Privacy Policy

Account holders and team members sign up and manage workspaces; for their data we are the controller. Guests are invited by a workspace to appear in a show; for their video, audio and names, the workspace that invited them is the controller and we process on its behalf (see section 8). Where a guest contacts us directly, we are the controller for that correspondence.

• Account data: name, email address, password (stored as a salted scrypt hash), workspace name, role, and Google profile details if you sign in with Google.
• Billing data: plan, subscription status, Stripe customer id, invoice history. Card numbers go directly to Stripe and never reach our servers.
• Production data: rooms, room PINs (hashed), scenes, lower-third text, uploaded media, stream destination names and encrypted RTMP keys, recording and streaming job history.
• Guest data: the display name a guest types, an avatar colour, join and leave times, and their live camera, microphone and screen-share media (section 3).
• Technical data: IP address, browser and device type, request ids, timestamps, error reports, and rate-limit counters kept briefly to stop abuse.
• Communications: support emails and anything you send us.

Live camera, microphone and screen-share streams flow through our media servers (self-hosted Jitsi) so participants can see and hear each other and the director can compose the program. These live streams are not stored by the media servers.

When a director starts a recording, the composed program output (what the audience would see, including every visible participant, media and overlay) is captured and stored in the workspace’s Cloudflare R2 storage until deleted. When a director starts a stream, the same output is sent to the RTMP destination the workspace configured (for example YouTube). That platform’s privacy policy governs what happens next.

We do not run facial recognition, transcription or advertising profiling on media. The workspace that invites guests is responsible for telling them the session may be recorded or streamed and for getting the consent the law requires.

• to provide, operate and secure the service and your rooms;
• to bill you and send receipts and billing notices;
• to send transactional email (verification, password reset, invitations, recording-ready notices). We do not send marketing email without a separate opt-in;
• to answer support requests;
• to detect and prevent abuse, fraud and security incidents (rate limiting, audit logs of administrative actions);
• to fix errors, using Sentry reports;
• to comply with law and enforce our Terms.

We do not sell personal data and we do not use it to train machine learning models.

• Contract: account, billing, production and guest data needed to deliver the service you or your workspace signed up for.
• Legitimate interests: security, abuse prevention, error reporting, and running our business, balanced against your rights.
• Legal obligation: tax and accounting records.
• Consent: optional marketing communications, and guest participation where the inviting workspace relies on consent.

We share personal data only with the providers below, each bound by a contract that limits them to acting on our instructions, and with authorities when the law requires it. We do not share data with advertisers.

If we are involved in a merger, acquisition or asset sale, data may be transferred as part of it; we will notify you before your data becomes subject to a different policy.

• Account and workspace data: kept while the account exists. When a workspace is deleted, its rooms, scenes, media and recordings are removed within 30 days; database backups that contain them are cycled out within a further 30 days.
• Recordings and uploaded media: kept until you delete them or the workspace is deleted. If a subscription lapses, content is kept for 60 days in a restricted state so you can export it, then deleted.
• Guest records: display name and join times are kept with the room and deleted with it. Live media is never stored.
• Invitations and password reset tokens: expire after 7 days and 1 hour respectively and are deleted after use.
• Sessions: sign-in sessions last 30 days and are deleted at sign-out or expiry.
• Billing records: kept for the period tax law requires (typically 7 years).
• Logs and error reports: 30 days (Sentry retention per its plan; request logs on our hosts, 30 days).
• Audit log of administrative actions (plan overrides, deletions, member changes): 12 months.

When a workspace invites guests and records or streams them, the workspace is the controller of that personal data and SocialTV is its processor. Our Terms of Service incorporate a data processing agreement (DPA) covering: processing only on the workspace’s documented instructions; confidentiality of our staff; the security measures in section 10; use of the sub-processors listed in section 6 with notice of changes; assistance with data subject requests and breach notification without undue delay; deletion or return of data at the end of the service; and audit information on request. [For legal review: attach the full DPA, including EU Standard Contractual Clauses and the UK Addendum, before the effective date.] Customers who need a signed copy can request one at support@socialtv.cc.

We use only strictly necessary cookies, so we do not show a consent banner:

• socialtv_session: keeps you signed in; HttpOnly, Secure, SameSite=Lax, 30 days.
• a short-lived state cookie during Google sign-in to prevent cross-site request forgery (10 minutes);
• a short-lived cookie that shows a newly generated room PIN once to the admin who created it (a few minutes).
• Guests keep their room join token in the browser’s session storage (not a cookie) so a page refresh does not create a duplicate participant.

There are no analytics, advertising or third-party tracking cookies. Stripe sets its own cookies on its checkout pages under its policy.

TLS everywhere; passwords hashed with scrypt; room PINs hashed; RTMP stream keys encrypted at rest; signed, purpose-bound and short-lived tokens for realtime, guest and output access; rate limiting on login, signup and room joins; role-based access to rooms and workspaces; Content Security Policy and other browser hardening headers; nightly encrypted database backups with 30-day retention; error reports without session replay. No system is perfectly secure; if we learn of a breach affecting you we will notify you and any regulator without undue delay.

Some providers in section 6 are in the United States. Where data leaves the EEA, UK or Switzerland we rely on the EU Standard Contractual Clauses, the UK Addendum, or an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified).

Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. Account holders can edit their profile and delete their workspace in account settings; for anything else email support@socialtv.cc. Guests should contact the workspace that invited them first; we will help the workspace respond. You may also complain to your data protection authority. California residents have the rights in the CCPA/CPRA; we do not sell or share personal data for cross-context advertising.

The service is for adults. We do not knowingly collect data from children under 16 as account holders. Workspaces that invite minors as guests are responsible for obtaining parental consent where required.

We will post changes here and, for material changes, email workspace owners at least 14 days before they take effect. The date at the top shows the current version.

Privacy questions and requests: support@socialtv.cc. Operator name, registered address and, where required, EU/UK representative: [to be inserted before the effective date]. See also our Terms of Service.