Privacy Policy

Controller

The data controller for StreamDono is Kristian Bryld, [email protected]. These notes describe how that service handles personal data under the GDPR and the Danish Data Protection Act.

A streamer who publishes a donation on stream, or forwards it to another tool, is a separate controller for that publication. StreamDono does not control what the streamer says on stream.

What is processed

Depending on how the service is used, StreamDono processes:

• Account data: email, username, display name, password hash, country, currency, settings, and whether terms were accepted and when.
• Twitch profile, if the streamer signs in with Twitch or connects it: Twitch id, login name, and avatar URL. An email from Twitch is stored only when it is not already used by another account. If Twitch sends no email, the account is created without one and the streamer can add it later.
• Donation data: donor name, message, amount, currency, time, and payment status. Donors are not asked for an email address. A message may still contain personal data the donor typed.
• IP address and browser type, used for security, rate limits, and login notices.
• Technical logs needed to run and protect the service.
• If the streamer connects Streamlabs or StreamElements: the tokens they provide, stored encrypted, and the donation name, message, amount, and currency sent to that service.

Purposes and legal bases

Data is used only to run the service, keep it secure, and meet legal duties.

• Providing the account, the donation page, and alerts: contract, GDPR article 6(1)(b).
• Security, abuse prevention, rate limits, and login notices: legitimate interests, article 6(1)(f). The interest is keeping accounts and payments from being abused. It is not used to profile people for ads.
• Records that bookkeeping or tax law requires the operator to keep: legal obligation, article 6(1)(c), where that duty applies.
• Remembering the current terms version the streamer accepted: contract and, where relevant, legal obligation.

Processors and other recipients

Personal data is not sold. It is not shared for advertising. Recipients are limited to those needed to run the feature the user turned on:

• Stripe, which processes the payment on the streamer’s connected account and acts under its own terms for payment data. Card numbers are not stored by StreamDono.
• Twitch, if the user signs in with Twitch or links an account. Twitch receives the OAuth request the user starts.
• Streamlabs or StreamElements, only if the streamer connects them. They then receive the donor name, message, amount, and currency for alerts. They do not receive the donor’s email.
• The provider that hosts this installation, which stores the database and files on the operator’s behalf.
• Email delivery, if the operator has configured SMTP, for security messages such as a new login or a password change.

Transfers

Stripe, Twitch, Streamlabs, and StreamElements may process data outside the EU/EEA. Where they do, they state their own transfer safeguards (such as the EU standard contractual clauses). The hosting provider is whoever the operator uses for this installation.

Retention

Account and donation records are kept while the account exists. After closure they are kept for as long as Danish bookkeeping or tax rules require, often five years, and then deleted or anonymised.

Sessions last until logout or up to 14 days. Rate-limit and security logs are kept only as long as needed for that purpose, and not longer than 12 months unless a specific incident must be documented.

Rights

You can ask for access, rectification, erasure, restriction, and a copy of data you provided (portability), and you can object to processing based on legitimate interests. Where erasure would break a legal duty to keep a record, the data is restricted instead.

Write to [email protected]. The operator may ask for enough information to confirm it is your account or your donation. You can also ask the streamer about anything they have already shown on stream or forwarded.

Complaint

You can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, [email protected], https://www.datatilsynet.dk. You can also complain to the authority where you live.

Cookies

StreamDono uses only cookies and similar storage that are necessary to run the site: the session, the CSRF token, the theme, the language, and short-lived cookies while a Twitch or Streamlabs login is in progress. There are no advertising or analytics cookies. Details are on the cookie page.