Privacy notice

Who is responsible

The controller for SubathonOS is Fin. Privacy contact: privacy@subathonos.co.uk.

If those operator details are not shown as a real legal name and working contact address, SubathonOS is not ready for public release. We do not deliberately replace legally required controller details with a generic brand name.

What information we collect

Account and identity data. Twitch user ID, login, display name, profile image, account preferences, role/membership information and account creation/update timestamps.

Twitch connection data. Encrypted OAuth access/refresh credentials, granted scopes, token validation state, broadcaster identity, EventSub subscription state and revocation information. We do not ask for or store your Twitch password.

Subathon and contribution data. Event configuration, schedules, timer limits, tracking segments, subscription/gift/Bit events, Twitch delivery IDs and timestamps, timer calculations, milestones, wheel activity, manual corrections, contributor display names and event audit history.

Team and support data. Creator invitations, event roles, support tickets, support-session records, managed-service enquiries and messages you send to us.

Security and technical data. Session identifiers, security events, rate-limit records, request metadata needed to protect the service, and operational logs.

Optional information. Creator-controlled analytics preferences, optional revenue-estimate assumptions, public profile choices, marketing preference and designs or files you choose to upload or publish.

Privacy case data. Data-rights requests, identity-verification information where reasonably necessary, data-protection complaints, investigation notes, correspondence and outcomes.

Where the information comes from

Most information comes directly from you when you sign in, configure an event, use support or submit a form. Twitch provides account identity, OAuth validation information and EventSub notifications when you connect Twitch. Managers may provide the Twitch login of a creator they are authorised to invite. Event staff may add manual contribution corrections and operational notes.

Why we use personal information and our lawful bases

Provide and administer SubathonOS. We use account, event, support and Twitch information to provide the service, perform a contract where one exists, or take steps at your request before entering one.

Security, reliability and abuse prevention. We use authentication, audit, EventSub delivery, duplicate-protection and security information where necessary for our legitimate interests in operating a secure, reliable service and protecting users, subject to your rights.

Legal and regulatory obligations. We use information where necessary to comply with applicable law, including responding to data-rights requests and data-protection complaints.

Consent. Where the law requires consent, such as particular non-essential browser storage or optional marketing, we rely on consent and provide a way to withdraw it. Consent is not used to make necessary account/security processing optional.

Legal claims. Limited records may be retained or used where necessary for the establishment, exercise or defence of legal claims.

Analytics and revenue privacy

Event analytics are off by default and controlled by the creator owner. Revenue estimation is separate, private to the creator owner and off by default. SubathonOS does not connect to Twitch payout or revenue APIs. When enabled, revenue estimates are derived from contribution counts using rates supplied by the creator. Turning revenue estimation off removes the saved estimate-rate values for that event.

Who we share information with

We share information only where necessary to operate the service, fulfil your instructions, protect the service or comply with law. Current core providers include Twitch for authentication and EventSub integration, Vercel for application hosting/delivery and Neon for PostgreSQL database infrastructure. We may also disclose information to professional advisers, law-enforcement or regulators where there is a lawful basis or obligation to do so.

Creator-authorised managers and event staff can access event information according to their role. Platform support access is separately controlled and audited. Creator-owned privacy and revenue settings cannot be changed through support mode.

International transfers

Some service providers may process information outside the UK. Where a transfer is subject to UK restricted-transfer rules, we use an available lawful transfer mechanism appropriate to the provider and destination, such as UK adequacy regulations or approved contractual safeguards. Contact privacy@subathonos.co.uk if you need information about the safeguard relevant to your data.

How long we keep information

We keep information only for as long as reasonably necessary for the purpose for which it is used, plus any legal, security, dispute or audit period that applies. Current operational defaults include short-lived authentication/invitation records, rate-limit records measured in days, EventSub/debug records measured in weeks, Twitch ledger and security records for longer operational audit periods, and durable event/contribution history until deletion, anonymisation or another documented retention rule applies.

Support, commercial and privacy-case records are retained for the time needed to handle the matter and, where justified, a further period for accountability, disputes or legal claims. Account deletion can revoke access and pseudonymise identity while preserving limited records that must or reasonably need to remain for those purposes.

Your data protection rights

Depending on the processing and lawful basis, you may have rights to be informed, access your personal information, correct inaccurate information, request erasure, restrict processing, receive portable data, and object to certain processing. You have an absolute right to object to direct marketing. These rights are not all absolute and lawful exemptions may apply.

We normally respond to rights requests without undue delay and within the legal time limit. For subject access requests this is generally one month, with limited extensions permitted for complex or multiple requests. We may ask for proportionate information to confirm identity where necessary.

Data protection complaints

You can complain to us if you think we have handled personal information incorrectly. We provide a dedicated complaint process separate from ordinary product support. We acknowledge data-protection complaints within the period required by UK law, investigate appropriately, keep you informed and provide an outcome without undue delay.

You also have the right to complain to the UK Information Commissioner. We encourage you to contact us first so we have an opportunity to investigate, but this does not remove your right to contact the regulator.

Children and young creators

SubathonOS may be used by creators who are under 18, so privacy defaults are designed to minimise unnecessary exposure: draft public pages are private by default, analytics and revenue estimation are off by default, and creator ownership remains separate from manager access. Where a child is able to understand and exercise their own data rights, those rights belong to them; a parent or authorised person may act where legally appropriate.

The operator must keep the service's Children's Code assessment and age-appropriate safeguards under review as the audience and product change.

Cookies and device storage

Our Cookies & storage page explains the storage used for authentication, security and interface preferences. Where consent is required, optional storage is not enabled before a valid choice and you can revisit your choices at any time.

Changes to this notice

We review this notice when our service, providers, purposes or legal obligations change. If we introduce a materially new use of personal information, we will update the notice and take reasonable steps to bring the change to affected users' attention before the new processing begins where required.