Privacy policy

MCN Desk (“MCN Desk”, “we”, “us”) operates the software service available at https://mcndesk.com. MCN Desk is an operating platform for multi-channel managers, creator networks, talent agencies, labels and publishers who manage multiple monetised YouTube channels on behalf of themselves or of creators they represent.

This policy explains what information we collect, why we collect it, how it is stored and shared, and how you can review, export or delete it. For any privacy question or request, contact us at privacy@mcndesk.com.

• Account information — your name, email address and the password hash or Google sign-in identifier used to authenticate you.
• Workspace information — your organisation name, timezone, display currency, fiscal year setting and the revenue-share percentages you configure per channel.
• Team information — email addresses and role assignments of the people you invite to your workspace.
• Creator records you enter — creator contact details, payment references, invoice numbers, notes and any banking details you choose to record for payout administration. This information is entered by you, not retrieved from Google.

When you choose to connect a YouTube channel, Google asks you to approve read-only access. We request the narrowest scopes that allow the product to function:

• https://www.googleapis.com/auth/youtube.readonly — to read the identity of the channels you manage (channel ID, title, handle, thumbnail) and the metadata and public statistics of their videos, so channels and videos can be listed in your dashboard.
• https://www.googleapis.com/auth/yt-analytics.readonly — to read aggregated performance metrics such as views, watch time, subscribers and impressions, so performance can be charted and reported.
• https://www.googleapis.com/auth/yt-analytics-monetary.readonly — to read estimated revenue, RPM and CPM figures, which are the basis of the revenue, reconciliation and creator-payout features that are the core purpose of the service.
• https://www.googleapis.com/auth/adsense.readonly — to read AdSense account and payment records so finalised payments can be reconciled against estimated YouTube revenue.
• openid, userinfo.email, userinfo.profile — to identify the Google account that authorised the connection and to attach that connection to the correct workspace.

We never request permission to upload, edit, publish, monetise, comment on or delete any content, and we never make changes to any YouTube channel or AdSense account.

MCN Desk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In concrete terms this means that data obtained through Google APIs is:

• used only to provide and improve the user-facing features described in this policy;
• never sold, rented or licensed to anyone;
• never transferred to advertising platforms, data brokers or information resellers;
• never used for advertising, retargeting or audience building;
• never used to develop, train, retrain or improve generalised artificial intelligence or machine learning models; and
• never read by a human being except with your explicit consent, where required for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised for internal operations.

MCN Desk uses YouTube API Services. By connecting a channel you also agree to the YouTube Terms of Service. Google’s own handling of your information is described in the Google Privacy Policy. You may revoke MCN Desk’s access to your Google data at any time through the Google security settings page at https://myaccount.google.com/permissions.

• Displaying consolidated channel, revenue, audience and video dashboards for the channels you manage.
• Calculating the agreed creator and management share of revenue and producing the monthly payout workspace used to record amounts owed, payment status, invoice references and notes.
• Reconciling estimated YouTube revenue against finalised AdSense payments.
• Generating the Excel, CSV and printable reports you request.
• Running the scheduled daily refresh that keeps your figures current.
• Authenticating users, enforcing role permissions and maintaining an audit history of sensitive actions.
• Operating the service securely, diagnosing faults and preventing abuse.

Revenue-share and payout figures are our internal calculations based on the percentages you configure. They are clearly distinguished in the product from figures reported by Google.

• Channel identity: YouTube channel ID, title, handle, thumbnail URL and country.
• Daily and monthly aggregated metrics, video metadata and video-level performance.
• AdSense account identifiers and payment records where you connect AdSense.
• OAuth access and refresh tokens needed to refresh your data without asking you to sign in again.
• The workspace, creator, payout and report records you create.

OAuth tokens and all other credentials are held exclusively on our servers, encrypted at rest, and are never transmitted to the browser, never logged and never exposed through any interface or export.

Every workspace is logically isolated at the database level. Records carry an organisation identifier and access is enforced by row-level security policies on the server, not only by the user interface. Members of one workspace cannot read another workspace’s channels, revenue, payouts or creator records.

Inside a workspace, access is governed by role. Owners and administrators have full access; finance and analyst roles have restricted access; creator accounts can be limited to only the specific channels assigned to them and cannot see other creators, organisation-wide totals or management profit.

A small number of MCN Desk staff with platform-administrator privileges can access workspace records where necessary to provide support, investigate a security issue or comply with law. Such access is logged.

We do not sell, rent or trade your information. We share it only with infrastructure providers acting as our processors and strictly to operate the service:

• Supabase — managed database, authentication and storage.
• Cloudflare — application hosting, content delivery and edge security.
• Google — the source of the YouTube and AdSense data you authorise.

We may also disclose information where required by law, to enforce our terms, or to protect the rights, property or safety of MCN Desk, our customers or the public.

We keep channel and performance history for as long as your workspace is active, because historical reporting and year-on-year comparison are the purpose of the product. Disconnecting or archiving a channel preserves its history so past reports remain accurate; it stops all further data collection for that channel.

When you delete a channel’s history, or delete your workspace, the corresponding records are removed from our production database within 30 days and from encrypted backups within 90 days. OAuth tokens are deleted immediately on disconnection and we ask Google to revoke them at the same time.

All traffic is served over HTTPS. Credentials and tokens are encrypted at rest. Every call to a Google API is made from our servers; no secret, client secret or refresh token is ever included in code delivered to a browser. OAuth authorisation uses the PKCE extension together with a single-use state value to prevent request forgery. Sensitive actions such as role changes, plan changes and payout status changes are recorded in an audit log.

We make no claim to any formal certification. No online service can be guaranteed absolutely secure, and you are responsible for keeping your own account credentials safe.

• Access and portability — you can export your channel, revenue and payout data at any time from the Reports page in Excel or CSV format.
• Correction — workspace, creator and payout records can be edited directly in the product.
• Withdrawal of consent — disconnect a channel from the Channels page, or revoke access at myaccount.google.com/permissions.
• Deletion — see our data deletion page or email privacy@mcndesk.com. Verified requests are actioned within 30 days.

Depending on where you live you may also have the right to object to processing, to restrict processing, or to complain to your local data protection authority.

Our infrastructure may process data in countries other than your own, including the United States and the European Union. Where personal data is transferred out of a region with transfer restrictions, we rely on our providers’ standard contractual clauses.

MCN Desk is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16.

We will update this page when our practices change and will revise the “last updated” date above. Material changes affecting how Google user data is handled will also be notified to workspace owners by email.

Privacy enquiries and deletion requests: privacy@mcndesk.com. General support: support@mcndesk.com.