Who is responsible
This notice covers the Vidroles website and beta platform, operated by Overluce GbR, represented by Maximilian Behrens and Dimitrios Chatziaivazoglou. Contact hello@overluce.com for privacy requests. The public contact addresses are listed in the legal notice.
Information the platform handles
Account information includes your email, authentication identifiers, confirmation status and security/session information. Google sign-in supplies basic identity information such as your name, email and profile picture. Password-based authentication is handled by our authentication provider; support never needs your password.
You supply profile details, roles, skills, availability, links, photos, cover images and portfolio contributions. Hiring accounts add company and channel details, jobs and application review information. Applications preserve the submitted profile, selected work and job terms. Conversations, replies, reactions, read states, notifications, verification decisions and preferences also form part of your account activity.
The service and its providers process technical information needed to deliver and protect the platform, including IP addresses, request and security logs, device/browser information and essential storage. Public video and channel metadata comes from YouTube when imported.
Purposes and proposed legal bases
The proposed basis for account access, profiles, applications, chat and requested imports is providing the service you request. Security, abuse prevention and necessary operational diagnostics rely on a legitimate-interest assessment; legally required records rely on the relevant legal obligation.
Optional email summaries and separately authorized Google/YouTube access are controlled by your choices. Withdrawing an optional permission does not invalidate earlier lawful processing. The operator must confirm these bases and any necessary assessments before this draft takes effect.
Who can see your information
Draft profiles and unsubmitted work are private to their owner. Published profiles and jobs are discoverable by eligible signed-in members. Up to three ranked homepage cards can publicly show a published name, role, portrait, portfolio count and selected collaboration credit.
An application and its submitted snapshot are available to the relevant hiring team. Conversations are limited to their participants, and team notes remain team-scoped. Unpublishing or withdrawing does not automatically delete submitted records or messages already shared.
Authorized operators and service providers may access information when needed to operate the platform, investigate an issue, handle a request or meet a legal obligation. The platform does not sell personal data or run advertising or analytics tracking integrations.
Service providers and international processing
Vercel hosts the application. Supabase provides authentication, the database, private file storage and realtime updates. Resend delivers account emails and optional notification summaries. Google provides optional sign-in, YouTube API Services, thumbnails and video playback.
The configured application/database region is Frankfurt and email delivery is configured in Ireland. Those region selections do not establish that all processing remains in the EEA. Provider entities, subprocessors, support access and any applicable transfer safeguards must be documented by the operator before this notice is finalized.
Google and YouTube choices
Vidroles uses YouTube API Services. Public imports retrieve video titles, channel identities, images, view counts and similar public metadata. The separate read-only channel authorization retrieves channels you control so you can import channel details or review work confirmations. It does not grant Vidroles permission to post or edit videos.
Provider access tokens are used for the immediate server-side import and are not retained in the application session; offline access is not requested. Imported channel records and confirmation history remain stored. Disconnecting in Vidroles revokes associated work confirmations, but is not the same as deleting all stored data or revoking Google-side permission.
You can revoke Google access through your Google account and request removal of imported data through the privacy contact. YouTube players load after you choose to play; thumbnails can load from Google before playback. Google’s own policies apply to its services.
Retention and deletion
Account content is currently retained while stored in the beta. Unpublishing, withdrawing an application, deleting a message from view or disconnecting a channel may leave related snapshots, audit history or shared records. File cleanup, account export and complete account deletion are not automated self-service features.
Before this notice takes effect, the operator must approve category-specific retention limits, a working manual export/deletion process, backup treatment and the required refresh/deletion lifecycle for YouTube API data. This draft does not claim an implemented deletion deadline or indefinite retention right.
Your rights and requests
Depending on the law that applies to you, you may request access, correction, erasure, restriction or portability, object to certain processing and withdraw consent. Some requests have lawful exceptions, particularly where records are needed for another person’s rights or legal obligations.
Send privacy requests to hello@overluce.com. We may need proportionate information to verify the request. You may also complain to the appropriate data protection authority. Hiring decisions are made by hiring teams; Vidroles does not make automated employment decisions about applicants.
Updates to this notice
Material changes to data handling must be reflected here and communicated where required before the new use begins. The publication date and an effective version will be provided when the operator completes review.