Privacy Policy

Last updated: 20 July 2026

IMAHub is a tool for influencer-marketing agencies to discover, score, and track YouTube creators through to a signed deal, and to manage the brands that sponsor them (including finding a brand's business contact and running outreach). This policy covers the IMAHub web application (at imahub.co) and the “Add to IMAHub” browser extension. In this policy, “we” and “IMAHub” refer to the operator of the service; “you” refers to the account holder. See also our Terms of Service.

Information we collect

• Account: your email address (used to sign in and to contact you).
• Your API keys: the YouTube Data API key, and optionally an Anthropic API key and an Instantly API key, that you choose to provide. These are encrypted at rest and used only to make requests on your behalf.
• Gmail data (only if you connect it): if you connect a Google account for the optional email-sync feature, IMAHub requests read-only Gmail access (gmail.readonly). We read message metadata and content only to match your sent/received emails to the creators in your pipeline, so your outreach status stays up to date. See “Google user data” below.
• Creator & pipeline data: public YouTube channel data (name, subscriber count, recent-video metrics, and a public contact email if the channel lists one) for creators you add, plus the rates, tags, notes, and follow-ups you enter.
• Brand & contact data: the brands you add or import, and business contact details associated with them (contact name, job title, email) — whether you enter them, import them, or obtain them through the contact-finder, which returns business contact data from Instantly's data service. You are responsible for having a lawful basis to collect and use this data (see “Outreach & contact data” below and our Terms).
• Outreach activity: if you push creators or brands into an Instantly campaign, we store which campaign they were added to and outreach status (e.g. contacted / replied), and sync send/reply events from Instantly to keep your pipeline up to date. This sync also stores the content of those outreach emails (subject and body text) against the relevant creator, so the app can show the conversation and generate an optional AI summary of it.
• Billing: if you subscribe, payments are handled by Stripe. We store your Stripe customer ID and subscription status; we never see or store your card details — those go directly to Stripe.
• Browser extension: the extension stores a single IMAHub connection token in your browser's local extension storage, and — only when you click “Add” or “Metrics” on a YouTube page — sends that page's URL to IMAHub so the channel can be looked up. It does not track your browsing, inject ads, or collect analytics.

How we use your information

We use the above solely to operate IMAHub for you: discovering creators, scoring rates (CPM), managing your creator pipeline and brands, finding brand contacts, running and tracking outreach, generating optional AI drafts and brand classifications, and processing your subscription. We do not use your data for advertising, and we do not sell it.

Google user data & Limited Use

IMAHub's use and transfer of information received from Google APIs — the YouTube Data API and, if you connect it, the Gmail API — adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Gmail data is used only to provide the email-sync feature within the app; it is never sold, never used for advertising, and is not read by humans except where necessary to support you at your request, for security, or where required by law.

AI processing

When you generate an AI outreach draft, the creator's public information is sent to the configured AI provider — Google (Gemini), Groq, and/or Anthropic — to produce the draft. The same applies when you classify a detected brand (the brand name and website are sent). When you request an AI “catch me up” summary of a conversation, the stored Instantly email content for that lead is sent to the AI provider (Groq, or Anthropic) to produce the summary; the provider does not use it to train models. Your Gmail content is notsent to AI providers.

Outreach & contact data

When you collect, import, or find business contact details and use them to run outreach, you act as the data controller for that personal data and are responsible for having a lawful basis and for complying with applicable law (including UK GDPR, GDPR, PECR, and CAN-SPAM). IMAHub provides the tooling and acts on your instructions. Business contacts surfaced by the contact-finder come from Instantly's data service and may be inaccurate; verify before use. See section 6 of our Terms.

Sharing & service providers

We do not sell your data. We share it only with the infrastructure providers needed to run the service: Supabase (database & authentication), Vercel (hosting), Stripe (payments), Instantly (outreach campaigns and business-contact lookup, using your key), and Anthropic / Google (AI drafts & classification, and the YouTube & Gmail APIs). Each processes data only to provide its part of the service.

Security

Your API keys are encrypted at rest, and your data is isolated per account by row-level access controls so other users cannot see it.

Your controls & retention

You can revoke extension tokens in IMAHub → Settings → Browser Extension, disconnect Gmail at any time (which stops all Gmail access), delete creators from your pipeline, and request full account deletion by contacting us. We retain your data for as long as your account is active or as needed to provide the service.

Contact

Questions about this policy or a data request: support@imahub.co.