goostospeakprivacy policy

Privacy Policy

Effective 4 June 2026

goostospeak (“we”, “us”) is a club operating system for Toastmasters and similar public-speaking clubs, operated by Goosto Industries. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have under the EU/UK General Data Protection Regulation (GDPR). For the purposes of the GDPR, Goosto Industries is the data controller for the data described here.

1. Data we collect

  • Account data — your name, email address, and authentication details when you sign up or are invited to a club.
  • Club activity — club and chapter membership, officer roles, meeting attendance and RSVPs, agenda assignments, speeches and projects, evaluations and written feedback, and awards.
  • Media — profile images you upload, and audio/video of meetings that your club chooses to record or livestream (see section 3).
  • Payment data — for paid subscriptions, billing is handled by Stripe. We receive the subscription status and limited billing metadata; we never see or store your full card number.
  • Technical data — device, browser, and log data needed to operate and secure the service.

2. How we use data & legal bases (GDPR Art. 6)

  • To provide the service — run your club, meetings, roles, and records (performance of a contract).
  • To process subscriptions and payments (contract / legal obligation).
  • To record and publish meeting media where your club has enabled it (consent, which you can withdraw — see sections 3 and 6).
  • To keep the service secure and to improve it (legitimate interests).

3. Livestreamed and recorded meeting media

Clubs may livestream or record their meetings through goostospeak. By default, livestreamed media is stored and published on the “goostospeakglobal” YouTube channel. A club that has connected its own YouTube account may instead route streams to its own channel, and may set each session’s visibility (for example public, unlisted, or private) at the time of streaming.

This means your image, voice, name, and spoken content during a streamed or recorded meeting may appear on YouTube. Once content is on YouTube it is also governed by Google’s Privacy Policy. If you do not wish to be recorded or streamed, tell your club’s officers before the meeting, and see section 6 to request removal of media that features you.

goostospeak uses YouTube API Services to set up and publish these streams. If you or your club connected a YouTube account to goostospeak, you can revoke goostospeak’s access to your YouTube data at any time on the Google security settings page.

4. Who we share data with (processors)

We use a small set of trusted providers to run goostospeak:

  • Supabase — database, authentication, and file storage.
  • Google / YouTube — hosting of livestreamed and recorded meeting media.
  • Stripe — subscription billing and payment processing.
  • Render — application hosting.
  • Resend — transactional email (invites, notifications).

We do not sell your personal data. Where these providers process data outside the EEA/UK, they do so under appropriate safeguards such as Standard Contractual Clauses.

5. How long we keep data

We keep account and club-activity data for as long as your account or club membership is active, and only as long as needed afterwards for legal, accounting, or legitimate operational reasons. Meeting media stored on YouTube remains there until it is deleted by the club, the channel owner, or in response to an erasure request (section 6). When you ask us to delete your data, we remove it from our systems within 30 days, except where we are legally required to retain it.

6. Your rights — including the right to be forgotten

Under the GDPR you have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”) — ask us to delete your account and personal data, including a request to remove or take down meeting media on YouTube that features you.
  • Restriction — ask us to pause processing of your data.
  • Portability — receive your data in a portable, machine-readable format.
  • Object — object to processing based on legitimate interests.
  • Withdraw consent — for example, to recording or streaming, at any time.

To exercise any of these rights, or to request deletion of your account and data (“right to be forgotten”), email privacy@goostospeak.com from the address on your account. We will respond within 30 days and free of charge. You also have the right to lodge a complaint with your local data protection supervisory authority.

7. Children

goostospeak is intended for use by club members aged 16 and over. We do not knowingly collect data from children under 16; if a club includes younger members, it must obtain the appropriate parental or guardian consent.

8. Security

We use industry-standard measures — encryption in transit, access controls, and row-level security — to protect your data. No system is perfectly secure, but we work to keep your information safe and to notify you and the relevant authority of any breach as required by law.

9. Changes to this policy

We may update this policy as the service evolves. We will update the effective date above and, for material changes, notify you in the app or by email.

10. Contact

Questions about this policy or your data? Email privacy@goostospeak.com.