Privacy Policy

1. Controller & joint responsibility

The controller under GDPR is the operator named in the imprint. For creator-controlled features (giveaways, community prizes, streamstats, Bot Protection), the respective creator decides about channel, rules, blocklists, and imports. StreamWizard provides the technical platform; the creator informs viewers in the channel/community context about data processing.

2. Legal bases

• Art. 6(1)(b) GDPR – performance of contract (account, license, Premium/VIP/Diamond, downloads, bot operation).
• Art. 6(1)(c) GDPR – legal obligations (e.g. accounting, retention).
• Art. 6(1)(f) GDPR – legitimate interests (security, abuse prevention, license enforcement, technical logs, selected Trustpilot invitations).
• Art. 6(1)(a) GDPR and § 25(1) TDDDG – consent (e.g. the optional reach measurement with Google Analytics and the loading of external media such as embedded images/streams from third-party sources – both only after your consent in the cookie banner).
• Art. 6(1)(a) GDPR and § 25(1) TDDDG – consent for advertising via Google AdSense (only after consent to the “Marketing” category in the cookie banner and in the Google consent dialog, see section 9). We do not rely on legitimate interests for advertising.

3. Which data – by application

a) Discord login & account
Via Discord OAuth: Discord ID, username, avatar URL, and – if transmitted – email. Internal: rank, activation status, license linkage. Sensitive identifiers are stored in the enc/hash model (HMAC-SHA-256 for lookup, AES-256-GCM for reversible values).

b) Session, API key, downloads
Technically required session cookie (PHPSESSID). One API key per account for protected downloads/API. Signed one-time download links for support and dashboard flows.

c) StreamWizard OBS plugin (24/7 stream operation)
Configuration data (playlist paths, scene/source names in OBS, Twitch/Kick connection).

d) Giveaway system: giveaways
Creator data: campaign title, ticket/point rules, sub-tier bonuses, channel slug, response templates (encrypted). Viewer data (also without StreamWizard account): Twitch user ID, login, display name in enc/hash model + technical counters (point balance, tickets, watchtime, winner rank). Twitch chat purchases only when the stream is reported online; chat content is not stored, only command triggers. On a draw, the winner display name may be announced in the creator's Twitch chat (creator setting).

e) Giveaway system: community prizes
Submissions via Discord forum or !einreichen: Discord owner ID (hash + encrypted), display name (encrypted), thread ID (hash + encrypted), prize description (encrypted). Separate weekly participant list (tickets, Twitch login in enc/hash model). Winner tracking with drawn_at/claimed_at. Weekly reset on Sundays.

f) Giveaway system: streamstats
Creator Twitch connection (encrypted tokens, scopes). Aggregated viewer counters: watchtime seconds, chat message count (no content), bits, gift subs. Ignore lists maintained by the creator. Streamstats is available only after admin entitlement; no team/delegate sharing.

g) Bot Protection
Optional protection feature against bot/spam accounts in the giveaway system. The creator maintains a block list of Twitch login names (stored encrypted or as a hash). For listed names, no new points/stars, watchtime, or bonuses are credited in the giveaway (points accrual is frozen); the existing balance is preserved unchanged – nothing is set to 0 and nothing is deleted. Viewers with a genuine monetary contribution (active sub, bits, or gifted subs) are exempt from the freeze and keep earning normally. We process only the names entered by the creator (enc/hash) and technical run metadata (timestamp, number of checked entries). There is no StreamElements integration, no JWT, and no access to third-party loyalty/points systems. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in defending against bot, multi-account, and abusive participation in the creator's giveaway). Giveaway points and tickets are free participation values with no monetary value and no claim to payout.

h) Central Discord runtime & token bridge
Discord features for the OBS plugin and the giveaway workers run via our central runtime (StreamwizardNode). This processes the Discord server, channel, and message ID, the Discord ID of the triggering account, and the command name plus the arguments required for that command. Handover to our server is HMAC-SHA-256 signed and protected against replay (narrow time window), duplicate delivery (dedupe per event ID), and overload (rate limits per user, server, and channel); on failure the request is denied, not passed through. Commands containing an OAuth code are accepted only from the linked Discord account, and the message carrying the code is deleted automatically in the server channel. The Twitch/Kick OAuth code exchange runs via the token bridge on our server: system client secrets never leave the server, and the platform response is returned hybrid-encrypted (RSA-OAEP + AES-256-GCM) to the requesting instance. Credentials a worker needs in order to operate are additionally delivered AES-256-GCM encrypted.

i) Team delegates
A license holder can invite other accounts as delegate for dashboard moderation (owner/delegate ID, token hash, creation/expiration/revocation time, optional note). Delegates receive no license and no download. For their own mod tools, delegates or licensed owners may create a personal Team API key; only the key hash, display hint, creation/use/revocation time are stored. The key allows only capped read access to shared viewer and Giveaway data and becomes ineffective when team access is revoked. Invitation valid for 7 days, one-time use; max. 5 active delegates per owner.

j) Payment & Trustpilot
Payment via Stripe (Premium, VIP, Diamond, licenses). Stripe processes payment data as its own controller. We store Stripe customer/subscription IDs, status, tier (authoritative), timestamps. Optional: transactional review invitation via Trustpilot after a successful purchase (Art. 6(1)(f) GDPR). You can object to this review invitation already at checkout (opt-out); in addition, every invitation contains an unsubscribe link.

k) Live translation (CaptionBridge)
CaptionBridge runs locally on the creator's streaming PC and converts the stream audio into captions via speech recognition. Transmitted to StreamWizard: caption text segments, detected source language, timestamps/duration, and a hashed ingest token; optionally the Twitch channel ID as a hash only for mapping. Captions are buffered only briefly (retention configurable by the creator, default 20 minutes, max. 240) and then deleted automatically. Translation uses the creator's OWN API key with the chosen provider (Anthropic Claude, OpenAI, DeepL, or Google Gemini); for this the caption text is transmitted to that provider, which processes it as its own controller under its own terms. API keys are stored encrypted (AES-256-GCM) and released to the translator worker only for concrete translation jobs. Translated captions are shown to viewers via the Twitch extension per language; only aggregated language counters are stored, no viewer identity. The feature is available only after admin entitlement; on revocation the service is refused immediately. All live translation data can be deleted in the dashboard.

l) Cancellation button
When using the cancellation button, we process name, email address, contract/service details, requested cancellation date, optional identifiers, a reason for extraordinary cancellation, receipt time, and an anonymized IP bucket to receive, assign, confirm, and document the cancellation. The declaration is sent to the internal support mailbox through the configured mail infrastructure; a receipt confirmation is sent to the provided email address. The data is retained until processing is complete and as required for statutory evidence.

m) Contact form in the imprint
Via the contact form on the imprint page we process your name, email address, the selected product, subject, and message text (up to 5,000 characters). The sole purpose is handling and answering your request. The message is not stored in our database; it is sent through the configured mail/SMTP provider to our support mailbox (support@streamwizard.de), with your email address set as the reply address. A rate limit based on an anonymized IP bucket protects against abuse. The legal basis is Art. 6(1)(b) GDPR where the request concerns or initiates a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries), plus the consent you give on the form under Art. 6(1)(a) GDPR. The correspondence is deleted once the request has been finally handled, unless a statutory retention obligation applies.

n) Public bug report
On the public giveaway pages the footer offers a "Report bug" button. We process the summary and description you enter, an optional contact detail (Discord, Twitch, or email), the address of the reported page, the identifier of the associated creator, the time, and an anonymized IP bucket. The report is not stored in our database; it is written through the Discord API into an internal channel of our Discord server, which makes Discord a recipient of your details as the operator of that platform. The report stays there until we delete it. The purpose is fault analysis and – if you provide a contact detail – following up with you; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a defect-free service). Contact details are optional; without them we cannot follow up. Please do not put anything into the description that is not needed to find the fault.

3a. Supporter wall

• Only the details you have chosen yourself are published on the supporter wall: either nothing (anonymous) or the Twitch username linked to your account. No profile picture is shown on the wall.
• The legal basis for publication is your consent under Article 6(1)(a) GDPR. The default is "anonymous"; a mention only occurs after active selection.
• You can withdraw your consent at any time in the dashboard. The entry then disappears from the wall; the name is removed from the publicly visible data. The lawfulness of publication up to that point remains unaffected.
• The payment transaction itself (amount, time, Stripe references) is stored separately as an accounting record. Retention follows commercial and tax law periods (section 147 of the German Fiscal Code, up to ten years) and is exempt from deletion requests to that extent.

4. Security logs

Security-relevant API/runtime events are logged in a structured way (JSON Lines with secret redaction). IP addresses are NEVER logged in clear text, only as subnet bucket (IPv4 /24, IPv6 /64). Rate limits protect security-critical endpoints; HTTP 429 on exceedance.

5. Third-party services

• Configured mail/SMTP provider: delivery of support, transactional, and legally required receipt confirmations. The service is used only for the respective delivery.
• Hosting provider (server location Germany/EU): operation of servers, database, and backups as well as technical server/access logs for service provision and security of the website. Processing is carried out on our instructions as a processor under a data processing agreement pursuant to Art. 28 GDPR; no transfer to third countries.
• Discord, Twitch, Kick: login/OAuth, API integrations for the respective bot features. We additionally transmit the content of bug reports, including any optional contact detail, to Discord, because these reports are written into a channel of our Discord server. On public giveaway pages, a Twitch stream player is loaded only after your explicit click ("Load Twitch stream"); before that there is no connection to Twitch and no Twitch cookies are set.
• Stripe (Stripe Payments Europe, Limited): payment processing for paid offers.
• YouTube: retrieval of public channel data (video list, titles, duration) through the YouTube Data API and playback via the official embedded player. No sign-in, no user tokens, no video files on our servers.
• Trustpilot: optional review invitation after purchase.
• Google AdSense (Google Ireland Limited) and the advertising partners listed in the Google consent dialog (IAB TCF): delivery and measurement of ads on selected information pages – only with consent. Google acts as an independent controller for ad delivery.
• StreamElements: only if initiated by the creator as an import source.
• Anthropic (Claude), OpenAI, DeepL, Google (Gemini): translation of live captions – only if the creator provides their own API key; the provider processes as its own controller.

The privacy notices of the respective providers additionally apply. Some providers process data in the USA or other third countries – in particular Anthropic (Claude), OpenAI, and Google (Gemini). For live translation the creator uses their OWN API access with the chosen provider; to that extent the creator decides on and is responsible for the legal basis of this third-country transfer, and StreamWizard transmits the caption text to the provider chosen by the creator solely on the creator's documented instruction. Where StreamWizard itself transfers data to third countries, we base this on EU standard contractual clauses (Art. 46 GDPR), certification under the EU-US Data Privacy Framework, or equivalent safeguards. We provide information about the safeguards used on request.

6. Retention & deletion

• Account and license data: for the duration of active use; after account deletion immediately, unless legal retention applies.
• Abuse protection for the 7-day Premium trial: if a trial was started for your account or there is payment or subscription history, we store a keyed hash of your Discord ID (HMAC-SHA-256 with a secret server key) and the time – nothing else, in particular no name, no email address and no account ID. The entry is kept even after an account deletion and serves only to prevent the same Discord account from starting the trial again. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing repeated use of the free trial). The entry is deleted automatically three years after the last event (trial start or account deletion).
• Accounting-relevant payment data: per §147 AO/§257 HGB (typically 10 years).
• Security logs (IP bucket, event metadata): up to 90 days rolling.
• Backup queue: individual control commands, max. 15 min unprocessed; confirmed entries are deleted.
• Giveaway data: until admin entitlement is revoked or account deletion; viewers can request deletion on the public giveaway page. When the licence ends (cancellation, expiry or end of the 7-day trial), data is kept unchanged for 90 days and then deleted automatically – this covers tickets, point balances, winners and winner history, viewer and follower lists, as well as created giveaways, chat commands and profile links.
• Live translation: caption segments only briefly (default 20 min, max. 240) with automatic deletion; configuration, API keys, and token until revocation, deletion in the dashboard, or account deletion.

7. Your rights

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20).
• Objection to processing based on legitimate interests (Art. 21 GDPR).
• Withdrawal of given consents with effect for the future (Art. 7(3) GDPR).
• Complaint to a supervisory authority, e.g. the Hessian Commissioner for Data Protection and Freedom of Information.

You can export and delete account-owned data in the dashboard. After Twitch login on the public giveaway page, viewers can export their stored data or request deletion for the respective creator.

8. Security measures (excerpt)

• TLS 1.2+ with HSTS preload; at-rest encryption of sensitive fields via AES-256-GCM; lookups via HMAC-SHA-256.
• Strict CSP (nonce), clickjacking protection, Permissions-Policy with FLoC/Topics opt-out, CSP reporting only as IP bucket.
• OAuth state + PKCE (Kick); session ID rotation after login; same-origin/CSRF protection on sensitive actions.
• Stripe webhook signatures (HMAC) with replay window and idempotency; outbound calls only HTTPS with certificate verification.
• Coordinated Vulnerability Disclosure: /.well-known/security.txt.

9. Cookies, reach measurement & advertising

Technically necessary cookies (session, CSRF) are always set; they are required for login, session, and security (Art. 6(1)(f) GDPR, § 25(2) TDDDG). We do not set advertising cookies or advertising tags.

Optionally, we use Google Analytics (Google Tag / GA4, provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for anonymized reach measurement. Google Analytics is loaded only after your explicit consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG) and remains disabled without consent. We use IP anonymization (anonymize_ip), no Google signals, no ad personalization, and no ad remarketing. The cookies are set with SameSite=Lax and Secure. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. This may involve a transfer to Google in the USA; we base this transfer on the EU standard contractual clauses or Google's certification under the EU-US Data Privacy Framework.

Access statistics from server log files

From the server log files that are created anyway when the website is accessed, we compile our own access statistics (number of page views, number of distinct visitors, most visited pages, referring domain, device type). No cookies are set, no script runs in the browser, and no data is transferred to third parties; the analysis runs exclusively on our server. To count visitors without counting them twice, we create a cryptographic hash value from the IP address (for IPv6 only the /64 network) and the browser signature using a secret key; the IP address itself is not stored for this purpose. We delete these hash values after 35 days at the latest; afterwards only totals without personal reference remain. They are not combined with accounts, profiles, or other data. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in measuring reach and in a stable offering that meets demand). You can object to this processing under Art. 21 GDPR; contact us using the details in the imprint.

Advertising (Google AdSense)

On selected information pages we show advertising via Google AdSense (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). There is no advertising on public creator profiles, in overlays, in the checkout and login flow, on legal pages, and for accounts with paid access or a running trial. Google acts as an independent controller for selecting and delivering the ads.

Consent in two steps: the AdSense script is only loaded after you consent to the “Marketing” category in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without this consent no advertising script is loaded and no advertising cookies are set. After consenting, Google shows its own consent dialog based on the IAB Transparency & Consent Framework (TCF). There you can accept, decline or choose individual purposes and advertising partners; the partners are listed in the dialog under “List of partners”. We do not base advertising on legitimate interests. If you decline in the Google dialog, no personalized ads are shown.

Data processed and retention: Google and the advertising partners may use cookies or similar technologies (e.g. __gads, __gpi, IDE) and process device and usage data (e.g. IP address, browser and device information, page visited, interactions with ads) to deliver ads, measure their performance, prevent fraud and – with consent – personalize ads. Your choice in the Google dialog is stored in a cookie (TC string). Google determines the retention period of advertising cookies; according to Google it is usually up to 13 months.

Withdrawal and third countries: via “Cookie settings” in the footer you can deselect the “Marketing” category at any time with effect for the future; after that no advertising script is loaded. You can change your choice in the Google dialog via the privacy settings link shown by Google. This may involve a transfer to Google in the USA, based on the EU standard contractual clauses or the Google certification under the EU-US Data Privacy Framework. More information: https://policies.google.com/technologies/ads

10. Changes & contact

We may update this privacy policy when features or legal requirements change. The version published here is authoritative. Questions: support@streamwizard.de.

Version date: 2026-10-13