Privacy Policy

Version 3.2 · Effective October 2026

Download PDF

This Privacy Policy explains how Stock Card, Inc., doing business as VexLab (“VexLab,” “we,” “us,” or “our”), collects, uses, and shares information about you when you visit vexlab.ai or originnotes.vexlab.ai (together, the “Site”), enroll in or use our services, subscribe to or use the GTM Library, or otherwise interact with us. In this Policy, “services” includes the GTM Library unless we say otherwise. By using the Site or our services, you agree to this Policy.

1. Who We Are and How to Contact Us

VexLab provides managed content packaging services for YouTube creators. VexLab also publishes Origin Notes and operates the GTM Library, an online subscription library of go-to-market tactics and teardown articles available at originnotes.vexlab.ai. If you have questions about this Policy or about your information, you can contact us at admin@vexlab.ai.

2. Information We Collect

2.1 Information you provide

When you enroll, contact us, or use our services, we collect information you give us, including your name, business name, email address, billing address, the YouTube channel or channels you engage us to work on, and the content of your communications with us.

If you subscribe to the GTM Library, we collect the email address you use at checkout and to sign in, and any message you send us, such as a suggestion of a company to cover.

2.2 Payment information

We use Stripe to process payments. Stripe collects and processes your payment card and billing details under its own privacy terms. We do not store full payment card numbers; we receive limited information such as billing contact details and a record of your transactions and subscription.

2.3 Channel and platform data

To provide our services, and with your authorization, we access data from your YouTube channel and related accounts, including channel settings, video metadata, performance metrics, and analytics, through access you grant us (such as YouTube Studio editor access) and platform interfaces such as the YouTube Data API. We use this data to perform and measure the services.

2.4 Information collected automatically

When you visit the Site, we and our providers automatically collect certain information, such as your IP address, device and browser type, pages viewed, referring pages, and interactions with the Site, using cookies and similar technologies.

2.5 Information from third parties

For business development, we may collect information about creators and businesses from publicly available sources and third-party data providers, including names, business or channel details, and professional contact information, which we use to identify and reach out to potential clients.

2.6 YouTube Data API research (Scout and Signal)

In addition to the client-service use described in §2.3, VexLab operates internal analytics tools that use the YouTube Data API v3 to research publicly-available information about YouTube channels and videos for the purpose of identifying high-performing creators in our focus verticals (finance, business, and technology).

• Data accessed: Only publicly-available metadata, channel names, handles, descriptions, subscriber counts, thumbnail URLs; video titles, view counts, publish dates, duration, thumbnail URLs. VexLab does not access user-authenticated data, viewing history, private videos, or OAuth-scoped individual accounts for this research use.
• How used: Internally to identify channels for outreach research (“Scout”). VexLab also plans to publish a public daily leaderboard of high-velocity videos in our focus verticals (“Signal”), displaying VexLab-derived analytics scores alongside publicly-available metadata. Signal is not currently live; its launch is pending YouTube API Compliance Audit approval.
• Data retention: Raw metadata is deleted or refreshed within 30 days in accordance with YouTube API Services policies. VexLab does not retain derived analytics metrics beyond that window unless and until VexLab is accepted as an audited developer under YouTube’s derived-metrics amendment, at which point accepted statistical metrics may be retained for up to 36 months as that policy permits.
• Channel owner opt-out: If you own a YouTube channel and prefer VexLab exclude your channel from Scout’s research pool or the Signal leaderboard, contact admin@vexlab.ai with your channel URL. We will exclude your channel within 7 business days and confirm removal.
• Third-party terms: VexLab’s use of YouTube Data API Services is subject to the YouTube Terms of Service. For information about how Google collects and uses data through YouTube API Services, please refer to the Google Privacy Policy.

2.7 GTM Library account and usage data

When you use the GTM Library, we collect:

• Account and sign-in data: your email address, your subscription status and renewal date, and a record of when you sign in. We sign you in with a one-time link sent to your email. We do not set or store a password.
• Tactic Library activity: the searches you run, the filters you apply, and the tactics and pages you view, with the date and time.
• AI access activity: if you connect an AI tool, the requests that tool sends to the GTM Library on your behalf (such as a search phrase, or the tactic or article requested), with the date and time. We do not receive the rest of your conversation with your AI tool. We store your personal connection key only in a protected form that cannot be read back.
• Technical data: your IP address and device and browser type, as described in §2.4.

The AI tool you connect is provided by a third party that you choose. That provider processes your prompts, and the GTM Library content returned to it, under its own terms and privacy policy, which we do not control.

3. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve our services;
• Set up and manage accounts, subscriptions, and billing, and process payments and send invoices;
• Communicate with you, including service and account messages and, where permitted, marketing;
• Measure and report on channel performance and deliver the services;
• Conduct business development and outreach to potential clients;
• Operate the GTM Library, including signing you in, confirming your subscription, and sending sign-in links and renewal, billing, and service notices;
• Apply usage limits and detect and prevent sharing of access, scraping, and other misuse of the GTM Library;
• Understand which tactics and topics subscribers use, in order to improve the GTM Library and decide what to cover;
• Maintain the security and integrity of our Site and services; and
• Comply with legal obligations and enforce our agreements.

4. Artificial Intelligence Tools

We use a combination of human expertise and artificial intelligence tools, including third-party AI and machine-learning platforms and our own internally developed tools, to provide our services. To do this, we may submit content and information reasonably necessary for the services to these tools, subject to their terms and data-handling practices. We use commercially reasonable efforts to select providers with reasonable data-protection commitments and, where available, to disable the use of your data to train third-party models. We may also use aggregated and de-identified data to operate and improve our tools and services; such data does not identify you.

The paragraph above describes our own use of AI tools to deliver our content packaging services. We do not use GTM Library subscribers' personal information or usage data to train AI models. The AI tools that a subscriber chooses to connect to the GTM Library are covered in §2.7.

5. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers: with vendors who help us run our business, such as payment processing (Stripe), website hosting, database, and sign-in services, email delivery, cloud storage and collaboration (such as Google and Slack), customer-relationship and outreach tools, analytics providers, and AI tool providers, who process information on our behalf.
• Legal and safety: when required by law or legal process, or to protect the rights, property, or safety of VexLab, our clients, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.
• With your direction: when you ask us to share information or make it public, for example a case study you have approved.

6. Cookies and Analytics

The Site uses cookies and similar technologies to operate the Site, remember your preferences, and understand usage. You can control cookies through your browser settings, though disabling some cookies may affect Site functionality. We may use analytics services to understand how the Site is used.

The GTM Library uses cookies or similar browser storage that are necessary to keep you signed in. If you block them, you will not be able to sign in.

7. Data Retention

We retain information for as long as needed to provide the services, maintain our business records, comply with legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

For the GTM Library, we keep your account and subscription records while your subscription is active and afterward for as long as needed for our business, tax, and legal records. We keep usage records for as long as needed to secure the GTM Library and enforce our terms, and then delete or de-identify them.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Choices and Rights

You may request access to, correction of, or deletion of your personal information, and you may opt out of marketing emails using the unsubscribe link or by contacting us. Depending on where you live, you may have additional rights under applicable law. We will respond as required by law and may need to verify your identity before acting on a request. You can reach us at admin@vexlab.ai.

California residents

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended, including the right to know what personal information we collect, use, and disclose; the right to request deletion or correction; and the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under California law. We will not discriminate against you for exercising these rights.

EEA and UK residents

If you are in the European Economic Area or the United Kingdom, you may have rights to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. Our legal bases for processing include performing our contract with you, our legitimate interests in operating and promoting our business, your consent where applicable, and compliance with legal obligations. You may contact us to exercise these rights or lodge a complaint with your local supervisory authority.

10. Children's Privacy

Our Site and services are intended for businesses and creators and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with information, contact us and we will delete it. The GTM Library is offered only to adults aged 18 or older.

11. International Data Transfers

We are based in the United States and process information there. If you access our Site or services from outside the United States, you understand that your information may be transferred to and processed in the United States and other countries, which may have data-protection laws different from those in your own country.

12. Third-Party Links and Services

Our Site and communications may link to third-party sites and services that we do not control. Their privacy practices are governed by their own policies, and we are not responsible for them. The Origin Notes newsletter is published on Substack, and payments are processed by Stripe. Each handles your information under its own privacy policy.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will change the effective date below and, for material changes, take any additional steps required by law. Your continued use of the Site or services after an update means you accept the revised Policy. For material changes that affect GTM Library subscribers, we will also notify you by email.

14. Contact Us

Questions or requests about this Policy or your information can be sent to VexLab at admin@vexlab.ai. This is Version 3.2 of this Policy, effective October 2026.