Last updated: 1 October 2026
This policy explains what data IOSA processes, why, and how you can ask us to stop. It covers the creators whose public metrics we measure and the people who order an optional commemorative item.
IOSA, the Institute for Open Social Analytics, is an independent research project studying how long-form YouTube videos first observed in the Most Popular charts perform relative to each channel’s own baseline. The project has no profit purpose: optional commemorative items fund servers, API quota and development.
Data controller: IOSA — Institute for Open Social Analytics, an
independent research project based in Italy. The project is run by a private individual and has
no commercial premises; the name and postal address of the person responsible are provided on
request to the addresses below, and to any supervisory authority that asks for them.
General contact: iosa.research.lab@gmail.com
Data requests and opt-out: iosa.research.lab@gmail.com
Our systems read publicly available metrics through the official YouTube Data API v3. We never scrape pages, never log into accounts, and never access anything that is not public. For each measured video we store:
We do not collect email addresses, contact details, private messages, demographic data, watch history or any non-public information about creators. We do not buy, sell, license or share this data with data brokers or advertisers.
Some of this information can identify a person, so under the GDPR it is personal data even though it is public. We process it for statistical and research purposes on the basis of our legitimate interest in publishing an open measurement of public content performance (Art. 6(1)(f) GDPR), with the safeguards for research set out in Art. 89 GDPR. We assessed that this processing is limited to data creators have already made public, produces aggregate research output, and does not profile individuals or target them with advertising.
Because we receive the data from the platforms rather than from the creator, Art. 14(5)(b) GDPR applies: informing every creator individually would require disproportionate effort, so we publish this notice instead and keep the opt-out address below permanently available.
Records do not expire. A measured video stays in the index, while it is in the Most Popular charts and after it leaves them, because the index is a research series and must stay complete. On request a record is hidden from public pages (section 5); it is not deleted. Aggregated statistics that cannot identify a single video or channel may be kept indefinitely.
You can ask us to remove your records from the index at any time, with no justification required. Write to iosa.research.lab@gmail.com from any address, naming the channel or the videos. The records are then hidden from public pages: they no longer appear on any page of the site or in our public API, and their analysis links stop resolving. They are not deleted, because the index is a research series that must stay complete (Art. 89 GDPR). You also have the right of access, rectification, restriction, portability and objection, and the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la protezione dei dati personali).
If you order a commemorative item we process your name, email address and shipping address, on the basis of the contract between us (Art. 6(1)(b) GDPR), for the sole purpose of producing and delivering that item. Payment card details never reach our servers: they are handled entirely by Stripe. Order and billing records are kept for the period required by Italian accounting and tax law, currently ten years.
| Provider | What it does |
|---|---|
| Supabase | Database hosting for the measurement index |
| Vercel | Website hosting and cookieless aggregate audience measurement |
| Stripe | Payment processing for optional orders |
| Printify and its print providers | Production and shipping of ordered items |
Some of these operate outside the European Economic Area. Transfers rely on the European Commission’s standard contractual clauses or on an adequacy decision, as published by each provider.
The site sets no advertising, profiling or tracking cookies, and shows no consent banner because none is required. Audience measurement uses Vercel Analytics, which counts page views in aggregate without cookies and without building a profile of the visitor.
Data is stored on managed infrastructure with access restricted to the project maintainer. The public index is served read-only: visitors cannot modify any record.
The site is not directed at children, has no accounts and no sign-up, and we do not knowingly process data provided by anyone under 16.
If this policy changes we update the date at the top of this page.