Privacy Policy
Last updated: November 3, 2026 · GDPR · CCPA/CPRA · Israeli Protection of Privacy Law, 5741-1981 (incl. Amendment 13) · Google API Services User Data Policy
1. About StreamLive Pro
StreamLive Pro is a multi-platform live streaming and video publishing service. It allows users to connect their social media accounts (such as TikTok, YouTube, Facebook, Twitch, and others) and simultaneously broadcast live streams or upload videos to multiple platforms from a single dashboard.
2. Data We Collect
3. How We Use Your Data
- Service delivery — Enable streaming, publishing, analytics, and account management
- Security — Detect suspicious activity, prevent fraud, protect your account
- Improvement — Analyze anonymized usage patterns to improve features
- Communication — Service notices, invoices, updates (you can opt out at any time)
- Legal compliance — Fulfill legal and regulatory obligations
4. What We Do NOT Do
- We do not sell your data to any third party
- We do not share your content with advertisers or ad networks
- We do not use your content to train external AI models
- We do not read your private messages (not even for support, unless you grant access)
5. Third-Party Platform Integrations
StreamLive Pro integrates with third-party platforms to enable live streaming and content publishing. Below are the platforms and the permissions we request:
TikTok
- Authentication: StreamLive Pro uses TikTok Login Kit (OAuth 2.0) to connect your TikTok account. We never store your TikTok password.
- Scopes requested:
user.info.basic(display name and profile picture),video.uploadandvideo.publish(sending the video you chose to your account, only when you press "Post to TikTok"). - Data scopes (only if you allow them on TikTok's consent screen):
user.info.profile(your @username, to show it and to build the correct link to your video),user.info.stats(your follower, like and video counts) andvideo.list(your public videos with the views, likes, comments and shares of each). You can refuse any of them: publishing keeps working and Analytics shows "needs permission". - What we do: upload and post videos to your TikTok account only as you instruct, and show your account and video numbers only to you, on the Analytics and Connections pages. We read only the connected account's own data, only when you use Analytics or after you post.
- What we store: encrypted tokens (AES-256-GCM), your account ID (open_id), name, @username and picture, the list of scopes you granted, and for each video: its ID, title, link, thumbnail, date and its view, like, comment and share counts.
- What we do NOT do: we do not read your private messages or your TikTok comments, follow or unfollow accounts, or delete content, and we do not use TikTok data for advertising, profiling or AI training. We do not sell or transfer it.
- Deletion: disconnecting TikTok deletes its tokens immediately; the account and video numbers leave Analytics and are deleted within 24 hours. The numbers of a post you published through us stay with that post's history until you delete the post or your account.
- Revocation: You can disconnect TikTok at any time via Settings → Connections in StreamLive Pro, or via the app settings in your TikTok account.
YouTube, Facebook, Instagram, Twitch, X (Twitter), LinkedIn, and other platforms
- All platform connections use OAuth 2.0 — we never store your passwords.
- Access tokens are encrypted with AES-256-GCM before storage, transmitted only over TLS 1.3, and used only for actions you authorize (streaming, uploading, analytics). Tokens are deleted immediately when you disconnect a channel.
- You can disconnect any platform at any time.
Meta Platform (Facebook, Instagram, Threads) — compliance with Meta Platform Terms
StreamLive Pro's use of Meta-supplied data complies with the Meta Platform Terms and the Meta Developer Policies.
- Data we receive: Facebook — page ID, page name, page access token, live-video and post IDs, and, with
read_insights, the insights of your Pages and of their posts and videos (views, reach, interactions, watch time, followers per day). Instagram — the ID of the Instagram professional (Business/Creator) account linked to your Page, its username and profile picture, the IDs of media you publish through us, and, withinstagram_manage_insights, the insights of the account's posts, Reels and stories (views, reach, likes, comment count, saves, shares, Reels watch time) and of the account (reach and followers per day). Threads — your Threads user ID, username and profile picture, the IDs and permalinks of the posts you publish through us, and, if you allow it, the replies to your own Threads posts for the Comments inbox. We do not read your Threads feed, followers or insights. - Permissions requested: Facebook —
public_profile,email,pages_show_list,pages_read_engagement,pages_manage_posts,pages_manage_metadata,publish_video,read_insights(Page and video insights for Analytics), and for the Comments inboxpages_read_user_contentandpages_manage_engagement. Instagram —instagram_basic,instagram_content_publish,instagram_manage_insights(insights for Analytics),instagram_manage_comments(Comments inbox) (together withpages_show_listandpages_read_engagement). Threads —threads_basic,threads_content_publish,threads_read_replies,threads_manage_replies(Comments inbox). Only the scopes the user explicitly approves. - Use: create live videos and publish posts on Pages you own and select; publish photos, videos and Reels to the Instagram account you connect, only when you publish from the dashboard; show your profile (username and picture) so you can recognise the connected account; read the numbers and insights (views, reach, likes, comment counts, watch time) of the posts on the Pages and Instagram accounts you keep switched on in Analytics, and show them only to you. On Threads we publish the text, image or video post you compose, only when you press Publish (or schedule it yourself), and show your Threads username and picture on the Connections page so you can recognise the account. Comments on your Pages, Instagram and Threads posts are read for the Comments inbox only when you allow it, and a reply, hide or delete happens only when you click it (see 5a-2).
- Retention: tokens are encrypted (AES-256-GCM) and deleted immediately when you disconnect the account or remove the app in your Facebook/Instagram settings or in Threads (Settings → Account → Website permissions); other Meta data (IDs, metrics) is deleted within 30 days of account deletion.
- We do NOT use Meta data for advertising, profiling, or AI training. We do not aggregate Meta data with third-party data sources to build user profiles.
- We do not sell, license or transfer Meta Platform Data to third parties (other than the service providers in the table below acting on our behalf), and we do not use it for surveillance, to discriminate, or to make eligibility decisions (for example about employment, housing, credit or insurance).
- Data deletion request: email [email protected] with subject "Meta Data Deletion" — we delete within 30 days. You may also revoke from Facebook Settings → Business Integrations — removing the app, or requesting deletion there, notifies us automatically and we delete your access tokens and disconnect the account. For Threads: Threads → Settings → Account → Website permissions → Active → StreamLive Pro → Remove. Full instructions and deletion-request status: /data-deletion.
TikTok — compliance with TikTok Developers Policy
StreamLive Pro complies with the TikTok for Developers Terms.
- Scopes requested:
user.info.basic,video.upload,video.publish; and, only if you allow them,user.info.profile,user.info.stats,video.list(details in the TikTok section above). - Use: post the videos you choose to your connected TikTok account, and show your own account and video numbers to you in Analytics.
- We do NOT read your private messages, send follow/unfollow actions, or delete content without explicit instruction.
- Revocation: Settings → Connections inside StreamLive Pro, or via TikTok app settings.
X (Twitter) — compliance with X Developer Agreement & Policy
StreamLive Pro complies with the X Developer Agreement and Policy.
- Scopes requested:
tweet.read,tweet.write,users.read,offline.access,media.write(the image or video of your post). - Use: post on your behalf when you publish content from the dashboard; read your own profile to display the connected account.
- We do NOT read your DMs, scrape timelines, or use X data for ML training. We respect rate limits and never re-distribute X content beyond what the API permits.
- Revocation: X Settings → Apps and sessions → Revoke.
LinkedIn — compliance with LinkedIn API Terms of Use
StreamLive Pro complies with the LinkedIn API Terms of Use.
- Scopes requested:
openid,profile,email,w_member_social. - Use: publish posts to your personal profile when you publish from the dashboard. Publishing to company Pages is not available yet.
- We do NOT read your connections, message inbox, or use LinkedIn data for ad targeting.
- Revocation: LinkedIn → Settings → Data privacy → Permitted services → Remove.
Twitch — compliance with Twitch Developer Services Agreement
StreamLive Pro complies with the Twitch Developer Services Agreement.
- Scopes requested:
user:read:email,channel:read:stream_key,channel:manage:broadcast,chat:read,chat:edit. - Use: read your stream key for server-to-server RTMP relay; aggregate chat for the unified chat panel during your live stream.
- We do NOT store your stream key in plaintext (encrypted at rest), and never share it with third parties.
- Revocation: Twitch Settings → Connections → Disconnect.
Pinterest — compliance with the Pinterest Developer Guidelines
StreamLive Pro complies with the Pinterest Developer Guidelines. Pinterest is a network you connect yourself, with OAuth 2.0; we never see your Pinterest password.
- Scopes requested:
user_accounts:read,boards:read,boards:write,pins:read,pins:write. - Use: show your Pinterest account name and profile picture on the Connections page; list your boards so you can choose where to publish; create a board only when you ask for one in the publish form; create a Pin (image or video, title, description and link) only when you press Publish or schedule it yourself; read the Pins you published through us and their numbers (impressions, saves, Pin clicks, outbound clicks) to show them to you in your dashboard.
- What we store: encrypted tokens, your Pinterest user name and picture, and the ID, link and numbers of the Pins you published through us.
- We do NOT read other people's boards or Pins, follow or unfollow, read messages, or use Pinterest data for advertising, profiling or AI training. We do not sell or transfer it.
- Deletion and revocation: disconnecting Pinterest (Settings → Connections) deletes its tokens immediately; the Pin IDs and numbers are deleted with the post or with your account. You can also remove StreamLive Pro from the apps that have access to your Pinterest account in your Pinterest settings.
- The Pinterest tag (advertising measurement on our website, only with your cookie consent) is separate from this connection and is described under Cookies.
Vimeo — compliance with the Vimeo API License Agreement
StreamLive Pro complies with the Vimeo API License Agreement. You connect Vimeo yourself with OAuth 2.0; we never see your Vimeo password.
- Scopes requested:
public,private,upload,edit. - Use: show your Vimeo account name, picture and account type; list your folders so you can choose one; upload the video you chose, with the title, description and privacy you set (and a password or folder if you set them), only when you publish; check that Vimeo finished processing it; read the plays, likes and comment count of the videos you published through us to show them to you in your dashboard.
- What we store: the encrypted token, your Vimeo account name and picture, and the ID, link and numbers of the videos you published through us.
- We do NOT download, change or delete your other Vimeo videos, read your messages, or use Vimeo data for advertising, profiling or AI training. We do not sell or transfer it.
- Deletion and revocation: disconnecting Vimeo (Settings → Connections) deletes the token and also revokes it at Vimeo. You can also remove StreamLive Pro under Vimeo → Settings → Apps.
Kick, Rumble, Dailymotion
Each integration uses the platform's official API or RTMP ingest endpoint with credentials you supply. Tokens are encrypted with AES-256-GCM before storage and used only for the actions you initiate. Standard revocation paths apply on each platform's settings page.
WhatsApp Business API and Telegram Bot API
If you connect WhatsApp Business or a Telegram bot as a content source, the access token is provided by you. We process incoming messages from groups you connect only to extract media you intentionally route through StreamLive Pro for publishing. We never read messages from groups you have not connected, and never share recipient lists outside of the publishing flow you trigger.
5a. Google API Services — User Data (Compliance with Google's Limited Use Policy)
StreamLive Pro's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
What Google user data we collect
- Profile (Google Sign-In): name, email address, profile picture, language preference, Google account ID. Used solely to create and authenticate your StreamLive Pro account.
- YouTube (when connected via OAuth 2.0): channel ID, channel title, broadcast/stream metadata, upload tokens. Scopes requested (minimum necessary):
https://www.googleapis.com/auth/youtube,https://www.googleapis.com/auth/youtube.upload. Only if you switch on replying to comments in the Comments inbox, we also ask forhttps://www.googleapis.com/auth/youtube.force-ssl, used only to post your reply (comments.insert), to hold a comment for review or remove it on your own video (comments.setModerationStatus) and to delete your own reply (comments.delete), each only when you click it. Without it, comments are only shown.
How we use Google user data
- Authenticate you into StreamLive Pro (Google Sign-In).
- Create live broadcasts, upload videos, and read public/owner analytics on your behalf — only when you explicitly trigger these actions in our dashboard.
- Display your channel name and avatar inside our app so you know which YouTube channel you are publishing to.
What we do NOT do with Google user data
- We do not sell, rent, or trade Google user data.
- We do not use Google user data to serve advertising or build advertising profiles.
- We do not use Google user data to train, fine-tune, or improve any generalized or third-party AI/ML model.
- We do not read, analyze, or share content from your private YouTube videos beyond what is required to perform the action you requested (e.g., publishing the video you uploaded).
- Human access to Google user data is restricted to: (a) you (the data subject), (b) operations engineers acting under your written request to debug your account, and (c) legal disclosures when required by valid legal process.
With whom we share, transfer, or disclose Google user data
We do not sell, rent, or trade Google user data, and we do not share it with any third party for that party’s own purposes. Google user data is disclosed only in the following cases:
- Back to Google — to perform the action you requested (for example, creating a live broadcast or uploading a video through the YouTube Data API).
- Infrastructure providers that host the data on our behalf, bound by written data-processing agreements and permitted to process it only on our instructions: Neon (managed PostgreSQL, EU — Frankfurt) stores your account record and OAuth tokens; Cloudflare R2 (US/global) stores media files you upload or record; Cloudflare Inc. provides CDN, DNS and DDoS protection and terminates TLS; Upstash holds transient background-job payloads. The full list is published at Sub-processors.
- Only if you enable an AI feature on that content — if you ask us to transcribe, translate, or caption a video, the audio or text of that video is sent to the provider that performs it (Groq, Anthropic, or Google Gemini) under contracts that prohibit using your content to train their models. This happens only for content you explicitly submit to that feature.
- Legal disclosure — when required by valid legal process, or to protect our rights, safety, or the safety of others.
- Business transfer — if StreamLive Pro is acquired or merged, data may transfer to the successor entity, which remains bound by this policy. You will be notified before any such transfer takes effect.
We do not transfer Google user data to advertisers, data brokers, or analytics companies, and we do not use it to build advertising profiles.
How we protect Google user data
Google user data — including OAuth tokens and any YouTube content you authorize us to act on — is protected by the following measures:
- Encryption in transit: TLS 1.3 on every connection, both between you and us and between us and Google. HSTS is enforced.
- Encryption at rest: OAuth tokens are individually encrypted by StreamLive Pro with AES-256-GCM before they are written to the database, so they are unreadable even to someone holding a copy of the database. The database, the object storage holding media, and all backups are additionally encrypted with AES-256 at the storage layer.
- Access control: data is isolated per account. No employee accesses your Google data in the ordinary course of business; access occurs only at your request to debug your own account, or where legally compelled. Administrative actions are recorded in a tamper-evident, hash-chained audit log.
- Minimum scopes: we request only the OAuth scopes needed for the features you switch on, and we do not request restricted scopes we do not use.
- Deletion: disconnecting a channel deletes its OAuth tokens immediately. Deleting your account erases your data within 30 days, apart from records we are legally required to keep (see Data Retention).
- Monitoring and response: automated error and health monitoring alerts our operations team in real time, and we notify affected users and regulators of a personal-data breach within 72 hours as required by GDPR.
Revoking access
You can revoke our access at any time from Google Account → Third-party apps with account access, or from inside StreamLive Pro at Settings → Connections → Disconnect. Upon revocation we delete the OAuth tokens immediately; cached profile fields are removed within 30 days.
5a-1. YouTube API Services — Required Disclosure
StreamLive Pro uses YouTube API Services. We access YouTube on your behalf exclusively through Google's official YouTube Data API, YouTube Live Streaming API and YouTube Analytics API, only after you grant explicit authorization via OAuth 2.0, and only to perform the actions you request (creating and managing live broadcasts, uploading videos and thumbnails, reading your channel name and avatar, and reading the viewer count and live chat of a broadcast you created through us). For the Analytics page we also read, with the same authorization, the videos of your own channel with their public numbers and the YouTube Analytics reports of your own channel (views, watch time, average view duration, shares, subscribers gained and lost, per day and per video), and show them only to you. We do not request the yt-analytics.readonly or monetary scopes.
- By using YouTube-powered features within StreamLive Pro, you agree to be bound by the YouTube Terms of Service.
- Google's use of your data is described in the Google Privacy Policy.
- Our use of YouTube API Services is also subject to the YouTube API Services Terms of Service and the YouTube API Services Developer Policies.
- YouTube data we store: OAuth tokens (encrypted), channel ID, channel name and avatar, metadata for the broadcasts/uploads you create through us, and — when the unified chat is in use — the live chat messages of that broadcast (the public author name, author ID and avatar, and the message text), retained for up to 30 days and then deleted automatically. For Analytics we also keep the title, thumbnail link, date and numbers of the videos of your channel; they are refreshed while you use Analytics and deleted within 24 hours after you disconnect the channel. We do not store the content of your private videos.
- Revoking YouTube access: at any time via Google security settings (or myaccount.google.com/permissions). Upon revocation, the YouTube authorized data we hold is deleted and any cached data is purged within 30 days at most.
- YouTube comments: when you allow it, the public comments on the recent videos of your channel are shown in your Comments inbox; a comment we have not re-read from YouTube for 30 days is deleted (see 5a-2).
- We do not use YouTube API data for advertising, profiling, or training AI/ML models.
5a-2. Comments inbox and reply suggestions
- What we read: only when a channel you connect allows it, the public comments on the recent videos, posts and live broadcasts of the channels and Pages you connect, whether or not they were published through StreamLive Pro (YouTube, Facebook Pages, Instagram, Threads, X, Bluesky, Mastodon): the commenter's public name, ID and profile picture, the comment text, its time and like count. We do not read TikTok or LinkedIn comments.
- Why: to show them in Analytics → Comments inbox, tag them (question / praise / complaint / spam — done on our own server, without AI), alert you about questions and negative comments if you choose, and count them in your statistics.
- Retention: a comment we have not re-read from the network for 30 days is deleted automatically. Disconnecting a channel removes its comments from the inbox at once and deletes them within 24 hours; deleting your account deletes them.
- Replies: a reply is posted on the network only when you press Send. Nothing is posted automatically.
- AI (optional): quick replies are templates and use no AI. Only when you click “AI options” or “Translate” is that one comment's text, with the post title, sent to Anthropic Claude (or Google Gemini as a fallback) to draft reply options or a translation. It is not used to train models.
5a-3. Podcast hosting, downloads and live alerts
When you create a podcast, its RSS feed, episodes and cover art are published the way you choose: public, unlisted (reachable by link only, marked so that directories and search engines do not list it) or private (not reachable). The owner email appears in the feed only after you verify it, because Spotify, Apple and the other directories send their ownership code there.
To count episode downloads we keep, per day, only a one-way keyed hash (HMAC) of the IP address, the app and the episode, plus the app name (for example Spotify). We do not store the IP address itself, and bots are not counted. The data is deleted with the podcast or the account.
"We are live" alerts are sent only to the Discord and Slack channels you connected and switched on yourself, once per broadcast.
To mark a podcast as connected to Apple Podcasts, Spotify or Podcast Index we look it up in their public directories by the podcast title and its public feed address only - no personal data. An API key you enter (for example an Apple Podcasts Connect key) is stored encrypted, never shown again and deleted with the podcast or the account.
5b. Sub-processors and Data Sharing — With Whom We Share, Transfer, or Disclose User Data
To operate StreamLive Pro we share strictly necessary data with the following sub-processors. Each is bound by a written Data Processing Agreement (DPA) and processes data only on our documented instructions. None of these parties receive Google user data for advertising, profiling, or AI-training purposes.
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| Google LLC (YouTube Data API) | Live broadcasts, video uploads to YouTube channels you connect | OAuth token, channel ID, video metadata you submit | USA (Google Standard Contractual Clauses) |
| Google LLC (Sign-In) | Authentication only | Your email + name returned by Google during sign-in | USA |
| Cloudflare, Inc. | Live video ingest (RTMP/WHIP), HLS playback, R2 object storage, edge CDN, DDoS protection | Live video bytes you broadcast, recordings, IP addresses | Global / USA |
| StreamLive Pro application server | Runs the web app, API and media processing | All data while it is processed; temporary media files | Israel (Tel Aviv) |
| Neon (PostgreSQL hosting) | Application database | User accounts, project metadata (encrypted at rest) | Frankfurt, Germany (EU) |
| Upstash (Redis) | Background job queue, rate limiting, caching | Transient job payloads | Frankfurt, Germany (EU) |
| Sentry | Error monitoring | Error stack traces, anonymized user ID (PII scrubbed) | Germany (EU) |
| Resend (email provider) | Transactional email (verification, password reset, billing receipts) | Your email address + the email body | USA |
| Licensed payment processor (see Subprocessors) | Card processing and subscription charges (PCI DSS) | Card details are entered on the processor's secure page and never reach our servers; we receive and keep only an encrypted token, the expiry date, the last 4 digits and card brand, plus transaction records. | Israel |
| EZcount | Invoices and receipts (Israeli tax documents) | Name, email, billing details, amounts | Israel |
| Groq, Inc. + Google AI (Gemini) | Speech-to-text (Whisper, via Groq) for uploads, clips and live captions; translation and audio-assisted transcript checks (Gemini) — only for content you submit to these features | The audio of the media you submit, transcripts and text to translate. Inputs and outputs are not used for model training under the provider terms. | USA |
| OpenAI (fallback only, when configured) | Fallback for transcription/translation when Groq/Gemini are unavailable | Audio chunks (transient), transcribed text. Not used for training per OpenAI API terms. | USA |
| Anthropic PBC (Claude) | Translation and caption polishing, suggested titles, descriptions and clips, comment-reply drafts, and the in-app support assistant — only when you use one of these features | Text only: transcripts, captions, titles, a comment you select, support questions. Not used for training under Anthropic's commercial terms. | USA |
| Meta (Facebook), TikTok, X (Twitter), LinkedIn, Twitch, Kick, Threads, Pinterest, Vimeo, Rumble, Dailymotion | Publishing/streaming to platforms you explicitly connect | OAuth token, video and post metadata you submit | Per each provider |
An up-to-date sub-processor list is maintained at /subprocessors. We notify users by email of any new sub-processor 30 days before activation; you may object during that window by replying to the notice.
We do not share, transfer, or disclose your data — including Google user data — to anyone other than the sub-processors listed above, except where required by valid legal process (court order, subpoena) or to protect the safety of users. In any such case we will, where lawful, notify the affected user.
5c. Who Is Responsible, Legal Bases and Regional Rights
Who is responsible for your data
The Service is operated by KIWI AI, a trade name of Aharon Liran Twito (אהרון לירן טויטו) (Israeli business (VAT) no. 204156848), 16 Bar Ilan St., Petah Tikva, Israel, the controller of your personal data and the database owner under the Israeli Protection of Privacy Law. Privacy questions: [email protected]; Data Protection Officer: [email protected].
Notice under the Israeli Protection of Privacy Law, 5741-1981
- You are under no legal obligation to give us information; doing so depends on your will and consent. Without a name, an email address and sign-in details we cannot open an account, and without payment details we cannot provide a paid plan.
- The information is used for the purposes in Section 3 and disclosed only to the recipients in Section 5b (sub-processors and platforms you connect) and as required by law.
- You have the right to inspect information about you (section 13 of the Law), to ask us to correct or delete information that is not accurate, complete, clear or up to date (section 14), and to be removed from a direct-mailing list (section 17F). Write to [email protected]. If we refuse a request we will tell you and explain why, and you may apply to the Privacy Protection Authority or to a court.
Legal bases for processing (GDPR)
- Performance of the contract — your account, streaming, publishing, editing, AI features you turn on, billing and support.
- Legal obligation — keeping billing records and handling authority requests and copyright notices.
- Legitimate interests — security, fraud and abuse prevention, error monitoring, improving the Service from aggregated data, and service emails. You can object to this processing.
- Consent — marketing email to people who are not customers, and any processing for which we ask for your explicit consent. You can withdraw consent at any time.
AI and automated decisions
AI features work only on content you submit to them, which is sent to these providers: Groq (transcription), Anthropic Claude and Google Gemini (translation, text polishing and suggestions), and OpenAI only as a configured fallback. The providers may not use the content to train models. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing; comment tagging uses simple rules on our own server, without AI.
Minimum age
The Service is for people aged 16 and over (under 18 with a parent's or guardian's consent) and is not directed at children. We do not knowingly collect data about children under 16; if we learn that we have, we delete the data and the account.
Account, billing and security emails go to every user. Marketing email is sent only to people who agreed to receive it, or to customers about services similar to those they bought; it is marked as advertising, identifies the sender, has an unsubscribe link, and you can stop it at any time with that link or in your account settings. The weekly summary is a report about your own account and can be turned off in settings.
California residents (CCPA/CPRA)
We do not sell personal information and we do not "share" it for cross-context behavioural advertising. The categories of personal information we collect, their sources and purposes are described in Sections 2 and 3, and retention periods in Section 8. You have the right to know what we collect about you, to ask us to correct and delete it, and not to be discriminated against for exercising these rights. You or an authorised agent can write to [email protected]; we answer within 45 days.
6. Your Rights
At any time, you have the full right to:
- Access — See what data we have about you (via Account Settings → "Download my data")
- Rectification — Correct inaccurate data
- Erasure — Delete your account and all data (via Settings → "Delete account")
- Portability — Receive your data in JSON/CSV format for export
- Restriction — Restrict data processing to specific purposes
- Objection — Object to certain data processing
- Complaint — File a complaint with the data protection authority in your jurisdiction; in Israel, the Privacy Protection Authority
- Withdraw consent — Where processing is based on consent (for example marketing email), withdraw it at any time, without affecting processing that took place before
To exercise a right, use the tools in your account settings or write to [email protected]. We verify your identity (usually through the account email address) and answer within 30 days. Rights under the Israeli Protection of Privacy Law and California law are described in Section 5c.
7. Security
- In transit: all traffic is encrypted with TLS 1.3. HSTS is enforced and HTTP is redirected to HTTPS.
- At rest: OAuth tokens for your connected channels are encrypted with AES-256-GCM by the application before storage. Our database (Neon) and object storage (Cloudflare R2) additionally encrypt stored data with AES-256 at the storage layer, and backups are encrypted and stored separately.
- Passwords: hashed with bcrypt (12 rounds). We never store a password in a readable form.
- Access control: customer data is isolated per account (multi-tenancy); no employee accesses your content in the ordinary course of business. Administrative actions are written to a tamper-evident, hash-chained audit log.
- Monitoring: automated error and health monitoring with real-time alerting to our operations team.
- Least privilege: we request the minimum OAuth scopes required for the features you enable, and we delete platform tokens as soon as you disconnect a channel.
8. Data Retention
We keep information only as long as it is needed for the purpose it was collected for:
- Your account and content — while the account is active. When you delete your account, access is blocked immediately and for 30 days (a grace period) you can cancel the deletion by signing in again; after that the account and all of its data are permanently deleted (/data-deletion).
- Media files after a paid subscription ends — deleted 30 days after the subscription ends, after email reminders. The account itself stays.
- Comments in the Comments inbox — a comment we have not re-read from the network for 30 days is deleted automatically; disconnecting a channel deletes its comments within 24 hours.
- Numbers read from your connected accounts for Analytics (posts, videos and their statistics) — refreshed regularly; removed within 24 hours after you disconnect the account or switch it off in Analytics; items older than 400 days are deleted.
- Live chat and viewer statistics of a broadcast — up to 30 days.
- Tokens of connected networks — deleted immediately when you disconnect.
- Sign-in sessions — 30 days; in-app notifications and broadcast performance data — 90 days; recording and device audit log — 1 year.
- Invoices and billing records — 7 years (required by tax law).
- Records of copyright notices and abuse reports — as long as needed as evidence or required by law.
- Encrypted backups — deleted on a cycle of up to 30 days; technical and security logs — up to 90 days.
- Aggregated, anonymous statistics (that do not identify anyone) — without a time limit.
9. Cookies
We use three kinds of cookies and local storage: those needed to run and secure the site, our own first-party measurement, and third-party advertising and analytics tags – only if you accepted them in the cookie banner. You can change your choice at any time with the "Cookie settings" link below.
csrf_token— protection against cross-site request forgery (CSRF); 12 hours.auth_token— keeps you signed in for some dashboard features; up to 30 days, or until you sign out.- Cloudflare cookies (for example
__cf_bm, and Turnstile cookies on sign-up) — protection against bots and attacks. - Browser local storage (localStorage) — your language choice, sign-in token, display preferences and your cookie choice (
slp_consent). It stays on your device.
Our own measurement (first party). To know where visitors come from (for example an ad, a search or a link) we count page views and keep the traffic source: slp_vid (a random browser ID, 1 year), slp_ft (first source, 180 days) and slp_lt (last source, 30 days). This stays with us, is not shared, and is used only for statistics and to attribute a sign-up to the campaign that brought it. Visitors from the EU, EEA and UK get these only after consent.
Advertising and analytics tags (consent only). If you accept, the site loads tags from providers such as Google (Analytics, Ads, Tag Manager), Meta (Facebook/Instagram), TikTok, Microsoft Clarity, LinkedIn and Pinterest, which set their own cookies under their own policies. When an account is created, a trial starts or a payment is made, we may report that event to these providers from our server (for example the Meta Conversions API and the TikTok Events API), together with your hashed (SHA-256) email address and phone number, IP address, browser details and the ad click ID (for example the _fbc cookie, 90 days, set when you arrive from a Meta ad), to measure advertising performance. Our marketing service provider may also receive the event, with the email hashed only. If you chose "Necessary only", we do not report you to these providers. We do not sell personal information.
The site's fonts are loaded from Google Fonts, so when a page loads your IP address and browser details are sent to Google. If you play an embedded third-party player (for example YouTube), that provider may set its own cookies under its own policy. You can block cookies in your browser settings, but signing in will not work without them.
10. International Transfers
Your data is processed in three countries: Israel — our application server (Tel Aviv), payment processing and invoicing (EZcount); Germany — our database (Neon Postgres) and job queue (Upstash Redis) in Frankfurt, and error monitoring (Sentry, EU — Germany); United States — Cloudflare (CDN, R2 storage and Stream live video, global/US), AI providers (Groq, Anthropic, Google Gemini; OpenAI only as a configured fallback) and email (Resend). Transfers from the EU to Israel rely on the European Commission's adequacy decision for Israel; transfers to the United States use EU Standard Contractual Clauses (SCCs). The full list is at Sub-processors. Transfers of data from Israel abroad follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001.
11. Changes to This Policy
If we update this policy, we will notify you by email 30 days in advance and update the date at the top of this document.
12. Contact
Privacy questions? [email protected]
Data Protection Officer: [email protected]