GDPR / UK GDPR Disclosure

This disclosure supplements our Privacy Policy for users located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It explains the legal bases we rely on, the categories of data we process, and the rights that apply under the GDPR and UK GDPR.

Data controller

Livestreamer Hub ("we", "us") is the data controller responsible for the processing of your personal data. You can reach us at help@darkfoxdev.com.

Categories of personal data processed

• Account identifiers: Twitch user ID, login handle, and display name (collected via Twitch OAuth).
• Service configuration: Timer rules, overlay styles, sound alert settings, TTS preferences, goal configurations, and other settings you create.
• Uploaded content: Sound files and video clips you upload to the platform.
• Payment data: Stripe customer ID, subscription ID, and subscription status. Full payment details (card numbers, billing address) are processed exclusively by Stripe and never stored by us.
• Usage data: Anonymous analytics events collected via Google Analytics / Firebase (e.g., page loads, feature usage, channel ID).
• Technical data: Session cookies, IP addresses in server logs, and browser user-agent strings.

Legal bases for processing

• Performance of a contract (Art. 6(1)(b)): Processing your Twitch account data, storing your configuration and preferences, and managing your subscription are necessary to provide you with the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): We process technical data and maintain ban records to ensure platform security, prevent abuse, and maintain the reliability of our infrastructure. Our legitimate interest does not override your fundamental rights.
• Consent (Art. 6(1)(a)): Analytics cookies and Google Analytics tracking are based on your consent, managed through Cookiebot. You may withdraw consent at any time via the cookie banner without affecting the lawfulness of prior processing.

Data processors and third-party recipients

• Twitch (Amazon): Authentication provider and source of channel event data. Data processed in the US.
• Google / Firebase: Anonymous analytics. Data processed in the US under Google's data processing terms.
• Stripe: Payment processor for Pro subscriptions. Data processed in the US under Stripe's DPA.
• Inworld AI: Text-to-speech synthesis. Only message text and voice selection are transmitted — no user identifiers.
• Cookiebot (Cybot A/S): Cookie consent management. Cookiebot is an EU-based processor.

International transfers

Your data is hosted on servers in the United States. Transfers of personal data from the EEA/UK/Switzerland to the US are supported by:

• The EU-US Data Privacy Framework (where applicable to our processors)
• Standard Contractual Clauses (SCCs) incorporated into processor agreements

Data retention

• Account and configuration data: Retained while your account is active. Deleted upon request.
• OAuth tokens: Held in server memory only; automatically expire after approximately 1 hour.
• Session cookies: Expire when you close your browser or log out.
• TTS audio: Automatically deleted after 10 minutes.
• Uploaded content: Retained until you delete it or request account removal.
• Analytics data: Retained per Google Analytics default policies (14 or 26 months depending on property settings).
• Payment records: Retained per Stripe's policies and applicable financial regulations.

Your rights as a data subject

Under GDPR / UK GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16). Note: your Twitch display name syncs from Twitch — changes should be made there.
• Erase your data ("right to be forgotten") (Art. 17). We will delete your stored profile, preferences, uploaded content, and subscription records.
• Restrict processing in certain circumstances (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent for analytics cookies at any time via the Cookiebot banner (Art. 7(3)).
• Lodge a complaint with your local supervisory authority if you believe your rights have been violated.

Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. TTS content moderation filters (offensive language, caps, repeat characters) are applied uniformly and do not constitute profiling under GDPR.

How to exercise your rights

Email help@darkfoxdev.com with "GDPR request" in the subject line. Please include your Twitch username so we can locate your data. We will respond within 30 days. If we need additional time (up to 60 additional days for complex requests), we will inform you within the initial 30-day period.