Last updated: 19 September 2026
This policy explains what data IOSA processes, why, and how you can ask us to stop. It covers the creators whose public metrics we measure and the people who order an optional commemorative item.
IOSA, the Institute for Open Social Analytics, is an independent research project studying how short-form video performs relative to each channel’s own historical baseline. The project has no profit purpose: optional commemorative items fund servers, API quota and development.
Data controller: IOSA — Institute for Open Social Analytics, an
independent research project based in Italy. The project is run by a private individual and has
no commercial premises; the name and postal address of the person responsible are provided on
request to the addresses below, and to any supervisory authority that asks for them.
General contact: iosa.research.lab@gmail.com
Data requests and opt-out: iosa.research.lab@gmail.com
Our systems read publicly available metrics through the official YouTube Data API v3 and the TikTok Research API. We never scrape pages, never log into accounts, and never access anything that is not public. For each measured video we store:
We do not collect email addresses, contact details, private messages, demographic data, watch history or any non-public information about creators. We do not buy, sell, license or share this data with data brokers or advertisers.
Some of this information can identify a person, so under the GDPR it is personal data even though it is public. We process it for statistical and research purposes on the basis of our legitimate interest in publishing an open measurement of public content performance (Art. 6(1)(f) GDPR), with the safeguards for research set out in Art. 89 GDPR. We assessed that this processing is limited to data creators have already made public, produces aggregate research output, and does not profile individuals or target them with advertising.
Because we receive the data from the platforms rather than from the creator, Art. 14(5)(b) GDPR applies: informing every creator individually would require disproportionate effort, so we publish this notice instead and keep the opt-out address below permanently available.
A measured video stays visible in the public index for 15 days from the moment we detect it. After that it is marked as expired and is no longer shown. Expired records are kept in the database for research continuity and are deleted on request. Aggregated statistics that cannot identify a single video or channel may be kept indefinitely.
You can ask us to stop processing your data or to delete your records at any time, with no justification required. Write to iosa.research.lab@gmail.com from any address, naming the channel. We remove the records and exclude the channel from future scans. You also have the right of access, rectification, restriction, portability and objection, and the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la protezione dei dati personali).
If you order a commemorative item we process your name, email address and shipping address, on the basis of the contract between us (Art. 6(1)(b) GDPR), for the sole purpose of producing and delivering that item. Payment card details never reach our servers: they are handled entirely by Stripe. Order and billing records are kept for the period required by Italian accounting and tax law, currently ten years.
| Provider | What it does |
|---|---|
| Supabase | Database hosting for the measurement index |
| Vercel | Website hosting and cookieless aggregate audience measurement |
| Stripe | Payment processing for optional orders |
| Printify and its print providers | Production and shipping of ordered items |
Some of these operate outside the European Economic Area. Transfers rely on the European Commission’s standard contractual clauses or on an adequacy decision, as published by each provider.
The site sets no advertising, profiling or tracking cookies, and shows no consent banner because none is required. Audience measurement uses Vercel Analytics, which counts page views in aggregate without cookies and without building a profile of the visitor.
Data is stored on managed infrastructure with access restricted to the project maintainer. The public index is served read-only: visitors cannot modify any record.
The site is not directed at children, has no accounts and no sign-up, and we do not knowingly process data provided by anyone under 16.
If this policy changes we update the date at the top of this page.