This Privacy Policy explains how Fishrift collects, uses, stores, and protects your personal data. We are committed to full transparency about our data practices and to compliance with the General Data Protection Regulation (GDPR — Verordening (EU) 2016/679) and Dutch implementation law (Uitvoeringswet AVG).
When your stream is live, Fishrift receives event data that includes your viewers' platform usernames. This data powers your alerts, activity feed, loyalty system, and bot features. We do not sell or share viewer data with any third party.
We use your data to:
| Purpose | Legal basis |
|---|---|
| Providing the service | Contract performance (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Product improvement | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Optional communications | Consent (Art. 6(1)(a)) |
We share your data only as follows:
We may disclose your data if required by law, court order, or governmental authority in the Netherlands or EU.
| Data type | Retention period |
|---|---|
| Account data | Duration of account + 30 days after deletion |
| Stream events | 24 months from event date, then purged |
| Payment records | 7 years (Dutch fiscal law requirement) |
| Fishcoins/loyalty data | Duration of account + 30 days after deletion |
| Media uploads | Until manually deleted or 30 days after account deletion |
| Security logs | 90 days |
We will notify you before implementing any change to these retention periods.
We protect your data using:
In the event of a personal data breach that poses a risk to your rights, we will notify you and the Autoriteit Persoonsgegevens within 72 hours as required by GDPR Article 33.
| Right | What it means |
|---|---|
| Access (Art. 15) | Request a copy of all personal data we hold about you |
| Rectification (Art. 16) | Correct inaccurate personal data |
| Erasure (Art. 17) | Request deletion of your personal data |
| Data portability (Art. 20) | Receive your data in a machine-readable format |
| Restriction (Art. 18) | Ask us to pause processing in certain circumstances |
| Object (Art. 21) | Object to processing based on legitimate interests |
| Withdraw consent | Where processing is consent-based, withdraw at any time |
To exercise any right: privacy@fishrift.com
We will respond within one month. Complex requests may be extended by two additional months with notice to you.
You have the right to lodge a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens autoriteitpersoonsgegevens.nl +31 88 1805 250
Fishrift primarily processes data within the European Economic Area. Where data is transferred outside the EEA (e.g. Cloudflare or AWS infrastructure in the United States), this is done under Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms under GDPR Chapter V.
Fishrift is not directed at persons under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data about someone under 18, contact us at privacy@fishrift.com and we will delete it promptly.
We will notify you via email and Sonar at least 30 days before making material changes to this Privacy Policy. The "Last updated" date at the top reflects when the policy was last revised.
Fishrift The Netherlands privacy@fishrift.com