VeylarkData processing agreement
Pursuant to Art. 28 GDPR between the streamer as controller and the operator of Veylark as processor. Last updated: 11.10.2026
1. Subject and duration
The processor moderates the controller's Twitch chat according to the rules set by the controller. The agreement applies as long as the controller has their channel connected to Veylark.
2. Nature, purpose and scope
- Purpose: detecting unwanted chat messages, deleting them, replying and, if enabled, timeouts or bans; a log for the controller's review.
- Types of data: message text, message ID, Twitch user ID, login name, roles in the channel.
- Data subjects: people who write in the controller's chat.
- Storage: messages only when acted on or marked “uncertain”, 30 days; strikes 7 days after the last violation; everything else only transiently in memory.
- Not part of this agreement: ratings the controller chooses to share under section 6a of the terms; the processor handles these without user or channel reference as a controller in its own right (see the privacy policy, section 7a).
3. Instructions
The processor processes the data only on documented instructions from the controller. The instructions are the settings in the dashboard (rules, wordlist, exemptions, actions). If the processor considers an instruction unlawful, it informs the controller without delay.
4. Confidentiality
Persons with access to the data are bound to confidentiality.
5. Sub-processors
The controller approves the use of Cloudflare, Inc. (USA; hosting, database, queues, AI models) with a data processing agreement, certification under the EU-US Data Privacy Framework and EU Standard Contractual Clauses. The processor informs the controller in advance about new sub-processors; the controller may object and disconnect the channel.
6. Assistance and notification duties
The processor assists the controller with data subject requests (Art. 12 to 23 GDPR) and with its obligations under Art. 32 to 36 GDPR. It reports personal data breaches without undue delay, at the latest within 48 hours of becoming aware of them.
7. Deletion after termination
When the controller disconnects their channel, the processor immediately deletes all channel data; the host's logs are removed according to its retention periods (at most 7 days).
8. Evidence and audits
The processor provides the information needed to demonstrate compliance and allows audits after reasonable notice.
9. Technical and organisational measures (Art. 32 GDPR)
- Encryption: transport only via HTTPS (TLS 1.2 or higher, HSTS); Twitch access tokens stored encrypted with AES-256-GCM.
- Access control: sign-in via Twitch, signed HttpOnly session cookies; each customer sees only their channel's data; operator access only for designated accounts; limits on login attempts.
- Integrity of inputs: Twitch webhooks are verified by HMAC signature and timestamp; firewall rules and rate limiting at the network edge.
- Data minimisation: no permanent storage of chat messages without an action; logs without message content; automatic deletion periods.
- Availability: operation on Cloudflare's distributed infrastructure; when in doubt, the bot does not act.
- Separation: data of different channels is logically separated; each channel has its own processing state.
Processor
Michael Zimmermann
Obere Vorstadt 1
78532 Tuttlingen
Germany
Email: contact@veylark.tech