Privacy policy

Who we are

Tenor is operated by [COMPANY NAME] (“Tenor”, “we”, “us”), [REGISTERED ADDRESS], company number [COMPANY NUMBER]. We are the data controller for the personal data described in this policy.

• Contact for privacy matters: [CONTACT EMAIL]
• ICO registration number: [ICO REGISTRATION NUMBER]

We have not appointed a Data Protection Officer, as our processing does not meet the threshold requiring one.

What Tenor does, in one paragraph

Tenor measures public opinion by analysing comments left on UK political YouTube videos. It identifies which topics people are discussing and how opinion divides on each, and publishes those findings as population-level statistics. It does not build profiles of individual people.

How this policy is organised

Tenor handles personal data in two distinct situations, with different rules attached:

• Part A — you visit this website, create an account, or join our waitlist. You give us your data directly.
• Part B — you commented on a UK political YouTube video. You did not give us anything; we obtained your comment from YouTube.

If you are here because you commented on YouTube and want to know what we hold, go to Part B and then to Your rights.

Part A — This website, your account, and the waitlist

What we collect

If you create an account: your name, your email address, and a password.

Your password is never stored as you typed it. Our authentication provider stores only a salted cryptographic hash of it. We cannot see it, cannot recover it, and cannot tell you what it is.

If you sign in with Google instead: Google tells us your name, your email address, whether that address is verified, your Google account identifier, and the URL of your profile picture. We do not receive your password, and we receive no other part of your Google account — not your contacts, your files, your search history, or anything else. You can see and revoke this at any time from your Google Account’s connections settings.

If you simply visit: our hosting provider records standard technical information as part of serving the site — IP address, browser type, pages requested, and timestamps. This is ordinary server logging and we do not use it to identify you.

We do not ask for your employer, your job title, your phone number, or your postal address.

Accounts and access

Creating an account puts you on our waitlist and does nothing else. It does not give you access to any reading, report or dashboard, and it does not cost anything.

Access to the client dashboard is enabled by us, by hand, for clients who have commissioned a reading. We record this as a single flag against your account. It is not something you can grant yourself, and creating an account does not put you in a queue for it.

Cookies

When you sign in, we set cookies that keep you signed in as you move between pages. These are strictly necessary to provide a service you have asked for, so under the Privacy and Electronic Communications Regulations they do not require your consent. They are not used for analytics, advertising, or tracking you across other websites. Signing out clears them.

We do not use advertising cookies, analytics cookies, or tracking pixels. We do not share browsing data with advertisers or data brokers.

If we add analytics in future we will ask for your consent first, as required by those same Regulations, and update this policy before doing so.

Why we collect it, and our lawful basis

Note that the basis differs between the two things an account does. Holding your account is contract: you asked us to create it and we perform that. Emailing you at launch is consent, which you can withdraw at any time without closing your account.

What we will and will not do with your details

We will use your email to contact you about Tenor becoming available, and about your account if something affects it. We will not sell your details, rent them, share them with third parties for their own marketing, or add you to unrelated mailing lists.

Creating an account is entirely voluntary. It is not a statutory requirement, and the only consequence of not creating one is that we cannot tell you when Tenor opens. An account does not entitle you to access a reading, to particular pricing, or to a place in any queue. See our Terms and Conditions.

How long we keep it

We keep your account details for as long as your account exists.

If you close your account, or ask us to remove you, we delete your account record and your waitlist entry within [30] days, and they are removed from our backups within [90] days. If Tenor does not launch, we will delete the waitlist.

Withdrawing consent

Email [CONTACT EMAIL] and ask to be removed. We will do it, and we do not need a reason. Every email we send will also contain an unsubscribe link. Withdrawing consent does not affect anything we did lawfully beforehand.

Withdrawing consent to launch emails does not delete your account. If you want the account gone as well, say so and we will delete both.

Who else sees your account data

These are processors acting on our instructions, not independent controllers — except Google, which is its own controller for your Google account.

Part B — The Tenor polling service

This part concerns people who have commented on UK political YouTube videos. You have not interacted with Tenor and would have no reason to know we exist. This section exists to tell you what we do, because the UK GDPR requires it and because you are entitled to know.

Where the data comes from

Publicly visible comments on public YouTube videos, retrieved through the official YouTube Data API v3 under Google’s developer terms, using an authenticated API key.

We do not scrape YouTube. We do not use unofficial endpoints, browser automation, or third-party comment datasets. We do not access private videos, unlisted videos, or anything requiring your account credentials.

What we retrieve

For each comment:

• the comment text
• the public display name shown on the comment
• the number of likes and replies it received
• when it was published
• the video and channel it appeared under

We do not retrieve or receive your email address, your real name, your subscriber list, your watch history, your location, or any other part of your Google account.

What we do with it

1. We replace your display name with a pseudonymous identifier.

Immediately on ingestion, your display name is converted into an irreversible identifier using a salted SHA-256 hash. The display name itself is not carried forward into analysis.

2. We classify the comment.

An automated language model reads the comment and records: which political topics it mentions; whether it expresses support, opposition, or a neutral position on each; how strongly; and whether the comment leans left or right on economic questions and liberal or authoritarian on social ones. It also stores a one-sentence explanation of why it labelled the comment that way.

Every one of those labels describes the comment, not you. They are not combined across your comments, and no overall position is calculated or held for you as a person.

3. We delete the raw text and display name.

Once a comment is classified, the raw text, the display name, and the video description are cleared. Only the derived labels persist.

4. We aggregate.

Labels are pooled across thousands of comments to produce topic-level statistics — for example, “of comments discussing this topic, 62% expressed opposition”. Published output is statistical. We do not publish individual comments attributed to individual people.

What we use the pseudonymous identifier for — and only this

One purpose: to stop any one person being counted more than once.

If the same person leaves ten comments about the same topic, counting all ten would let a single vocal individual distort the result. The identifier lets us cap each person’s contribution to any one topic at three comments, and lets us report how many distinct people a figure rests on rather than just how many comments.

That is the entire use. We do not use it to follow you, build a picture of you, or link you to anything outside the comment data.

What Tenor does not do

We want to be specific, because these are the things people reasonably worry about:

• We do not build a profile of you. No accumulated political score is held against your identifier. No record of “what this person believes” exists.
• We do not infer your age or gender. Not from your username, not from your writing style, not at all — not even for internal use.
• We do not infer your ethnicity, national origin, religion, sexuality, health, or any other special category of personal data. No such capability is present in the system.
• We do not make automated decisions about you, and nothing we do produces legal effects or similarly significant effects for you.
• We do not attempt to identify you, contact you, or link your comments to any other account, dataset, or platform.
• We do not sell personal data.

Tenor previously had the capability to infer demographic attributes and accumulate per-person ideological scores. That capability was removed from our systems in August 2026 and is no longer part of the product. We mention it because we would rather tell you than have you find out.

Honesty about pseudonymisation

We could describe the hashed identifier as “anonymous”. It would be misleading, so we do not.

Pseudonymised data is still personal data under the UK GDPR. The identifier is irreversible in the sense that it cannot be mathematically decoded back to your display name, but someone holding both our secret salt and a guess at your display name could confirm a match. We treat the salt as a protected secret and the identifier as personal data, with the full protections that implies.

Our lawful basis

We rely on legitimate interests (UK GDPR Article 6(1)(f)).

• Our interest: measuring and reporting public opinion on political topics from material people chose to publish in public.
• Why it is necessary: the analysis cannot be done without processing the comments, and obtaining consent from every commenter is not possible — we have no way to contact them.
• The balance: we process only what is already public, delete raw text and display names promptly, hold no profile of anyone, publish only statistics, and provide the objection right set out below. We consider the impact on you to be minimal and the safeguards proportionate.

You have the right to object to this processing. See Your rights.

Why you are reading this instead of receiving a notice

Where personal data is not obtained from the individual, the UK GDPR ordinarily requires us to notify them directly. We are unable to do that: we hold no contact details for commenters and deliberately avoid acquiring any. Contacting people individually would require us to collect substantially more personal data than the analysis itself needs, which would be worse for your privacy, not better.

We therefore rely on the exemption at Article 14(5)(b) for cases where direct notice is impossible or would involve disproportionate effort, and we publish this policy openly and prominently as our public notice instead.

Who else sees the data

We do not share personal data with advertisers, data brokers, political parties, or campaign organisations.

International transfers

Your account data stays in the UK. Our database and authentication are hosted in London (eu-west-2), and we chose that region deliberately so that account details do not leave the United Kingdom.

Two exceptions, both disclosed:

• If you sign in with Google, that exchange involves Google LLC in the United States. That transfer is made under Google’s standard contractual clauses together with the UK International Data Transfer Addendum. Signing in with email and password instead avoids it entirely.
• Comment text sent for classification (Part B) may be processed outside the UK, depending on the classifier we use. Where it is, that transfer is made under the provider’s standard contractual clauses together with the UK International Data Transfer Addendum.

Note for the draft: the second bullet must be finalised once the classifier is chosen. If classification runs locally, say plainly that no comment data leaves the UK.

How long we keep it

Your rights (Parts A and B)

Under the UK GDPR you have the right to:

• be informed — this policy
• access the personal data we hold about you
• rectify it if it is inaccurate
• erase it
• restrict how we use it
• object to processing based on legitimate interests
• portability — receive your data in a usable format
• withdraw consent at any time, where consent is the basis

You will not be charged, and we will respond within one month.

Automated decision-making and profiling: still none. Nothing we do makes an automated decision about you that produces legal effects or similarly significant effects. Creating an account does not change that.

Exercising these rights if you have an account

Email [CONTACT EMAIL] from the address your account uses.

• Access — we will send you everything held against your account: your name, email address, when you joined, and whether dashboard access is enabled. We cannot send you your password, because we do not have it.
• Erasure — we delete both the authentication record and the account record. This is permanent and cannot be undone; you would need to create a new account to sign up again.
• Rectification — tell us the correct name or email and we will change it.

If you signed in with Google, deleting your Tenor account does not affect your Google account. You may also want to revoke Tenor’s access from your Google Account’s connections settings, which is separate and entirely in your control.

Exercising these rights if you commented on YouTube

This is more practical than it sounds. Because we hold no display names, we cannot search for you by name — but we can find the identifier derived from it.

Email [CONTACT EMAIL] with the YouTube display name or channel handle you commented under. We will apply the same hash to it, search for that identifier, and tell you what we hold against it. You can then ask us to delete it or object to further processing.

Two things worth knowing:

• Deleting your comment on YouTube does not automatically remove derived labels we already hold. Ask us as well.
• If you object or ask for erasure, we will remove your data from our analysis. We cannot retract statistics already published, because those aggregates contain no personal data and cannot be reverse-engineered to identify any individual’s contribution.

Complaints

If you are unhappy with how we have handled your data, please tell us first at [CONTACT EMAIL] — we would rather fix it.

You also have the right to complain directly to the Information Commissioner’s Office at any time, without going through us:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 — ico.org.uk/make-a-complaint

Changes to this policy

If we change what we do with personal data, we will update this policy and change the version number and effective date at the top. Material changes — a new category of data, a new purpose, a new recipient — will be announced on this website before they take effect, and by email to waitlist members where we hold a relevant address.

We will not reintroduce individual profiling, demographic inference, or special-category inference without publishing that change clearly and in advance.