Privacy policy

Who operates the service and why?

The Islamic University of Minnesota operates this service through its university portal and app. The Google connection is named IUM Portal Lecture Recordings.

The service matches an ended recording to its lecture, saves its summary, reviews its transcript before upload, and uploads the recording to the university YouTube channel as Private for staff review. A university administrator authorizes the connection; students do not connect their personal Google accounts.

Zoom and lecture data

The service reads meeting and ended-instance identifiers, host information, meeting and recording times, recording file metadata, the Zoom-generated summary, and the transcript with timestamps and speaker names when Zoom provides them. It uses the course, lecture number and timetable already held in the portal to match the recording.

A video may include voices, images, shared screens, participant names or other information shown during recording. A transcript may include names or personal details spoken during the lecture. Such details are not automatically removed before review.

Lecture audio on hearthis.at

When audio processing is enabled, an MP3 is derived from the Zoom original after staff approve the video recording. The audio, title, description and lecture reference are sent to the university hearthis.at account. YouTube API data is not used to download a video or extract audio.

The integration uploads as Private, verifies the returned visibility and does not change it to Public after approval. After rechecking video approval and transcript review, it attaches a playback entry in the portal and app. The portal checks course and term enrollment before returning the hearthis widget. Someone who obtains the provider widget URL may share it and listen outside the portal; provider privacy does not apply course permissions to copied links.

Audio plays directly from hearthis services inside the portal and app, without an additional audio copy in Alibaba OSS. Opening the player connects the listener device to the provider, which may process IP addresses, device information and cookies under its policy.

Audio account credentials are stored in server configuration outside the code repository. They are not sent to students or the review model. The portal retains track identifiers, links, processing status and review references. Temporary local conversion files are removed after upload completes or processing is held for review. Original recordings, summaries, transcripts and review evidence are preserved.

To stop the connection, the system administrator disables audio processing and removes its server credentials. Tracks and deletion are managed in the university hearthis.at account. Disabling audio or disconnecting YouTube does not automatically delete those tracks.

Google data and YouTube permissions

The service uses YouTube API Services. It requests youtube.upload to upload lecture videos and youtube.readonly to verify the university channel, video status, processing, visibility and embeddability. It also requests youtube.force-ssl to create private course playlists and add recordings to them. Google describes this additional permission broadly; the portal uses it for playlist organization without changing video visibility.

The portal stores the channel ID and title, video IDs and statuses, playlist and membership identifiers and status, granted permissions, access and refresh authorization tokens and expiry, and the reference and connection time of the employee who connected the channel. It does not request the Google account password or read Gmail or contacts. Existing upload-only authorizations may keep uploading privately; playlist organization waits for reconnection and the additional permission.

What is sent to service providers?

• Google / YouTube: the video, a title containing the course and lecture number, and a review description, with Private visibility requested. Playlist organization sends the course name, semester and academic year, a service grouping reference, and the recording identifier. Google also receives the channel, video, playlist and membership verification requests needed by the integration.
• OpenAI, when automated review is enabled: chunks of the Zoom transcript with their timestamps and any speaker names, together with content review instructions. The review model does not receive the video, Google authorization tokens or data retrieved from the YouTube API.
• University hosting and storage infrastructure: files and data needed to run the portal, store summaries and manage transfers and reviews.

Text review flags possible content concerns for authorized staff. It cannot assess images, music or visual copyright, and does not guarantee YouTube acceptance or the absence of copyright claims.

The university uses integration data only for the educational and administrative functions described here, not for sale, targeted advertising or training a general-purpose model. Each provider processes data sent to it under its own policies and terms.

Who can see recordings and summaries?

Video recordings are initially uploaded as Private without subscriber notifications. The portal does not change their visibility automatically. Staff review a recording in YouTube Studio, set it to Unlisted after review, and then approve its lecture link for playback inside the portal and app.

Automatic organization creates a private playlist for each course, semester and academic year recorded on the lecture. A delayed recording is grouped under its original lecture term. Adding it to a playlist does not change its visibility or approve student playback. A playlist whose visibility is changed from Private is held for review rather than used automatically.

This workflow provides students with a recording link only after staff approval and attachment to the lecture. The Zoom summary appears in the existing lecture summary section under normal course permissions. Source transcript and review screens and connection tokens are restricted to their designated administrative access.

An Unlisted video does not appear in YouTube search, but anyone who receives its link can watch and reshare it, including people outside the course. Later visibility changes by staff follow the current YouTube settings.

Data protection

Google authorization tokens, summary and transcript text, and review results are encrypted in the portal database. Temporary transfer files are outside public web paths with restricted file permissions. Summary files and review tools enforce user and course access controls.

The service keeps operational and review records, including processing status, employee, action, time and AI service usage metadata. These safeguards do not mean that every data field or infrastructure copy has the same encryption protections.

Retention and deletion

The service removes its temporary local video after upload completes or processing stops for review. A partial file may remain while a transfer is being resumed. This does not delete the Zoom original or the video uploaded to YouTube.

Lecture summary files are stored in private Alibaba OSS storage; original text, transcripts and review notes are stored in the portal database. These educational records remain available for course delivery and follow-up without automatic deletion based on lecture age. Disconnecting YouTube does not delete these materials or the actual videos on YouTube.

Stored YouTube API data follows a separate process: the service periodically verifies authorization and refreshes the channel, video, playlist and membership data needed by the integration, or removes data that it can no longer retain. Playlist data is subject to the same refresh, retention and disconnect safeguards. This process does not include lecture summaries, Zoom transcripts or review notes.

Withdraw access and request deletion

The university administrator can use Disconnect YouTube in the portal connection settings, or withdraw IUM Portal Lecture Recordings access from the Google Account connections page linked below. Portal disconnection immediately stops local use of the authorization, requests revocation from Google and starts removing stored connection and YouTube API data. If external revocation cannot be confirmed, the service retries and reports that the action remains pending; access can also be revoked directly in the Google Account.

Playback links added to the portal by this integration are removed with their associated data. Stored playlist and membership API data is also removed. Different manual links, the actual YouTube videos and playlists, Zoom originals, summary files, transcripts and review notes remain. Manage or delete uploaded videos and playlists in YouTube Studio.

To request deletion of stored connection data or review of a recording or transcript concerning you, use the contact email on this page. Withdrawing Google access and requesting deletion of university data or educational materials are separate actions.

Sessions and YouTube playback

The portal uses session cookies for sign-in and connection security. Opening or playing a YouTube video in the portal or app connects to Google services, which may process your IP address, device information and cookies under your settings and their policies.

Related policies and terms

Data received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements. YouTube API data is not used for AI training or transcript review. By using the YouTube features of this service, users agree to be bound by the YouTube Terms of Service.