GDPR Data Protection Notice

Privacy Policy

Effective Date: November 12, 2026 · Data Controller: Arvutituba OÜ (Estonia, EU)

Zero-Content Telemetry Commitment: StreamGate is engineered under strict GDPR data-minimization principles (Article 5(1)(c)). We never log media titles, catalog identifiers, playback history, or raw client IP addresses in our application telemetry database.

1. Data Controller

The data controller responsible for personal data processed through StreamGate is Arvutituba OÜ, registered in the Republic of Estonia, European Union. For privacy inquiries or GDPR rights requests, contact us through your account support channel or via the official contact details listed on our website.

2. Categories of Data We Process & Legal Basis

Account & Authentication Data (GDPR Art. 6(1)(b) — Contract Performance): Your email address, salted cryptographic password hash (PASSWORD_DEFAULT), subscription tier status, and generated gateway sub-tokens.
Workspace Configuration Data (GDPR Art. 6(1)(b)): Upstream manifest URLs and hardware codec profiles you explicitly configure in your console.
Pseudonymized Operational Telemetry (GDPR Art. 6(1)(f) — Legitimate Interest in Service Reliability): Request paths are immediately transformed using a server-side salted HMAC-SHA256 function before storage, alongside numerical latency (ms), cache layer status, duplicate counts, and codec mismatch labels (e.g., DV Profile 7 / FEL).
Ephemeral Anti-Abuse Session Hashes (GDPR Art. 6(1)(f) — Security & Quota Enforcement): Client IP addresses are hashed in volatile memory using HMAC-SHA256 solely to enforce active 15-minute concurrency slot locks and 24-hour IP-rotation thresholds. Raw IP addresses are not persisted in our application database.
Billing & Tax Records (GDPR Art. 6(1)(c) — Legal Obligation): Payment card details are never seen or stored by Arvutituba OÜ; payments and statutory tax records are processed directly by our Merchant of Record (Paddle or Lemon Squeezy).

3. Automated Data Retention Schedules

Operational telemetry logs are automatically purged from our database according to your active subscription tier:

Free Tier: 24 hours (1 day)
Personal Tier: 14 days
Household Tier: 30 days
Integrator / B2B Tier: 90 days

Ephemeral stream metadata caches and concurrency session locks end automatically after 15 minutes. Account configuration data is retained until you delete the specific item or close your account.

4. Cookies & Local Storage

StreamGate uses a single strictly necessary, first-party session cookie (HttpOnly, SameSite=Lax, Secure over HTTPS) solely to maintain your authenticated console session and protect against Cross-Site Request Forgery (CSRF). We do not use advertising trackers, third-party analytics pixels, or behavioral profiling cookies.

5. Infrastructure Hosting & Sub-Processors

Our core application servers and databases are hosted within the European Economic Area (EEA). Payment processing and tax compliance are performed by our Merchant of Record under GDPR-compliant Data Processing Agreements and Standard Contractual Clauses where applicable.

6. Your Rights Under the GDPR

As a data subject in the European Union / EEA, you have the right to:

Request access to and a copy of the personal data we hold about you (Article 15).
Request rectification of inaccurate account details (Article 16).
Request erasure of your account and all associated configuration and telemetry data ("Right to be Forgotten", Article 17).
Restrict or object to processing based on legitimate interests (Articles 18 & 21).
Lodge a complaint with your local supervisory authority or the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — aki.ee).