Privacy policy

1. Controller

Michael Zimmermann
Obere Vorstadt 1
78532 Tuttlingen
Germany

Email: contact@veylark.tech

For the moderation of chat messages in our customers' (streamers') channels, the respective streamer is the controller; we process this data on their behalf (section 6).

2. Overview

3. Hosting and delivery

Website, dashboard and bot run on the platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Workers, D1 database, Queues, Durable Objects, Workers AI). When you visit, Cloudflare processes technically necessary connection data such as IP address and browser information to deliver the pages and fend off attacks (firewall rules, rate limiting). We have a legitimate interest in secure and reliable delivery (Art. 6(1)(f) GDPR).

Our application logs contain no chat message content; Cloudflare deletes them after at most 7 days. We have a data processing agreement with Cloudflare. For transfers to the USA, Cloudflare is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.

4. Cookies and tracking

We use no tracking, no analytics tools and no advertising cookies, and we load no fonts or scripts from third parties. We only use technically necessary cookies: a session cookie for signing in (up to 7 days), a protective cookie against forgery during the Twitch sign-in (10 minutes), if you can open several channels, a cookie with the channel you picked (30 days) and, if you switch the language, a cookie that stores your choice (1 year). No consent is required for these (§ 25(2) no. 2 TDDDG).

5. Sign-in with Twitch

You sign in via Twitch (Twitch Interactive, Inc., USA). Twitch gives us your user ID, your login and display name and an access token. For signing in it only allows reading which channels you moderate; Twitch asks for the permissions the bot needs only when you connect your own channel. We store tokens only in encrypted form (AES-256-GCM). The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). Twitch's privacy policy applies to processing at Twitch.

You can disconnect your channel at any time under “Exemptions”. We then immediately delete all channel data and your account: rules, examples, moderation log, strikes, quota, access tokens and statistics.

5a. Access for moderators

Moderators of a channel that uses Veylark automatically get access to its dashboard, without an invitation. To do this we ask Twitch which channels you moderate (when you sign in and after that at most every 15 minutes) and, for connected channels, hourly with the streamer's access, who moderates there. For moderators we store the Twitch user ID, login and display name, the permissions granted by the streamer, whether the person is still a moderator and when they last used Veylark. We store nothing about channels that do not use Veylark. A moderator's access token is not kept in our database, only encrypted in the session cookie, so we can check the mod role again.

When a moderator or the streamer marks a false alarm, lifts a timeout, decides an uncertain case, reports a missed message or changes rules in the dashboard, we store their login name with it. It is only visible within that channel.

The purpose is to give a streamer's mod team access and to make clear who changed what. The legal basis is Art. 6(1)(b) GDPR (use of the dashboard) and Art. 6(1)(f) GDPR (the streamer's legitimate interest in traceable moderation by their team). We delete the data when the channel is disconnected, and otherwise 30 days after the person stops being a moderator of the channel. Login names on log entries and changes are deleted after 30 days, an account without its own channel and without a mod role 30 days after the last sign-in.

6. Chat moderation (processing on behalf)

In channels whose streamers use Veylark, the bot checks viewers' chat messages. We process the following on behalf of the streamers (Art. 28 GDPR, see the data processing agreement): the message text, the sender's Twitch user ID and login name, and their role in the channel (e.g. moderator, VIP, subscriber).

• Messages are classified automatically with AI models on Cloudflare Workers AI and then discarded.
• Only messages on which the bot acted or that were marked “uncertain” are kept in the channel's moderation log for 30 days and are then deleted automatically.
• For escalation we count violations per viewer and rule (strikes); we delete these counters after 7 days without a new violation.
• We keep a channel's last three messages and identical texts from the last 30 seconds in memory only, to recognize context and avoid duplicate checks.
• Whether a message is deleted, answered or the sender is suspended is set by the streamer's rules; timeouts and bans are only active if the streamer turns them on. Every action can be reviewed in the log, undone or marked as a false alarm.

Viewers can exercise their rights with the respective streamer or directly with us; we forward requests to the responsible streamer.

7. Rule assistant

Descriptions you enter in the rule assistant are sent to an AI model on Cloudflare Workers AI to phrase the rule. Please do not enter personal data of third parties there.

7a. Feedback to improve detection (optional)

If a streamer has switched on “Share feedback to improve detection”, we store individual chat messages that the streamer rated as a false alarm, a missed hit or a confirmation, without username, user ID, channel or exact time; e-mail addresses, phone numbers, links (except their domain) and mentions are removed beforehand. The purpose is to improve and test our moderation (Art. 6(1)(f) GDPR; legitimate interest in reliable detection of hate speech, fraud and harassment). Retention: at most 24 months. An internal, encrypted channel identifier used for limits and deletion on request is removed after 12 months.

8. Recipients

• Cloudflare, Inc. (hosting, database, AI models, security), as processor
• Twitch Interactive, Inc. (sign-in, moderation actions in chat), if you connect your channel

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Contact us at the email address above. You may also lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement (Art. 77 GDPR).