Privacy policy
Draft for legal review. Points marked like this are still open. Last updated: 18 October 2026.
Stream World (stream-world.net) is a business platform for sponsorship deals between licensed online casinos and streamers; Safe Deal is its deal product. This policy explains what personal data we process, why, for how long and what your rights are. We collect as little as the service needs.
1. Who is responsible
The controller of your personal data is [legal name of the company or, until it is registered, the private person running the service], [postal address]. Contact for anything about your data: [email protected].
[EU representative under Article 27 GDPR, if the controller is not established in the EU.]
2. Whose data
- Visitors of the website, including people who send a pilot request.
- Casino team members who register for their company.
- Creators (streamers) who register and connect a channel.
The service is for adults acting for a business or as professional creators. Creators confirm that they are 18 or older. It is not meant for players or viewers, and we do not show gambling advertising on this site.
3. What we process, why and on what basis
Pilot requests
- Data: your role (casino or creator), name, email, company or channel, the markets you name, your comment and when you agreed to this policy.
- Purpose: replying to your request and arranging the pilot. We send you one confirmation email.
- Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to us; we then delete the request.
Accounts
- Data: email address, role, account status and the date you registered. Your password is stored only as an Argon2 hash; we cannot read it. If you use two-factor login, its secret is stored encrypted and the recovery codes only as hashes.
- Purpose: giving you access to the service and keeping your account secure.
- Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
Security log and network addresses
- Data: security events (registration, login and failed login, logout, two-factor set-up and use, password reset, account lock, block and unblock) with their time and a keyed one-way hash of the network (IP) address. The IP address itself is never stored.
- Purpose: detecting and investigating attacks on accounts, and limiting how often the pilot form can be sent from one address.
- Legal basis: our legitimate interest in keeping the service and your account secure (Article 6(1)(f) GDPR).
Casino companies and their licences
- Data: company name, legal name, registration number and country, address, websites, contact email for deals, gambling licences (regulator, number, markets, validity, link to the regulator's public register) and who in the team made which change. We do not ask for licence documents or ID documents.
- Purpose: checking that only licensed operators can make deals, and only in markets their licence covers. A Stream World administrator checks each licence by hand in the regulator's public register.
- Legal basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in keeping unlicensed operators off the platform (Article 6(1)(f)).
Creator profiles and channels
- Data: display name, country, stream languages, a short bio, your rates and the deal types you accept, your confirmation that you are 18 or older and that viewers do not bet on your streams, your Kick channel name and Kick's account number for it.
- Channel verification: to prove the channel is yours, you put a code into your Kick channel description and we read the public channel information through Kick's official API.
- Channel statistics: from our data partner we receive public statistics about your channel for the last 30 days: average and peak viewers, streaming time, followers, audience countries and languages, and the share of casino content. We keep the partner's original response for at most 30 days, then only our summary. [Name of the data partner, once chosen.]
- Your comment: you can add a comment to your audience risk score, for example the reason for a jump in viewers; everyone who sees your card sees it.
- Who sees it: you and Stream World administrators. Members of verified casinos can see creator profiles and search them, with an hourly limit on views against bulk copying, [only once this policy is final and the data protection impact assessment is done; until then profiles are hidden from casinos].
- Legal basis: performance of the contract (Article 6(1)(b)); for statistics from the data partner, our legitimate interest and that of casinos in judging a sponsorship by reliable audience data (Article 6(1)(f)).
Audience risk score
- What it is: a score from 0 to 100 that shows how many unusual signals a channel's audience data has, for example sudden jumps in viewer numbers. It comes either from our data partner or from our own formula, and the creator card always says which.
- How it is used: as a hint for casinos to look more closely, never as an accusation. No decision is made automatically on the basis of the score: it does not block an account, a deal or a payment.
- Your view: creators see their own score with the same explanation casinos see, and can tell us when a signal has an ordinary reason, such as a raid or a tournament.
- Legal basis: our legitimate interest and that of casinos in fair sponsorship deals (Article 6(1)(f)). You can object to it (see section 8).
Deals
- Data: the parties, every version of the deal terms, who proposed, changed, accepted, declined or cancelled a deal and when. This record cannot be changed afterwards.
- Purpose: running the deal, settling disagreements, and giving both sides evidence that the deal followed advertising rules (licensed markets, ad disclosure).
- Emails: the other side of a deal gets an email when something changes in it.
- Legal basis: performance of the contract (Article 6(1)(b)) and the legitimate interest of both sides in proving compliance with gambling advertising rules (Article 6(1)(f)).
Administration
When an administrator verifies or rejects a licence, blocks or unblocks an account or resets two-factor login, we record who did it, when and why. If an account is blocked, the other side of its open deals learns only that the deal was cancelled because an account was blocked, not the reason. Legal basis: our legitimate interest in a safe and accountable service (Article 6(1)(f)).
4. Cookies
We use only cookies that the site needs to work, so we do not ask for consent to them:
session: keeps you logged in; at most 7 days, and you are logged out after 8 hours without activity.csrf: protects forms against misuse by other websites before you log in.
No analytics, no advertising trackers, no social media buttons and no scripts from other websites.
5. Who receives data
We do not sell personal data. Service providers process it only on our instructions, under a data processing agreement:
- Hosting: [Hetzner Online GmbH, Germany; servers in Germany or Finland].
- Network and security: Cloudflare, Inc. (USA) carries all traffic to the site and protects it against attacks; it sees your IP address and the pages you request.
- Email: [Brevo (Sendinblue SAS), France] sends our emails.
- Streamer data: [the data partner, once chosen] receives your channel name to return its statistics.
- Kick answers our requests about the channel you connect; Kick's own privacy policy applies to your Kick account.
Within the service, the other side of a deal sees what the deal needs: the casino sees the creator profile, the creator sees the casino's name and licensed markets.
6. Transfers outside the EU
We store data in the EU. Cloudflare may process data in the USA; such transfers rely on [the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses].
7. How long we keep data
| Data | Kept for |
|---|---|
| Pilot requests | 12 months, then deleted automatically |
| Security log | 12 months, then deleted automatically |
| Login sessions | until logout, 8 hours without activity or 7 days at most |
| Password reset links | 1 hour |
| Original responses from the data partner | 30 days |
| Counters of searches and profile views by casino accounts (who and when, not which profile) | 24 hours |
| Accounts, profiles, channel statistics and audience risk scores | while the account exists; [deleted within 30 days after you close the account] |
| Deal records and the administration log | [period to be set with legal advice, e.g. the limitation period for contract claims; at most as long as needed as evidence] |
| Backups | 14 days |
8. Your rights
Under the GDPR you can ask us for:
- a copy of your data (access) and a machine-readable copy of what you gave us (portability);
- correction of wrong data;
- deletion of your data, unless we must keep it, for example deal records still needed as evidence;
- restriction of processing while a question about your data is being resolved.
You can object at any time to processing based on our legitimate interests, including the audience risk score; we then stop unless we have compelling reasons. Where you gave consent, you can withdraw it at any time without affecting what happened before.
Write to [email protected]. We answer within one month and may ask you to confirm your identity from the email address of your account.
You can also complain to a data protection authority, in particular in the EU country where you live or work, or to [the authority responsible for the controller].
9. Security
Traffic is encrypted, passwords are hashed with Argon2, two-factor login is mandatory for casino teams and administrators, and the server accepts no direct connections from the internet. Every administrative action is logged and cannot be edited afterwards.
10. Changes
When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we tell registered users by email before it takes effect.