Privacy Policy

Introduction

Streamcentives, Inc. ("Streamcentives," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile applications, and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this policy, please do not use our Service.

1. Information We Collect

1.1 Personal Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, username, password, and profile photo when you create an account
• Profile Information: Bio, location, social media links, creator type, and preferences
• Content: Posts, comments, messages, media files, and other content you submit
• Communications: Emails, support requests, and feedback you send us

1.2 Information Collected Automatically

When you use our Service, we automatically collect:

• Usage Data: Pages visited, features used, time spent, click patterns, and engagement metrics
• SP and Activity Data: Experience points earned, campaigns completed, rewards redeemed
• Device Information: Device type, operating system, browser type, unique device identifiers
• Network Information: IP address, approximate geographic location, internet service provider
• Cookies and Tracking: See our Cookie Policy for details

1.3 Information from Third Parties

Streamcentives utilizes official third-party Application Programming Interfaces (APIs) including the YouTube API Services, Spotify Web API, and Kick Developer Services to retrieve public creator metadata, live status attributes, and track configurations. By connecting your accounts or interacting with these surfaces on our platform, you explicitly agree to be bound by the YouTube Terms of Service, the Spotify Terms of Service, and the Kick User Agreement.

• YouTube: Channel data and public video statistics (via YouTube API Services)
• Spotify: Artist ID, public streaming data, and track information (via Spotify Web API)
• Kick: Channel handles, live status, and public stream metrics (via Kick Developer Services)
• Google: Basic profile information when using social login

1.4 Google User Data (YouTube API Services)

When you choose to connect a Google/YouTube account, Streamcentives accesses, with your explicit consent, your channel identity (channel ID, name, thumbnail) and, where you have granted the read-only YouTube scope, your own subscription list. We use this data solely to display your connected account and your own YouTube information back to you inside Streamcentives. We do not use YouTube data to award StreamPoints, rank users, build advertising profiles, or derive engagement metrics, and we do not incentivize or reward watching, liking, commenting on, sharing, or subscribing to YouTube content. With your consent, we record which videos you choose to watch inside Streamcentives to power your own activity feed and personal top-creator stats — never for points, rankings, or advertising — and you can turn this off at any time with the "Track my YouTube watching" setting on the watch screen.

Streamcentives' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, transferred to third parties (including advertisers or data brokers), or used for purposes beyond the user-facing features described above.

You can disconnect your Google/YouTube account at any time in Settings → Connections, which deletes our stored tokens, or revoke Streamcentives' access directly at myaccount.google.com/permissions. You may also request deletion of all Google user data we hold by contacting support@streamcentives.io; we honor such requests within 30 days.

1.5 SMS / Text Messaging

By entering your phone number and requesting a verification code in the Streamcentives app, you consent to receive account-related text messages from Streamcentives (verification codes and account security alerts). Separately, and only if you check the optional opt-in box in the app (it is never pre-checked), you may also receive rewards-reminder texts — such as unspent StreamPoints balances, rewards you can redeem, and tier milestone updates. Promotional consent is optional and not a condition of any purchase. Message frequency varies based on your account activity. Message and data rates may apply. Mobile phone numbers collected for SMS are not shared with or sold to third parties for their marketing purposes. Reply STOP to opt out at any time, or HELP for help. You can also uncheck the rewards-texts box or remove your number in the app under Edit Profile. Our SMS consent flow is documented at streamcentives.io/sms-opt-in.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Service Provision

• Create and manage your account
• Calculate and award SP that you earn by watching and engaging with creators
• Facilitate connections between creators, fans, and sponsors
• Enable participation in campaigns, events, and communities

2.2 Personalization and Improvement

• Personalize your experience and content recommendations
• Analyze usage patterns to improve our Service
• Develop new features and functionality
• Conduct research and analytics

2.3 Communications

• Send transactional notifications (account updates, SP changes, reward redemptions)
• Deliver marketing communications (with your consent)
• Respond to your inquiries and support requests
• Notify you of policy changes or security incidents

2.4 Safety and Compliance

• Detect, prevent, and address fraud, abuse, or security issues
• Enforce our Terms and Conditions and other policies
• Comply with legal obligations and respond to legal requests
• Moderate content using AI-assisted and human review processes

3. Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Service to you (account management, transactions, core features)
• Consent: When you have given explicit consent for specific processing activities (marketing emails, optional data sharing)
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, security, and service improvement, balanced against your rights
• Legal Obligation: Processing necessary to comply with applicable laws and regulations

You may withdraw your consent at any time where we rely on consent for processing. This will not affect the lawfulness of processing before withdrawal.

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 With Creators and Sponsors

When you engage with creator campaigns or sponsor offers, we share relevant engagement data such as:

• Leaderboard rankings and SP earned in their campaigns
• Aggregated and anonymized fan engagement metrics
• Campaign participation status and completion data

We do not share your email address or personal contact information without your explicit consent.

4.2 With Service Providers

We work with trusted third-party providers who process data on our behalf:

• Supabase: Database hosting and authentication
• Vercel: Website hosting and deployment
• Analytics Providers: Usage tracking and performance monitoring
• 100ms: Live streaming infrastructure

These providers are contractually bound to protect your data and may only use it for the services we have engaged them for.

4.3 For Legal Reasons

We may disclose information if required by law or to:

• Comply with legal process, court orders, or government requests
• Protect our rights, property, or safety
• Prevent fraud, security threats, or illegal activities
• Enforce our Terms and Conditions

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or uses of your personal data.

4.5 Public Authority Data Requests

Streamcentives vigorously reviews all government, national security, or public authority data requests for strict legal validity before disclosing any Platform Data.

• Formal Challenge Policy: If any data request lacks proper judicial authorization, contains jurisdictional defects, or violates user privacy rights under applicable law, Streamcentives maintains a formal policy to legally challenge, narrow, or appeal the request before disclosing any information.
• Narrowing: Where possible, we will seek to narrow the scope of any request to only the information strictly required.
• Documentation: All disclosures in response to legal requests are documented internally for compliance and audit purposes.

4.5.1 User Notice & Transparency Procedure

We believe affected users have a right to know when a government or other public authority demands their data. Our standing user-notice procedure is:

• Default to Notice: Unless we are legally prohibited (e.g., by a statutory gag order, sealed court order, or a narrowly tailored emergency exception), we will notify the affected user before disclosing any Platform Data in response to a government, law-enforcement, or public-authority request.
• Notice Timing: Where pre-disclosure notice is possible, we will provide it with sufficient lead time (typically no less than ten (10) business days) for the user to seek legal counsel or a protective order. Where pre-disclosure notice is prohibited, we will provide notice promptly after the legal prohibition expires, lapses, or is lifted.
• What the Notice Contains: A copy or summary of the legal process received, the categories of data requested, the requesting authority and jurisdiction, the date of disclosure (if any), and the legal basis we relied on.
• Delayed Notice: If we are subject to a non-disclosure order, we will challenge or seek to time-limit that order where lawful and appropriate, and will notify the user as soon as the restriction ends.
• Emergency Disclosures: In good-faith emergency disclosures (e.g., risk of death or serious bodily harm), we will provide notice to the affected user after the emergency has been addressed, unless prohibited by law.
• Annual Transparency Reporting: Streamcentives will publish an annual transparency report summarizing the number and types of government data requests received, the number challenged or narrowed, the number complied with, and the number of users notified.
• Contact: Legal process and questions about this procedure can be directed to legal@streamcentives.io.

5. AI and Machine Learning

We use artificial intelligence and machine learning technologies to:

• Content Moderation: Automatically detect and flag potentially harmful content
• Recommendations: Suggest creators, campaigns, and content based on your interests
• Fraud Detection: Identify suspicious activity and prevent SP manipulation
• Content Generation: Power AI-assisted creative tools (optional features)

Automated decisions are subject to human review, especially for content moderation actions that may affect your account.

6. Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to enhance your experience, analyze usage, and provide personalized content. For detailed information about the types of cookies we use and how to manage your preferences, please see our Cookie Policy.

You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect Service functionality.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Row-level security policies on database tables
• Regular security assessments and monitoring
• Access controls and authentication requirements
• Secure payment processing through PCI-compliant partners

While we strive to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your personal information for as long as necessary to:

• Provide the Service and maintain your account
• Comply with legal obligations (e.g., tax records, fraud prevention)
• Resolve disputes and enforce our agreements
• Fulfill the purposes described in this policy

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes.

9. Your Privacy Rights

9.1 Rights for All Users

All users have the right to:

• Access and update your personal information through account settings
• Delete your account and associated data
• Opt out of promotional communications

9.1.1 How to Request Data Deletion

We provide multiple compliant pathways to permanently delete your account and the personal data we hold about you, in accordance with GDPR Art. 17 ("right to be forgotten"), CCPA/CPRA, the Apple App Store Review Guidelines (§5.1.1(v)), and Meta's Platform Terms (Data Deletion Callback requirement).

• In the app: Settings → Account → Delete Account. After password confirmation, your account is deleted immediately.
• Public web form: visit https://streamcentives.io/data-deletion — works whether or not you are signed in. You will receive a reference confirmation code.
• From Meta / Instagram: removing the Streamcentives integration in your Facebook or Instagram app settings automatically calls our Data Deletion Callback, which deletes all data we received from Meta.
• By email: privacy@streamcentives.io

What is deleted: account credentials, profile, posts, comments, messages, stories, live-stream chat, SP balances, unredeemed rewards, connected service tokens (Spotify, Apple Music, YouTube, Twitch, Kick, Instagram), and uploaded files (avatars, logos, media).

What is retained: financial and tax records, fraud-investigation logs, and anonymized aggregate analytics are retained only for the period required by applicable law (typically up to 7 years for financial records).

Turnaround: deletion is initiated immediately upon a verified request and completes within 30 days.

Meta Data Deletion Callback URL: https://fuoefkfekhzhlsblloal.supabase.co/functions/v1/meta-data-deletion-callback

9.1a Third-Party Data Deletion, Cache Control, & Revocation

We strictly respect your data autonomy. Users may instantly revoke Streamcentives' access to their data at any time via the Google Security Settings page (https://myaccount.google.com/permissions) or their respective Spotify and Kick account connection panels. In compliance with developer policies, Streamcentives executes a strict caching limit: public creator metadata, avatars, and stream metrics are cached temporarily in our private database for a maximum of 4 hours to ensure network efficiency. Upon explicit user account deletion or third-party access revocation, our automated backend processes execute a permanent, non-recoverable purge of all associated cached third-party profile fragments and metadata fields within 30 days.

9.2 Additional Rights for EEA/UK Users (GDPR)

If you are in the European Economic Area or United Kingdom, you also have the right to:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limitation of processing
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time
• Lodge Complaint: File a complaint with your local data protection authority

We will respond to verified requests within 30 days. Complex requests may take up to 90 days with prior notice.

9.3 Rights for California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of personal information collected, used, and shared
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information
• Right to Limit: Limit use of sensitive personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights

Do Not Sell or Share My Personal Information: We do not "sell" personal information as defined by the CCPA. If our practices change, we will provide clear notice and an opt-out mechanism.

To exercise your rights, contact us at privacy@streamcentives.io or use the account settings. We may verify your identity before processing requests.

10. International Data Transfers

Streamcentives is based in the United States. Your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

For transfers from the EEA, UK, or Switzerland to countries without adequate data protection laws, we use appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data processing agreements with service providers
• Binding Corporate Rules where applicable

11. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children under these ages.

If we discover we have collected information from a child under the applicable age, we will delete it immediately. If you believe a child has provided us with personal information, please contact us at privacy@streamcentives.io.

For Creators and Sponsors: Users must be at least 18 years old to access creator or sponsor features that involve financial transactions or contractual agreements.

12. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee compliance with data protection laws. You can contact our DPO at:

• Email: dpo@streamcentives.io
• Address: Streamcentives Data Protection Officer, [Company Address]

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email or prominent notice on our Service
• Provide at least 30 days' notice before changes take effect (for material changes)

Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@streamcentives.io
• General Inquiries: support@streamcentives.io
• Data Protection Officer: dpo@streamcentives.io
• Mailing Address: Streamcentives, Inc., [Company Address]

We aim to respond to all inquiries within 30 days.

Related Policies

10. Third-Party Service Providers

Streamcentives relies on the following processors and APIs to operate the Service. Each is bound by its own privacy policy; we share only the minimum data required for the function listed.

• Stripe — payment processing, escrow holds, payouts, refunds, tax forms. Receives: name, email, payment details, transaction metadata. Policy
• Apple Music (MusicKit API) — reads your listening history to convert plays into StreamPoints. Receives: Apple Music user token, listen events. Policy
• Spotify (Web API) — reads recently-played and now-playing data for point conversion. Receives: Spotify OAuth token, listen events. Policy
• Meta / Instagram (Graph API + Webhooks) — receives reshare/mention events to credit StreamPoints, and processes deauthorization & data-deletion callbacks. Receives: IG user id, media id, mention events. Policy
• YouTube Data API — reads your channel identity and subscriptions to power your activity feed and personal stats. YouTube activity never earns rewards or points. Policy
• Kick — counts follows and watch sessions for engagement rewards.
• Twitch (Helix API + EventSub) — counts follows, subs, and watch events. Policy
• Supabase — primary backend (auth, database, storage, edge functions). Receives: all account data necessary to operate the Service. Policy
• RevenueCat — manages iOS in-app purchases. Receives: app user id, purchase receipts. Policy
• Lovable AI Gateway — proxies AI model requests for Muse, content moderation, and discovery suggestions. Receives: prompt content only.

We do not sell your data. You can revoke any third-party connection from Settings → Connections at any time.