Privacy Policy

This Privacy Policy informs you, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Section 25 of the German Telecommunications-Digital Services Data Protection Act (“TDDDG”), about the processing of personal data when you visit this website and use the PixelPact platform.

Audience: The PixelPact platform is aimed exclusively at commercial streamers (in particular Twitch, Kick and YouTube creators) and at brands, agencies and other advertising customers, each acting as entrepreneurs within the meaning of Section 14 of the German Civil Code. We do not offer services to consumers.

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

2. Contact for privacy matters

We have not appointed a dedicated Data Protection Officer as the legal requirements (in particular Section 38 BDSG and Art. 37 GDPR) do not currently apply to us. Please direct all requests concerning data protection, including the exercise of your rights as a data subject, to:

3. Definitions

This Privacy Policy uses the terms defined in the GDPR. “Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means (Art. 4(2) GDPR).

4. Legal bases for processing

Where we obtain the data subject’s consent, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract, Art. 6(1)(b) GDPR applies. Processing necessary for compliance with a legal obligation relies on Art. 6(1)(c) GDPR. Processing necessary for the purposes of our legitimate interests (or those of a third party), where such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, is based on Art. 6(1)(f) GDPR. For the storage of, or access to, information on end-user devices, Section 25 TDDDG applies in addition.

5. Hosting and delivery of the website

We operate our website and all connected services (platform, API, WebSocket server, database) on a dedicated virtual private server (VPS) provided by IONOS SE & Co. KGaA, Elgendorfer Straße 57, 56410 Montabaur, Germany (“IONOS”). The servers are located exclusively in data centres within the Federal Republic of Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

Our database (MongoDB) also runs as a container on this IONOS server; data is not transferred to any external database service provider.

Backups: Compressed backup copies of the database are created daily and retained for 14 days. A copy of the backups is additionally stored off-site with Google (Google Drive; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); processing on servers in the United States is possible. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses apply (Art. 46(2)(c) GDPR). Purpose: data security and recoverability (Art. 32 GDPR). Legal basis: Art. 6(1)(f) GDPR. Retention: 14 days, after which each backup is deleted automatically.

Server logs for advertising short links: Deviating from the shortening described above, requests to advertising short links (path “/r/…”) are temporarily logged with unshortened IP addresses in separate server logs. Purpose: fraud prevention (click manipulation) and billing integrity. Legal basis: Art. 6(1)(f) GDPR. Retention: a maximum of 14 days, after which the logs are deleted automatically by log rotation.

Each time this website is accessed, our web server automatically stores the following information in server log files that your browser transmits:

• IP address of the requesting device (in shortened form)
• Date and time of the access
• URL requested
• HTTP status code
• Amount of data transferred
• Referrer URL (previous page visited)
• Browser type and version
• Operating system

Purpose: Ensuring the secure and stable operation of the website, user convenience and evaluation of system security and stability. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: 14 days; log files are deleted automatically afterwards, unless longer retention is necessary to clarify a specific incident (e.g. an attack, system error).

5.1 Content delivery network and security: Cloudflare

To accelerate delivery, to mitigate attacks (in particular DDoS) and for TLS termination we use the content delivery network operated by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). When you access our website, your request is first routed through Cloudflare servers; in particular, your IP address, browser information and the requested URL are processed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, available and fast website).

Third-country transfer: Processing may also take place on servers outside the EU, in particular in the United States. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (DPF). In addition, we have concluded standard contractual clauses with Cloudflare pursuant to Art. 46(2)(c) GDPR. For further information see Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

6. Cookies and similar technologies

Our platform uses strictly necessary cookies and storage technologies only. No consent banner is shown at present. If we later integrate analytics, marketing or other non-essential technologies, we will ask for your consent in advance using a consent management tool pursuant to Section 25(1) TDDDG.

Legal basis: Section 25(2) No. 2 TDDDG (strictly necessary to provide the telemedia service explicitly requested by the user) and Art. 6(1)(b) and (f) GDPR.

Cookies and local storage in use

7. Processing related to platform use

7.1 Streamer account (sign-up via Twitch, YouTube or Kick; optional Discord, TikTok, Instagram)

To use our platform as a streamer you sign up via Twitch or, where offered, via Google (YouTube) or Kick (OAuth 2.0 in each case). Additional accounts (YouTube, Kick, Discord, TikTok, Instagram) can optionally be linked. The following data is transmitted to us by the respective platform and stored in our database:

• Twitch: internal Twitch ID, login name, display name, email (if authorised), profile image, follower count
• YouTube (Google Ireland Ltd.): YouTube channel ID, channel name, handle, profile image, subscriber count
• Kick: Kick user ID, slug, display name, profile image
• Discord: Discord ID, username, avatar hash
• TikTok: TikTok open_id, username, display name, profile image, follower count
• Instagram (via Meta Graph API): Instagram business account ID, username, display name, follower count

We additionally process the following data that you provide yourself or that arises from your use of the platform: display name (for older accounts also first and last name), date of birth, contact email, country, stream language, details on viewer numbers and streaming volume, audience (region, language), selected and excluded industries, origin of your sign-up (referral code; for accounts created on or before 27 October 2026 also the source recorded at the time by the pp_utm cookie, which has since been discontinued), titles of active and historical streams, played game categories (IGDB genres), language detection, viewer snapshots (average and peak viewers), chat-activity metrics, payout preferences, payout requests and associated credit notes.

Purpose: Provision and billing of the platform under the Streamer Terms, eligibility assessment, matching, delivery of creatives, payouts, support. Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (commercial/tax retention duties), Art. 6(1)(f) GDPR (abuse prevention and platform analytics). Retention: Until account deletion; accounting-relevant data (in particular credit notes) are retained for eight years (Section 147(3) AO, Section 14b(1) UStG).

Date of birth: We use it to check that you are of age and, where a campaign sets an age range, whether it fits you. Your date of birth is never published and never passed on to advertising customers.

Step-by-step sign-up: We store what you enter during sign-up so you can continue later. We delete an unfinished draft 30 days after your last entry; if you state an age under 18, we delete it after 30 minutes. We only send a reminder about an unfinished sign-up if you expressly ask for it (Art. 6(1)(a) GDPR), and only once. The newsletter is a separate, voluntary subscription (Art. 6(1)(a) GDPR) you can cancel at any time.

Consents and proof of them: We store which version of the Terms, the self-billing agreement and the delivery of campaigns you agreed to and when, and whether you withdrew a consent, each with IP address and browser identifier. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR (proof of contract). When your account is deleted we delete the consents; we keep the log entry of the consent as proof, without IP address and browser identifier.

Notifications: Notices in the dashboard (bell), e.g. about payouts or campaigns, are stored in your account and deleted with it. Legal basis: Art. 6(1)(b) GDPR.

Stream summary via Discord: If you have linked Discord, we send you a direct message after a stream with stream times, platforms, average viewer count and your earnings or the reason no ads ran. You can switch this off in the settings. Legal basis: Art. 6(1)(b) GDPR. For the transfer to Discord see Section 7.7.

Help and support: When you send us a request from the dashboard, we process its title, description, topic, reference (e.g. a campaign), the page you write from, language, browser identifier and window size, your attachments and the further conversation in order to handle it. Legal basis: Art. 6(1)(b) GDPR. We keep requests as long as your account exists and delete them with it.

Public profile page: Where we offer it, your profile page at pixelpact.gg/@name only becomes public once you switch it on. It then shows the details named to you when you switch it on, and an imprint if you add one. Legal basis: Art. 6(1)(a) GDPR; you can switch the page off at any time, and it is then no longer reachable straight away. If someone reports content on the page as illegal, we process the reporter’s name and email address, the reason, location and description to review the report and notify those involved (Art. 6(1)(c) GDPR in conjunction with Arts. 16 and 17 DSA). We delete these details six months after our decision on the report.

Chat messages for chat-ad control and effectiveness measurement: To determine whether a chat is active enough to deliver chat ads, and to measure the effect of chat ads that were delivered, we process chat messages from your live chat (message text, sender ID and display name, timestamp) — across platforms (Twitch, Kick, YouTube). This data may also relate to messages from viewers; it is stored for a maximum of 30 days and then deleted automatically. Effectiveness measurement: For each chat ad delivered we derive from these messages statistical figures only: the number of messages and of people writing in a short window after the ad post and in an equally long window before it, the number of direct replies to the ad post, the number of messages referring to the brand or the campaign, and a rule-based distribution across positive, neutral and negative tone. Beyond those 30 days we retain only aggregated, anonymous figures per campaign and platform — with no reference to a channel, a session or a point in time. Message text, sender IDs, display names and any other indication of an individual writer’s identity are neither retained for this purpose nor transmitted to advertising customers, and do not leave our systems for this purpose. Advertising customers receive these figures exclusively in that aggregated form, in the campaign closing report — not per individual message and not per person writing. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the integrity of ad delivery, in abuse prevention, and in measuring the performance of delivered advertising for our advertising customers). You may object to this processing under Art. 21 GDPR; contact details are in Section 2.

Chat messages for determining the moment of delivery (Moment Marketing): For chat and combined campaigns, advertising customers can book the “Moment Marketing” addon. For it we continuously evaluate chat messages from your Twitch live chat as to whether the message rate is significantly above the running session’s own average and whether search terms defined in advance by the advertising customer appear in it. When both conditions hold, the next ad delivery that was scheduled anyway is brought forward. Only the following are evaluated for this: the number of messages and of people writing within short time windows, the number of hits on those search terms, and — for the matching messages only — a rule-based classification into positive, neutral and negative tone, which we use to suppress a delivery when sentiment is predominantly negative. The evaluation runs entirely on our own systems; no external service and no AI is involved, and message text does not leave our systems for this purpose. For traceability we store, per triggered moment, only the figures named above together with the advertising customer’s search terms — no message text, no sender IDs and no display names — for a maximum of 30 days. Advertising customers receive no access to this data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in contextually appropriate ad delivery). You may object to this processing under Art. 21 GDPR; contact details are in Section 2.

7.2 Customer account (brands and agencies)

To use our platform as an advertising customer you register via email and password or alternatively via Google (OAuth). The following data is processed:

• Core data: name, business email address, password hash, email verification status, profile image (optional)
• Company data: company name, website, VAT ID, billing address, billing email, preferred language
• Contact person data: first and last name, phone number, department
• Two-factor authentication (TOTP): encrypted TOTP secret and hashed backup codes; activation is voluntary
• Stripe customer ID (when using card payments, see Section 7.8)
• Origin of your sign-up: if the link to the registration page carries campaign parameters (source, medium, campaign, e.g. utm_source), we store them with the account together with the landing page and the time. No cookie is set for this. A sign-up via Google records no campaign parameters. For accounts created on or before 27 October 2026, the source recorded at the time by the since discontinued pp_utm cookie may be stored instead.

Purpose: Account management, campaign creation and delivery, invoicing, support, fraud prevention, analysing which advertising channels bring customers to us. Legal basis: Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (commercial/tax obligations), Art. 6(1)(f) GDPR (IT security, abuse prevention, analysis of our advertising channels). Retention: Until account deletion; accounting-relevant data for 10 years (Sections 147 AO, 257 HGB).

7.3 Campaign creation and delivery

Advertising customers create campaigns through our six-step wizard. We process the campaign information provided (internal and public name, briefing, targeting criteria, budget, schedule) and the uploaded creatives. Creatives are stored in our database system (GridFS) on the IONOS server.

During the campaign, the following data is recorded per delivery: timestamp, streamer session ID, asset ID, ad format, viewer count at delivery, calculated impressions and any correction values from post-stream reconciliation.

Legal basis: Art. 6(1)(b) GDPR (platform contract). Retention: For the customer at least for the duration of the business relationship plus retention duties; aggregated, non-personal delivery statistics may be kept beyond that for platform optimisation.

7.4 OBS overlay and real-time delivery

To deliver creatives, streamers embed a PixelPact-provided overlay link as a browser source in their OBS setup. The overlay opens a WebSocket connection to our server; as a fallback it uses HTTP polling every two seconds. In this context we process technical parameters (overlay token, IP address of the OBS client, timestamps, status and device data for debugging).

Legal basis: Art. 6(1)(b) GDPR. Retention: Connection logs for a maximum of 14 days.

7.5 AI-powered briefing generator (OpenAI)

Optionally we offer advertising customers an AI-powered briefing generator. To this end we send the prompt entered by you (up to 1,000 characters) to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”). OpenAI in turn uses subprocessors in the United States.

Purpose: Generation of a draft briefing for further editing by the user. Legal basis: Art. 6(1)(b) GDPR (contractual ancillary feature requested by the customer). Third-country transfer: OpenAI Ireland Ltd. is our contracting party in the EU. Where processing by subprocessors occurs in the US, it is based on standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Model training: We use the API integration with training opt-out activated; prompts are not used to train OpenAI models under the applicable OpenAI terms. Retention: Up to 30 days at OpenAI (abuse-related retention); we ourselves only store the number of remaining generations per campaign.

7.6 Transactional emails (Resend)

Transactional emails (registration confirmation, password reset, security and notification emails) are sent via the service provider Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA (“Resend”). Resend processes the recipient and sender addresses, subject, content and metadata (timestamps, delivery status).

Legal basis: Art. 6(1)(b) GDPR. Third-country transfer: Resend, Inc. is certified under the EU-US Data Privacy Framework; standard contractual clauses additionally apply. Retention: Delivery status and metadata are retained for up to 30 days at Resend; contents are stored permanently on our side only to the extent they are attached to an account (e.g. sent notifications).

7.7 Linked streaming and messaging services

The following third parties act as independent controllers within the meaning of the GDPR. Our involvement is limited to the fact that you sign in via or link your account with one of these services:

• Twitch Interactive, Inc., 350 Bush St, 2nd Floor, San Francisco, CA 94104, USA (OAuth login, EventSub webhooks, Twitch API). Purpose: authentication, live detection, viewer and category tracking. Legal basis: Art. 6(1)(b) GDPR. Privacy policy: twitch.tv/p/legal/privacy-notice.
• Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland — YouTube API Services (YouTube login and YouTube Data API v3), plus the Google Places API for address autocomplete and Google Maps in the settings view. Via the YouTube API we process — using the OAuth scopes openid, email, profile, and youtube.readonly (at login) and youtube.force-ssl (only when you optionally connect a chat bot) — the channel ID, channel name/handle, subscriber and view counts, and the live status incl. video ID, start time and current viewer count for billing. When chat ads are enabled, your own connected bot posts ad messages into your live chat (scope youtube.force-ssl). Purpose: authentication, live detection, reach measurement for billing, optional chat ads; Google Places/Maps serve convenient address entry. Legal basis: Art. 6(1)(b) GDPR (contract); for Google Places/Maps additionally Art. 6(1)(f) GDPR. Retention of YouTube data: stream/snapshot data is deleted after 30 days; after you revoke or disconnect the YouTube account, the related YouTube data is removed within 30 days (billing-relevant data is kept longer only with your consent — see Section 7.7a). Privacy policy: policies.google.com/privacy.
• Kick.com (Kick Streaming Pty Ltd, Australia). Purpose: authentication, retrieval of public channel data, live detection and optional chat ads via your own connected bot. Legal basis: Art. 6(1)(b) GDPR. Privacy policy: kick.com/privacy-policy.
• Stream Hatchet, Inc. (operator of StreamsCharts), USA. Purpose: verifying Kick eligibility based on average viewer counts; for this the streamer’s public channel slug is sent to streamscharts.com. Legal basis: Art. 6(1)(b) and (f) GDPR. A transfer to the USA takes place; unless an adequacy certification (EU-US Data Privacy Framework) applies, the transfer is based on standard contractual clauses (Art. 46 GDPR).
• TwitchTracker (twitchtracker.com). Purpose: verifying Twitch eligibility at registration based on public average viewer counts; for this the streamer’s public Twitch channel name is sent to twitchtracker.com. Legal basis: Art. 6(1)(b) and (f) GDPR. Processing outside the EU is possible; only channel data that is public anyway is transmitted.
• Discord, Inc., 444 De Haro Street #200, San Francisco, CA 94107, USA. Purpose: optional linking of a Discord account and notifications via a PixelPact Discord bot. Legal basis: Art. 6(1)(a) and (b) GDPR. Privacy policy: discord.com/privacy.
• TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland (for EEA/UK users) or TikTok Pte. Ltd. (worldwide) — use of the TikTok Login Kit with the scopes user.info.basic, user.info.profile and user.info.stats. Purpose: optional linking of a TikTok account to enrich the streamer profile with display name, username, profile image and follower count so that advertising customers can discover the creator. The follower count is refreshed every six hours via the TikTok API. Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time via the disconnect function in the settings, which triggers immediate revocation of the associated tokens and deletion of the linked profile data. Privacy policy: tiktok.com/legal/page/eea/privacy-policy/en. TikTok transfers data in particular to the United States, Singapore and the United Kingdom; according to TikTok such transfers are based on standard contractual clauses.
• Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Instagram via the Meta Graph API, Facebook Login). Purpose: optional linking of an Instagram business account to enrich the streamer profile with username, display name and follower count for discovery by advertising customers. The follower count is refreshed every six hours. Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time via the disconnect function, which triggers deletion of the associated tokens and profile data. Privacy policy: privacycenter.instagram.com/policy. Meta transfers data to the United States; according to Meta it is certified under the EU-US Data Privacy Framework.
• IGDB (Internet Game Database, Twitch Interactive, Inc.): enriching a stream’s game categories with additional genre data. Legal basis: Art. 6(1)(f) GDPR.

A transfer of data to the United States (and, for TikTok, possibly further third countries) may take place with the providers listed above. These companies are — where applicable — certified under the EU-US Data Privacy Framework or covered by standard contractual clauses.

OAuth tokens and automated refresh: For the integrations with TikTok and Instagram we store the access and (where available) refresh tokens issued by the respective providers. Tokens are stored exclusively in AES-256-GCM-encrypted form in our database and are used solely to periodically retrieve the streamer’s publicly available follower count (every six hours). Upon disconnect the tokens are immediately revoked with the respective provider and deleted from our database.

7.7a Specific notes on YouTube API Services

PixelPact uses YouTube API Services. By using PixelPact’s YouTube features you agree to the YouTube Terms of Service. Google’s handling of your data is governed by the Google Privacy Policy. Authorized data obtained from the YouTube API is used solely for the purposes described in this policy (live detection, reach measurement for billing, optional chat ads) and is not shared with unrelated third parties (“Limited Use”); it is deleted no later than 30 days after the last retrieval or after revocation. PixelPact’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: You can revoke PixelPact’s access to your Google/YouTube data at any time via your Google security settings or via the disconnect function in your PixelPact settings. After revocation we delete the associated YouTube tokens immediately and the related YouTube data within 30 days.

Separate consents: As part of YouTube delivery we obtain the following separate consents: (1) acknowledgement of paid promotion, (2) display of your YouTube reach metrics to booking brands (off by default), and (3) retention of billing-relevant reach data beyond the 30-day window for billing and tax purposes. Legal basis: Art. 6(1)(a) GDPR (consent); each may be withdrawn at any time with effect for the future. The YouTube and Kick chat-bot tokens are — like all other bot tokens — stored exclusively in AES-256-GCM-encrypted form.

7.8 Payments and payouts

For payouts to streamers we use PayPal or SEPA bank transfers:

• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Purpose: payout of streamer balances. Data transferred: the streamer’s PayPal email, payout amount, reference. Legal basis: Art. 6(1)(b) GDPR.
• SEPA bank transfer via our bank account: IBAN, BIC and account holder are transmitted to our bank. Legal basis: Art. 6(1)(b) GDPR.

For payments from advertising customers to PixelPact we plan to use Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland (“Stripe”). Once the integration is active, payment data (name, payment method, card identifier, transaction amount, IP address) will be exchanged directly between the customer and Stripe; we only receive the transaction status and a transaction ID to assign payments to a campaign. Legal basis: Art. 6(1)(b) GDPR. Privacy policy: stripe.com/en-de/privacy. For invoice payments by bank transfer, IBAN, account holder and payment reference are transmitted to PixelPact’s bank.

7.9 Billing documents and retention periods

The credit notes arising from payouts and the invoices issued to advertising customers contain all mandatory information required by Sections 14 and 14a of the German VAT Act and are stored electronically. Retention: credit notes eight years (Section 147(3) AO, Section 14b(1) UStG), invoices to advertising customers 10 years pursuant to Section 147 AO and Section 257 HGB. Legal basis: Art. 6(1)(c) GDPR.

7.10 Website chat

On selected pages for advertisers we offer a chat. It is loaded only when you click the chat button; before that, no data is transferred and no cookies or local storage are created for it. The chat runs in its own window at chat.pixelpact.gg and is provided by our self-hosted Odoo instance (odoo.pixelpact.gg); no external chat provider is involved. Like the whole website, the connection runs through Cloudflare (section 5.1).

An automated assistant asks you multiple-choice questions; you can also type questions of your own. We store your answers and messages as a chat transcript in our Odoo instance as soon as you select or write anything in the chat – even if you do not give us an email address. Restarting the chat only deletes the data in your browser, not the transcript already sent. If you explicitly ask us to get in touch and give your email address, we create an enquiry in our CRM with the transcript attached; we use the email address only to answer that enquiry. IP address, browser details and time of use are also processed for technical reasons. Please do not share sensitive data in the chat.

Legal basis: Art. 6(1)(f) GDPR (our interest in answering enquiries about our services promptly) and, where you yourself become a party to a contract, Art. 6(1)(b) GDPR (steps prior to entering into a contract). Retention: chat transcripts without an enquiry are deleted 30 days after the last activity. Enquiries that do not lead to a contract are deleted 12 months after their last change; if a contract is concluded, the periods in section 7.9 apply. The storage used is listed in section 6.

7.11 Contact form, contact by email and customer relationship management (CRM)

When you write to us through the contact form on our website or by email, we process the details you give us: the topic, your name, your email address and your message, and, if you provide them, your company, a link to your channel and your phone number. Without topic, name, email address and message we cannot reply; everything else is voluntary.

Purpose and legal basis: we use the details to answer your request. Where it concerns planning a campaign, this is a pre-contractual step taken at your request (Art. 6(1)(b) GDPR); for all other requests we rely on our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

How the data travels: the form sends your details to our server over an encrypted connection. From there we send them by email through Resend (see 7.6) to our team mailbox hello@pixelpact.de, which is operated by IONOS SE (see Section 5) and forwards to the mailboxes of the team members. Requests on the topic “Plan a campaign” are additionally recorded as a lead in our customer relationship management system (CRM), Odoo. We run Odoo ourselves on a server of IONOS SE in Germany, with which we have concluded a data processing agreement under Art. 28 GDPR. We do not send an automatic confirmation of receipt.

Protection against abuse: the form uses no CAPTCHA and sets no cookies. We recognise automated requests by a field people cannot see and by a minimum time to fill in the form, and we limit the number of requests per IP address and per email address. For this we store, for at most 24 hours, a non-reversible hash of the IP address and of the email address, not the addresses themselves. The legal basis is our legitimate interest in operating without abuse (Art. 6(1)(f) GDPR).

Retention: leads in the CRM that do not result in a contract are deleted automatically 12 months after their last change. If a contract is concluded, the periods in 7.9 apply. Emails about requests are deleted once we no longer need them to handle the request, unless a statutory retention obligation applies. Resend keeps delivery metadata for at most 30 days (see 7.6).

8. Recipients of data

Within our organisation, only those teams receive access to your data who need it for the purposes described in this policy (in particular platform operations, customer support, accounting, management). Disclosure to external recipients takes place only in the constellations described in Sections 5 to 7 above and, in addition, to:

• Tax advisors and auditors on the basis of Art. 6(1)(c) and (f) GDPR
• Authorities and public bodies where legally required (Art. 6(1)(c) GDPR)
• Debt collectors or lawyers for the enforcement of claims in case of default (Art. 6(1)(f) GDPR)

9. Automated decision-making and matching

Our matching engine automatically assigns advertising campaigns to suitable streamers. To this end we evaluate profile data (e.g. industry, average viewer count, category, language) and campaign requirements and compute a score. From a score of 75 an automatic assignment (“auto-assign”) takes place; below that a manual review is carried out by our team. Streamers can reject, pause or leave any assigned campaign individually.

No solely automated decision producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22(1) GDPR is made, as any auto-assignment can be rejected by the streamer and no fully automated mechanism is used to establish, execute or terminate the platform contract.

10. Your rights as a data subject

Where the respective conditions are met, you have the following rights against us:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR): where we process your data based on legitimate interests, you may object at any time on grounds arising from your particular situation.
• Withdrawal of any consent given with effect for the future (Art. 7(3) GDPR).

As a streamer you can download a copy of your data yourself in the settings. It also contains your consents with their log, notifications, support requests and the origin of your sign-up.

To exercise your rights please send an informal email to hello@pixelpact.de. We will handle your request without undue delay, at the latest within one month (Art. 12(3) GDPR).

11. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our competent authority is:

12. Obligation to provide personal data

Providing your personal data is neither required by law nor by contract. However, without the data required for registration and performance of the contract we cannot provide the platform to you.

13. Data security

We apply appropriate technical and organisational measures (TOMs) pursuant to Art. 32 GDPR. Communication with our website is exclusively TLS-encrypted (HTTPS). Passwords are stored only as salted hashes (bcrypt); security-critical fields such as TOTP secrets, backup codes, tax numbers, IBAN, payout email, and the OAuth access and refresh tokens of the third-party integrations (in particular TikTok and Meta/Instagram) are encrypted with AES-256-GCM.

14. Amendments to this Privacy Policy

We will update this Privacy Policy where the legal or functional situation changes. The current version can always be accessed on this page.