Under Art. 11 KVKK and the GDPR you have the right to learn whether your data is processed, to request information, to learn the purpose of processing and the recipients, to request correction of incomplete or inaccurate data, erasure or destruction, restriction of processing, to object, to receive your data in a portable format and to claim compensation for damages. Send your request to contact@glactro.com or through Support in the panel; we reply within 30 days at the latest. You also have the right to complain to the Turkish Personal Data Protection Board (or your local supervisory authority in the EU).

13. Minors

The panel is not intended for people under 18. For channel owners who are minors, the agreement and panel use are handled by their legal representatives.

14. Changes

We may update this policy; the date above shows the latest version. We announce significant changes in the panel or by e-mail.