Your data, clearly explained

Privacy notice

Last updated: 7 October 2026

Momentum Studio, operated by Josh Llewellyn-Jones as a sole trader, is the controller of personal data processed through Momentum OS. This notice explains what we collect, why we use it and the choices you have.

Information we collect

• Account details such as your name, email address, member type and referral information.
• Free-scan details such as your email address, chosen platform, stated goal, acquisition source and whether you separately opted into marketing.
• Read-only social account details and performance analytics that you authorise Instagram or YouTube to share, including profile identifiers, posts or videos and related reach, viewing and engagement metrics.
• Encrypted platform access tokens used to refresh your authorised analytics connection.
• Plans, recommendations, feedback and product-usage events created while you use Momentum.
• Subscription and payment status supplied by Stripe. Momentum does not store full card details.

How we use information

We use this information to provide and secure your free scan or account, analyse content performance, generate personalised recommendations, maintain your connections, process subscriptions, support referrals, secure the service and improve Momentum. We do not use a connected account to publish, edit or delete your content.

Google and YouTube user data

If you choose to connect YouTube, Momentum requests read-only access to your YouTube channel and YouTube Analytics. We access your channel identifier and title; video identifiers, titles, publication dates and durations; and available performance data such as views, watch time, average view duration, average percentage viewed, thumbnail impressions and click-through rate, likes, comments, shares and subscribers gained. We also store the encrypted OAuth access and refresh tokens required to maintain the connection. Momentum does not request permission to create, edit or delete YouTube content.

We use this Google user data only to provide the user-facing features you request: your 90-day performance analysis, platform-specific recommendations, content plan and subsequent measurement. We do not use Google user data for advertising, retargeting, determining creditworthiness, selling data, building data-broker profiles, or developing, improving or training general-purpose or non-personalised AI or machine-learning models.

To provide these features, the minimum necessary Google user data may be processed by Netlify, which runs Momentum's secure server functions; Supabase, which provides Momentum's database; and OpenAI, which processes a limited strategy context to generate the personalised recommendations shown inside your Momentum workspace. OpenAI receives selected video titles, aggregated performance signals and the account context you provide; it does not receive your Google access or refresh token. These service providers may process the data only on Momentum's behalf to operate or secure the requested service. OpenAI states that API data is not used to train its models unless the API customer explicitly opts in; Momentum has not opted in. We do not transfer or disclose Google user data to any other third party except with your consent, where necessary for security, or where required by law, and we do not sell Google user data.

Momentum's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Marketing messages

We only send promotional email to a free-scan visitor when they make a separate, optional choice to receive it. Declining marketing does not prevent access to the scan. We keep a record of the wording, source and time of that choice. Every marketing email will identify Momentum and provide a simple way to unsubscribe. You can withdraw consent at any time by using that link or contacting us.

Our legal bases

We process data where it is needed to provide the service you request or perform our contract with you, where we have a legitimate interest in operating and improving a secure product, where the law requires it, or where you have given consent. You can withdraw consent for a platform connection by disconnecting it at any time.

Who receives information

We use trusted service providers to operate Momentum, including Netlify for hosting and secure server functions, Supabase for authentication and database services, OpenAI for generating the personalised strategy displayed to you, Stripe for billing, Resend for service email, and the relevant Meta, Instagram, Google, YouTube and TikTok services when you choose to connect them. They receive only the information reasonably necessary to perform their role for Momentum and may not use it for unrelated purposes. We do not sell personal information.

Storage, security and international transfers

Platform access and refresh tokens are encrypted before storage, data is encrypted in transit using HTTPS, and connected platform access is read-only. We use access controls, secret-managed server functions and other proportionate safeguards to protect data against unauthorised access, alteration, loss or disclosure. Some providers may process information outside the United Kingdom. Where required, transfers are protected using recognised safeguards such as adequacy regulations or standard contractual clauses.

How long we keep information

We keep account and analytics information while your account is active and for a reasonable period afterwards where needed to provide support, resolve disputes or meet legal obligations. Google access and refresh tokens are removed when the YouTube connection or Momentum account is deleted. You may also revoke Momentum's Google access at any time through your Google Account permissions. OpenAI may retain API abuse-monitoring logs for up to 30 days under its standard API data controls; it does not retain Momentum strategy requests as application state. Payment and transaction records may be retained for up to six years where UK tax or accounting rules require it.

Your choices and rights

You can disconnect a social account through its platform settings and ask us to access, correct, export or delete your personal data. You may also object to or restrict certain processing and complain to the UK Information Commissioner's Office. To make a request, email joshllew24@gmail.com. We may need to verify your identity before completing it.

Cookies and local storage

Momentum uses essential session technology and browser storage to keep you signed in, preserve your setup and operate the product. We do not currently use third-party advertising cookies inside Momentum OS.

Children

Momentum OS is intended for adults and is not designed for children under 18. Please do not use the service if you are under 18.

Changes to this notice

We may update this notice as Momentum develops. The current version and its effective date will remain available on this page.