Gistilo — Privacy Policy

Last updated: 2026-08-12
Who we are

Gistilo ("we," "us," "our") provides an online tool that summarizes public video content and generates concise notes and insights.

Legal owner: Gistilo, British Columbia, Canada.

Contact: terms_gistilo@post.com
1) Scope

This policy explains what personal data we collect, how we use it, how long we keep it, and your rights. It applies to our website and app at Gistilo.com, our Gistilo browser extension for Chrome and Firefox, and any connected endpoints we operate.
2) Data we collect
a) Account data (you provide)

Email address and password (stored as a hash)
Name
Authentication timestamps


b) Usage & service data (automatic)

IP address, device, and browser/OS information
Session identifier (used to remember state)
Request metadata (timestamps, response codes)
Minute balance and ledger entries (grants, top‑ups, and usage)


c) Content you submit

Links or prompts you provide (e.g., public video links)
Results generated for you by the Service (e.g., summaries/notes)


d) Payments (via Stripe)

Payments are processed by Stripe. We do not collect or have access to complete payment card details (such as full card number or CVC). We may receive limited billing details (e.g., last four digits, card brand, expiry month/year) from Stripe for receipts and fraud prevention.
e) Browser extension (Chrome and Firefox)

The Gistilo extension adds a summary panel to YouTube watch pages. It is active only on youtube.com, and the only server it sends data to is Gistilo.

Stored on your device (browser extension storage; not sent to us except where stated below):

A randomly generated installation identifier, used to apply the free-tier limit before you create an account. It contains no personal information.
An access token, if you connect a Gistilo account. It is removed when you disconnect.
A short-lived copy of your plan details (tier, remaining monthly minutes, remaining fact-checks) so the panel can display them without asking our servers on every page.


Captions. When you press Summarize, the extension reads the caption track that YouTube publishes for that video and sends the caption text to Gistilo, which is what we summarize. Reading the captions in your browser rather than from our servers is what lets us summarize videos that block requests from data centres. This happens only for a video you explicitly ask us to summarize, never in the background and never for videos you merely watch. If the captions cannot be read, our servers fetch them instead and the result is the same.

Sent to Gistilo when you request a summary:

The YouTube video link, the summary type you chose, and whether you asked for a fact-check
The caption text described above, together with the caption language and the list of caption tracks the video offers
The installation identifier above, or your access token if you are signed in
Your IP address, as with any web request, used for rate limiting and abuse prevention


What the extension does not do:

It does not read, collect, or transmit your browsing history
It does not read page content other than the captions of a video you ask it to summarize
It does not read, store, or transmit your YouTube or Google account credentials, and it sends no cookies with any request it makes
It is inactive on every site other than YouTube, apart from the Gistilo page you use to connect your account
It requests no permissions beyond local storage and access to gistilo.com


We do not sell data collected by the extension, do not transfer it to third parties except the processors listed in section 11, and do not use it for advertising or for any purpose unrelated to producing your summaries.

Caption text is used to generate your summary and may be cached so the same video does not have to be processed twice. Summaries you generate while signed in are saved to your account history. Both are covered by the retention and deletion terms in sections 5 and 6. Uninstalling the extension removes the locally stored items above; to delete account data, use the account deletion options described in section 6.
3) Why we process data (purposes & legal bases)

Provide the Service (accounts, summaries/notes, usage tracking) — contract / legitimate interests
Payments & billing — contract / legal obligations
Security & abuse prevention (basic logging and anomaly detection) — legitimate interests
Support & troubleshooting — legitimate interests
Product analytics (aggregate, non‑advertising) — legitimate interests / consent where required


4) Cookies & similar tech

Essential: session ID, CSRF, and settings needed for the app to function.
Optional analytics (if enabled): we will disclose provider and provide an opt‑out.


We do not use third‑party advertising cookies.
5) Retention

Account & billing records: while your account is active and as long as required by tax/financial laws.
Minute ledger: retained for the current and prior billing cycles and as needed for audits.


6) Your rights

Depending on your location, you may have rights to access, correct, delete, or export your data, and object to/limit certain processing. To exercise rights, email terms_gistilo@post.com from the address associated with your account. We may verify your identity before acting.

EU/EEA/UK: GDPR rights (access, rectification, erasure, restriction, portability, objection).
California: CCPA/CPRA rights (know, delete, correct, opt‑out of "sale/share"). We do not sell personal information.


7) Security

We use reasonable safeguards: HTTPS in transit, hashed passwords, role‑limited access, and Stripe for payments. No method is 100% secure; report issues to terms_gistilo@post.com.
8) Children

The Service is not directed to children under 13 (or the age required in your country). Do not use the Service if you are under that age.
9) Third‑party platforms

We may interact with third‑party platforms to fetch publicly available information that helps provide the Service (e.g., retrieving basic video metadata). Your use of those platforms remains subject to their terms and privacy policies. We do not connect to or access your personal accounts on those platforms.
10) International transfers

We may process data in Canada, the United States, or other countries where our providers operate. When transferring personal data, we use appropriate safeguards (e.g., contractual clauses).
11) Processors

Key providers include payment processors (e.g., Stripe) and hosting/infrastructure vendors. They process data on our behalf under appropriate agreements.
12) Changes to this policy

We may update this policy at any time without prior notice (unless notice is required by law). We will post the updated policy with a new "Last updated" date; continued use after the effective date means you accept the changes.
13) Contact

Email: terms_gistilo@post.com