Privacy Policy

Effective date: May 2, 2026  ·  Last updated: May 7, 2026

AMRAX (“we”, “our”, or “us”) operates the website amrax.in and the AMRAX desktop application. This Privacy Policy describes what personal information we collect, how we use it, with whom we share it, and the rights you have over your data. By using AMRAX you agree to the practices described here.

1. Who we are

AMRAX is an AI-powered YouTube creator studio. Our contact address is contact@amrax.in. If you have any questions about this Privacy Policy or your personal data, please contact us at that address.

2. Information we collect

Google Account data

When you sign in with Google OAuth we receive your full name, primary email address, and profile photo URL. This is required to create and identify your AMRAX account.

YouTube channel data

With your explicit consent, we access your YouTube channel identity (channel ID, title, description, thumbnail), your public video library (titles, descriptions, tags, thumbnails, publish status), and read-only performance analytics (views, watch time, impressions, CTR). This data is used exclusively to power AMRAX features — we never sell it or use it to train AI models.

YouTube upload permissions

If you use the upload or scheduling feature, we request write access to upload videos to your channel on your behalf. We only publish content that you explicitly initiate inside the app.

OAuth tokens

Google issues us an access token and a refresh token so the app can act on your behalf without requiring you to re-authenticate every session. These tokens are stored in our database, which is encrypted at rest via Neon’s SOC 2 Type II certified AES-256 storage encryption. We never log or expose raw tokens.

Device signal data (anti-abuse)

At sign-up we record a one-way browser fingerprint hash, your IP address, and your HTTP user-agent string solely to detect multiple accounts created to claim free credits. This data is not used for advertising and is never sold or shared with third parties.

Usage and billing data

We log which AI features you invoke and how many credits are consumed per transaction to power your usage dashboard, enforce quotas, and audit billing disputes. Credit purchase records (amount, timestamp, payment provider reference) are also retained.

AI prompt content

When you use AI features (SEO optimisation, thumbnail analysis, chat assistant, etc.), the text prompts and any video metadata you submit are forwarded to our AI routing layer to complete your request. We do not permanently store your prompt text on our servers beyond what is necessary to fulfill that request.

3. Legal basis for processing (GDPR)

Where EU/EEA/UK data-protection law applies, we rely on the following legal bases:

  • Contract performance — processing your account data, YouTube tokens, and credits is necessary to provide the service you signed up for.
  • Legitimate interests — device signal data for anti-abuse; usage logs for quota enforcement and billing integrity.
  • Consent — accessing your YouTube channel data and upload permissions via the Google OAuth consent screen. You may withdraw consent at any time by revoking access from your Google Account Permissions page.

4. How we use your information

  • Authenticate you and maintain your login session
  • Display your YouTube channel analytics inside the AMRAX dashboard
  • Generate AI-powered SEO titles, descriptions, and tags for your videos
  • Schedule and publish videos to YouTube on your behalf
  • Analyse thumbnails and suggest improvements
  • Power the AI chat assistant for YouTube strategy advice
  • Generate suggested replies for YouTube comments
  • Detect and prevent free-credit abuse at sign-up
  • Send transactional emails (credit purchase confirmations, billing receipts)
  • Respond to your support requests

We do not use your data for advertising, sell it to third parties, or use YouTube user data to train AI models.

5. Google API scopes we request

AMRAX requests the following Google OAuth 2.0 scopes. We request only what is strictly necessary for the features described:

ScopeWhy we need it
openid profile emailIdentify who you are and create your account
…/auth/youtubeRead your channel identity and video library; update titles, descriptions, tags, and thumbnails on your behalf
…/auth/youtube.uploadUpload video files to your YouTube channel when you use the upload or scheduling feature
…/auth/yt-analytics.readonlyDisplay channel and video performance metrics in your analytics dashboard

AMRAX’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to provide or improve AMRAX features visible to the user.
  • We do not transfer Google user data to third parties except as necessary to provide the service.
  • We do not use Google user data for advertising purposes, nor allow humans to read it for that purpose.
  • We do not use Google user data to develop, train, or improve AI or ML models.

6. Data sharing and third-party processors

We share your data only with the following sub-processors, each bound by data-processing agreements:

Google LLC

Authentication and YouTube API access. Google Privacy Policy

Neon Inc.

Serverless PostgreSQL database hosting (SOC 2 Type II). Stores account records, YouTube tokens, credit balances, and usage logs.

Vercel Inc.

Application hosting, edge network, and serverless functions. All traffic is served over TLS. We also use Vercel Analytics, a cookie-free, privacy-friendly page-view counter that does not collect personal data or track individual users.

AIcredits.in

AI model routing layer (Claude, Gemini). Prompts and video metadata are forwarded to fulfill your AI requests. Refer to AIcredits’ own policy for their retention practices.

Razorpay

Payment processing for credit purchases. We never receive or store your full card number, CVV, or bank details — only a transaction reference and amount.

We do not sell your personal data. We will never share it with advertisers or data brokers.

7. Data retention

  • Account data — retained while your account is active.
  • YouTube tokens — retained while your account is active; revoked immediately if you disconnect your YouTube account or delete your AMRAX account.
  • Usage logs — retained for 12 months for billing integrity and abuse detection, then deleted.
  • Device signal data — retained for 6 months from sign-up, then deleted.
  • Billing records — retained for 7 years to meet applicable accounting and tax obligations, even after account deletion.

Upon account deletion we will remove your profile, YouTube tokens, credit balance, and associated records within 30 days, except where retention is legally required. To request deletion, email contact@amrax.in.

8. Data security

  • All data is stored on Neon (SOC 2 Type II certified PostgreSQL).
  • OAuth access tokens and refresh tokens are stored in Neon’s SOC 2 Type II certified PostgreSQL, which enforces AES-256 storage encryption at rest.
  • All connections enforce TLS 1.2 or higher.
  • We never log raw OAuth tokens or payment card data.
  • Production database access is restricted to automated application processes; no individual developer has standing production access.

Despite our efforts, no system is 100% secure. If we discover a breach affecting your data, we will notify you by email within 72 hours of becoming aware.

9. Cookies and local storage

authjs.session-token

HttpOnly session cookie to keep you logged in. Expires on sign-out or after 30 days of inactivity.

authjs.pkce.*

Short-lived PKCE code-verifier cookie used only during the OAuth login flow. Deleted after sign-in completes.

amrax_fp

Browser fingerprint hash to detect duplicate free-credit sign-ups. Not used for tracking or advertising.

We do not use advertising cookies, third-party tracking pixels, or analytics SDKs that track individual users (e.g., Google Analytics, Mixpanel). We use Vercel Analytics solely for anonymous, aggregate page-view counts — no cookies, no personal data.

10. Children’s privacy

AMRAX is intended for YouTube content creators and is not directed at children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe we have inadvertently done so, contact us at contact@amrax.in and we will delete the data promptly.

11. International data transfers

AMRAX is operated from India. Our infrastructure (Neon database, Vercel hosting) may process data in the United States and other jurisdictions. By using AMRAX you consent to this transfer. Where required by applicable law, we rely on Standard Contractual Clauses or equivalent safeguards.

12. Your rights

Depending on your location you may have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — request deletion of your personal data (“right to be forgotten”).
  • Portability — receive your data in a structured, machine-readable format.
  • Restriction — ask us to pause processing in certain circumstances.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — revoke AMRAX’s access to your Google account at any time via Google Account Permissions.

To exercise any right, email contact@amrax.in with the subject line “Data Request”. We will respond within 30 days.

13. Changes to this policy

We may update this Privacy Policy periodically. When we make material changes we will update the “Last updated” date and, where practicable, notify you by email. Continued use of AMRAX after the effective date constitutes acceptance of the revised policy.

14. Contact us & Grievance Officer

For privacy questions, data requests, or to report a concern:

AMRAX

Email: contact@amrax.in

Website: amrax.in

In accordance with the Information Technology Act, 2000 and rules made thereunder, the details of the Grievance Officer are provided below:

Grievance Officer

Name: Amit Kumar

Designation: Grievance Officer

Organization: AMRAX HEALTH CARE Pvt. Ltd.

Address: Purnea, Bihar, India

Email: contact@amrax.in

Response time: Within 30 days of receiving a complaint

© 2026 AMRAX. All rights reserved.