Privacy Policy

1. Controller

The controller of TopAIMuza.pl is Łukasz Król, KROL-TECH. Contact: kontakt@topaimuza.pl. Full business details: kroltech.eu/kontakt/#dane-firmy.

2. What data we process

• Public artist data: names, descriptions, releases and statistics fetched automatically from YouTube (official API, section 3) and from Spotify and Deezer (their APIs and public artist pages). Our back-end fetches them without signing in and without cookies — not your browser. This is publicly available data; we do not collect it from visitors. It serves the catalogue and the ranking (Art. 6(1)(f) GDPR).
• Creator panel: an e-mail address for one-time sign-in links and the profile data a creator enters. If a creator signs in with Google, we request only the openid email scope (a stable account ID and the verified e-mail address). We never request access to Gmail, Google Drive or YouTube channel management.

3. YouTube data (YouTube API Services)

TopAIMuza.pl uses YouTube API Services (YouTube Data API v3). By using the features based on YouTube data (profiles, ranking, track pages, view charts, player) you agree to the YouTube Terms of Service. Data processed by Google is subject to the Google Privacy Policy.

• What we fetch: only public data of channels and videos listed in the catalogue: channel ID, name, description, thumbnail, subscriber, view and video counts; for videos: ID, title, description, publish date, duration, embeddable status and view, like and comment counts. We use an API key without signing in to YouTube, so we have no access to private channel data or to data about our visitors.
• What we do not do: we do not collect data about TopAIMuza.pl users through the YouTube API, we do not ask for access to anyone's YouTube account, and we do not sell or share YouTube data with third parties.
• How we use it: to show profiles and tracks, for the ranking and the “Views over time” charts. The ranking and indicators are our own calculations based on YouTube measurements, not data published by YouTube; see the methodology.
• Refresh and retention: descriptive data (names, titles, descriptions, thumbnails) is refreshed by our automated API reads, usually daily; channel-description information is valid for 30 days and is not shown as current without a new read. Statistics (views, likes, comments, subscribers) are stored with their measurement date as the history needed for the ranking and charts, for no longer than 36 months from the measurement. When a video or channel is no longer publicly available, we stop showing it as soon as the next check detects it.
• Deletion and revoking access: a channel owner can ask at any time for their profile and the data fetched from YouTube to be deleted, by writing to kontakt@topaimuza.pl or via the contact page. We take the profile down and delete that channel's YouTube data from our database within 7 days of confirming that the request comes from the channel owner. If you sign in to the creator panel with Google, you can revoke our app's access to your Google account in the Google security settings.
• YouTube player: videos play in the embedded YouTube player in privacy-enhanced mode (youtube-nocookie.com). The player loads only after you click “play”; from then on YouTube processes data under its own terms (YouTube Terms of Service and Google Privacy Policy).

4. TikTok connection (creator panel)

A creator who has claimed their profile may voluntarily connect a TikTok account through the official TikTok for Developers services (Login Kit and Display API, scopes user.info.basic, user.info.profile, user.info.stats). Tokens are stored encrypted and used only to refresh the counts; “Disconnect TikTok” revokes access and deletes the tokens, counts and history at once.

5. Google Analytics, advertising and cookies

Only after your consent do we load Google Analytics 4 (Google Ireland Limited), which may store _ga cookies. Before you choose “I agree to statistics” the script is not downloaded. Third-party vendors, including Google, may use cookies to serve ads based on previous visits; you can turn off personalised ads in Google Ads Settings and read how Google uses information from partner sites. You can change your choice at any time with “Cookie settings” in the footer.

6. First-party visit counter

Independently of Google Analytics, the website sends a minimal page-view signal to its own counter. The browser keeps a random identifier for the day (kt_fp_*); on the server we keep only a keyed hash (HMAC), deleted after 35 days. We do not store raw IP addresses, user agents or form content. Legal basis: Art. 6(1)(f) GDPR.

7. AI assistants (MCP)

The read-only MCP server at https://topaimuza.pl/mcp returns only data that is already public on the website. The assistant's query is processed in memory and not stored; no accounts, cookies or profiling. See AI assistants.

8. Your rights (GDPR)

You have the right to access, rectify, erase and port your data, to restrict processing and to object (Art. 21 GDPR) to processing based on our legitimate interest. You can withdraw consent to Google Analytics at any time and lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych). Requests: kontakt@topaimuza.pl.