Privacy & Data Processing Policy

Last Updated: July 9, 2026

Privacy and Data Processing Policy of ArcanaStream

This Policy explains how ArcanaStream collects, uses, stores, and discloses personal data when you visit arcanastream.io or arcanastream.com, create an account, purchase a subscription, connect a streaming platform, upload content, contact us, or otherwise use our services.

ArcanaStream is the controller of the personal data described in this Policy. We are based in Yverdon-les-Bains, Switzerland, and process personal data primarily under the Swiss Federal Act on Data Protection (FADP). Where another law, including the EU or UK GDPR, applies to a specific processing activity, we also respect the rights and requirements imposed by that law.

1. Personal Data We Process

• Account and identity data: username, email address, password hash, account identifiers, verification status, role, language, and account preferences.
• Contact and billing data: name, billing address, telephone number, company name, tax information, subscription, order, invoice, refund, and payment-status information.
• Payment data: Stripe customer, payment, and subscription identifiers and transaction status. Full payment-card details are entered into and processed by Stripe and are not stored on ArcanaStream servers.
• Platform and streaming data: connected platform, channel identifiers, OAuth access and refresh tokens, stream keys, API credentials, chat settings, stream destinations, schedules, and technical configuration.
• User Content: uploaded or imported video, audio, subtitles, images, overlays, thumbnails, playlists, titles, descriptions, tags, source URLs, and related technical metadata.
• Usage and security data: IP address, request and login timestamps, authentication events, browser and device information made available through HTTP requests, service activity, error data, and audit logs.
• Communications: support tickets and attachments, contact-form messages, emails, newsletter subscription status, and our replies.
• Public-stream data: playback requests, chat events, advertising events, and technical information needed to deliver a public stream where those features are enabled.

2. How We Receive Personal Data

We receive personal data:

• directly from you when you register, configure your account, upload content, purchase a service, or contact support;
• automatically when your browser or application communicates with our services;
• from a platform you choose to connect, such as Twitch, YouTube, TikTok, Kick, or another streaming destination;
• from Stripe when it confirms a payment, subscription, refund, dispute, or billing event;
• from other users or third parties when they submit a support request, rights complaint, or lawful notice involving you or your User Content.

3. Why We Process Personal Data

• Providing the service: creating and managing accounts, hosting content, encoding media, scheduling and delivering streams, connecting platforms, relaying chat, and providing support.
• Billing: processing orders, subscriptions, payments, refunds, invoices, discounts, and accounting records.
• Security and reliability: authenticating users, providing two-factor authentication, preventing abuse and fraud, rate limiting, troubleshooting, maintaining audit logs, and protecting infrastructure.
• Communications: sending verification, security, billing, service, support, and operational messages.
• Product operation and improvement: measuring service performance and diagnosing failures using our own operational data. ArcanaStream does not currently use Google Analytics or sell usage profiles for advertising.
• Legal compliance: meeting accounting and other legal duties, responding to lawful requests, handling rights complaints, and establishing, exercising, or defending legal claims.
• Optional communications: sending newsletters or marketing messages only where you have requested them or where otherwise permitted by law. You may opt out at any time.

Depending on the context and the law that applies, processing is based on performing our contract with you, taking steps at your request, complying with legal obligations, your consent, or our legitimate interests in operating, securing, and improving ArcanaStream. You may withdraw consent at any time, without affecting processing already carried out lawfully.

4. User Content and Data About Other People

You remain responsible for the User Content you provide to ArcanaStream. You must own that content or hold all rights, licenses, permissions, and consents required to upload, store, process, stream, and distribute it. If User Content contains personal data, images, voices, or recordings of another person, you must have a valid legal basis and provide any information or obtain any consent required for that processing.

We process User Content to provide the service, including storage, import, encoding, transcoding, scheduling, delivery, re-streaming, security, troubleshooting, and responding to valid legal or rights-holder requests. We may restrict, preserve, or remove content where reasonably necessary to comply with law, protect third-party rights, or enforce our Terms and Conditions. This Policy does not transfer ownership of User Content to ArcanaStream.

5. Hosting and Storage in Switzerland

ArcanaStream's primary production infrastructure, databases, and object storage are hosted in Switzerland on infrastructure provided by Infomaniak Network SA. Uploaded media and the core account data managed by ArcanaStream are therefore primarily stored in Switzerland. Production email infrastructure is also operated from Switzerland using Infomaniak Mail.

Hosting in Switzerland does not mean that no data ever leaves Switzerland. A limited transfer occurs when you use an external payment service, complete a reCAPTCHA security check, connect or stream to a foreign platform, communicate with a recipient whose email provider is abroad, or load an embedded third-party player or advertising service.

6. Service Providers and Other Recipients

We disclose only the data reasonably necessary for the relevant purpose. The principal categories of recipients are:

These disclosures are not sales of personal data. Service providers may process data only for the contracted service and under their applicable contractual and legal obligations. When data is transferred abroad, we rely as applicable on an adequate level of protection, recognised contractual safeguards, or another lawful basis available under Swiss data-protection law. A destination platform you deliberately connect also processes data under its own terms and privacy policy.

7. YouTube API Services

ArcanaStream uses YouTube API Services to provide the YouTube-related features described in this Policy. By connecting a YouTube channel to ArcanaStream or using these features, you also agree to be bound by the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy.

When you connect your YouTube channel, ArcanaStream accesses, collects, and stores the following data through the YouTube API Services:

• Authorization data: OAuth 2.0 access and refresh tokens for your Google account, stored encrypted and used solely to make API calls on your behalf.
• Channel and broadcast data: your channel identifier and name, live broadcast identifiers, titles, and status, used to create and manage the live broadcasts you start from ArcanaStream and to keep their titles in sync with your playlist.
• Live chat data: messages, author names, and moderation events from the live chat of your own broadcasts, displayed in your unified chat dashboard and used to apply the moderation rules you configure. Chat messages are processed in near real time and are not retained after your streaming session beyond operational logs.
• Video metadata and content: the list of videos on your channel and, when you explicitly request an import, the video content itself, stored in your ArcanaStream media library so you can rebroadcast it.

This data is used only to provide the features you request, is shared only with the service providers listed in Section 6 to the extent necessary to operate the service, and is never sold or used for advertising. ArcanaStream does not use YouTube API data to train machine-learning or artificial-intelligence models.

You can disconnect your YouTube channel at any time from your ArcanaStream platform settings, which deletes or revokes the stored tokens as described in Section 9. You can also revoke ArcanaStream's access to your Google account at any time via the Google security settings page. For any questions about our use of YouTube API data, contact us using the details in Section 14.

8. Cookies and Local Storage

ArcanaStream uses the following browser storage technologies:

• Essential session cookies: authenticate your account, protect requests, and keep you signed in. A standard session may remain valid for up to seven days, and the optional "Remember me" feature for up to thirty days, subject to logout, revocation, and security controls.
• Local storage: retains an access token and functional preferences such as language, layout, cart or checkout state, timezone, and drafts needed by features you use.
• Security and payment technologies: Google reCAPTCHA and Stripe may use cookies or similar technologies to prevent fraud and provide their services.
• Embedded services: a third-party video player or advertising provider may store or read its own cookies when you load that feature.

ArcanaStream does not currently place third-party advertising or Google Analytics cookies for general website analytics. You can remove cookies and local-storage data through your browser, but deleting essential data may sign you out or reset features.

9. Retention and Deletion

• Account and service data: retained while your account is active and afterwards only as needed to close the account, handle disputes, secure the service, or meet legal obligations.
• User Content: retained until you delete it, your account is closed, or it is removed under our Terms. Residual copies may remain temporarily in backups until the normal backup rotation completes.
• Platform credentials: retained while the integration is connected or needed for an active service, and deleted or revoked when the integration is removed, subject to technical and legal retention needs.
• Security and activity logs: retained for the period reasonably necessary to investigate abuse, maintain security, troubleshoot incidents, and resolve disputes, then deleted or anonymised when no longer needed.
• Support and communications: retained as needed to resolve the request and maintain an appropriate history of the relationship.
• Accounting records: invoices, transaction records, and supporting accounting documents may be retained for ten years where required by Swiss law.

A deletion request does not require us to delete data that must be retained by law or that is still necessary to establish, exercise, or defend legal claims. In those cases, processing is limited to the relevant purpose.

10. Security

We use technical and organisational measures appropriate to the risk, including HTTPS in transit, password hashing, access controls, role-based permissions, two-factor authentication, audit logging, infrastructure isolation, and encryption at rest for selected secrets such as two-factor secrets, stream keys, and platform client secrets. No internet service can guarantee absolute security.

You are responsible for protecting your password, recovery codes, stream keys, and connected platform accounts. Please contact us promptly if you suspect unauthorised access.

11. Automated Security Checks

ArcanaStream uses automated checks, including Google reCAPTCHA, rate limits, and authentication controls, to identify bots, fraud, and abuse. A request may be delayed or refused when a security check indicates elevated risk. We do not use these checks to create advertising profiles. If you believe a legitimate request was blocked incorrectly, contact us so that the situation can be reviewed.

12. Your Rights

Subject to applicable law and any permitted limitations, you may ask us to:

• confirm whether we process personal data about you and provide access to it;
• correct inaccurate or incomplete personal data;
• delete personal data or restrict or object to certain processing;
• provide data you supplied in a portable format where the right applies;
• withdraw consent for future processing;
• review a decision made solely by automated means where applicable.

We may need to verify your identity before acting on a request. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or another competent supervisory authority.

13. Changes to This Policy

We may update this Policy when our services, providers, or legal obligations change. The date at the top identifies the current version. We will provide an appropriate notice when a change is material.

14. Contact

To exercise your rights or ask a privacy question, contact:

Controller: ArcanaStream

Email: contact@arcanastream.com

Address: Yverdon-les-Bains, Switzerland