AI Summary for YouTube

GDPR overview

There is no GDPR implementation to report. The words GDPR, General Data Protection and CCPA appear nowhere across the ten pages collected, in either the rendered text or the archived HTML. No Article 27 representative is designated, no data protection officer is named, no lawful basis for processing is stated, no retention period is given and no international transfer is described. The closest equivalent is section 6 of the company privacy policy, which recognises rights of access, rectification, erasure, objection and restriction, exercisable by email to the single contact address. On the Chrome Web Store the extension declares that it handles personally identifiable information, while the publisher registers as a non-trader and notes explicitly that EU consumer rights do not apply. Both privacy policies announce cookies serving personalised content and advertising, with no consent mechanism documented anywhere.

Who owns the data?

Neither the user agreement nor either privacy policy says who owns the summaries the tool produces: ownership of generated content is simply not addressed. What the documents do cover is personal data. LELU TECH states that it collects a name, email address, phone number and contact details, along with IP address, browser type and pages viewed in log files. It undertakes not to sell or rent personal information, but reserves the right to share it with unnamed trusted partners who help operate the service under confidentiality agreements, and to disclose it where the law requires. The Chrome Web Store listing adds that the data is not sold to third parties outside approved uses. No third party is ever named — neither those trusted partners, nor the provider of the AI model that writes the summaries.

Reuse rights

The user agreement grants the end user no explicit reuse rights over the summaries and transcripts produced, and withholds none either: the question is absent from the document. The only restrictions it sets concern the user's own conduct — no illegal activity, no infringement of other people's intellectual property, and no dissemination of false or misleading information. That last clause matters in practice, because the source material belongs to the YouTube creators rather than to LELU TECH, and nothing in the published documents addresses the status of a derived summary or of a copied transcript. Users should also note that the publisher reserves the right to modify or terminate the service at any time, which extends to continued access to summaries already generated.

Data retention & training

Hosting summary

No hosting jurisdiction is declared anywhere on the site. Neither privacy policy names a country or region where data is stored, the user agreement states no governing law, and no international transfer clause or standard contractual clause is mentioned. The only measurable element is technical rather than contractual: on 9 August 2026 the A record for chatgpt4youtube.com resolved to 3.165.190.78, an Amazon Web Services address geolocated to Zurich, Switzerland. That is a delivery node, not a declared place of storage, and it should not be read as a hosting jurisdiction. The publisher, LELU TECH LTD, is based in Hong Kong, which says nothing about where data sits. The extension's privacy policy claims reasonable security measures without describing a single one, and expressly declines to guarantee security. No certification is claimed: SOC 2, ISO 27001 and encryption appear nowhere in the pages collected.