1. Introduction

Streamster, operated by Matthew Rosan ("Streamster," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you use our live-stream commerce marketplace at streamster.shop (the "Service"). By using the Service, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service immediately.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

Full name
Email address
Account type (seller)
Profile information you choose to provide
Authentication credentials (passwords are hashed and never stored in plaintext)

2.2 Transaction Data

When you sell through the Platform, or when a buyer checks out as a guest, we collect:

Buyer contact email and shipping address provided at guest checkout (buyers do not create accounts)
Order and transaction amounts
Payment method details (processed and stored by Stripe; we do not store full card numbers)
Commission and fee records
Refund and dispute records

2.3 Stream and Content Data

Live stream metadata (title, duration, viewer counts, timestamps)
Product listings and descriptions
Stream recordings (if enabled by the seller)

2.4 Device and Technical Information

IP address
Browser type and version
Operating system
Device identifiers
Referring URLs and pages visited
Time and date of access

2.5 Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies to maintain your session, remember preferences, analyze usage patterns, and improve the Service. See Section 12 for our full Cookie Policy.

3. How We Use Your Information

We use collected information for the following purposes:

Platform Operation: To create and manage accounts, facilitate transactions, process payments, and deliver the core Service;
Payment Processing: To process purchases, calculate commissions and fees, and facilitate seller payouts through Stripe;
Communications: To send transactional emails (order confirmations, shipping updates, security alerts, legal notices), and, with your consent, marketing and promotional communications;
Analytics and Improvement: To understand how users interact with the Platform, identify trends, and improve features and performance;
Fraud Prevention and Security: To detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities;
Legal Compliance: To comply with applicable laws, regulations, legal processes, and government requests;
Dispute Resolution: To mediate and resolve disputes between customers and sellers.

4. How Long We Keep Your Data

We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires us to. Different data has different lifetimes:

Account data (your name, email, profile, settings, streaming and platform credentials) — kept while your account is open. Erased when you close your account or ask us to delete it.
Order records (order reference, amounts, tax, dates, and the buyer's delivery details) — kept for as long as tax and accounting law requires, which is generally six to seven years. We keep these even after a seller closes their account, because they are records of a completed transaction and are not ours alone to erase.
Payment dispute and chargeback records — kept while a dispute could still be raised or defended. A card chargeback can be filed months after a purchase.
Records of agreement (which version of these terms you accepted, and when) — kept while those agreements could be relevant to a claim.
Our own record of your privacy requests — kept so we can demonstrate that we handled your request properly. A log that deletes itself is no evidence at all.

Payment card details are never stored on our systems. Card data is handled directly by Stripe.

5. Data Sharing and Third Parties

We share your information only as necessary with the following categories of third parties:

Stripe, Inc.: Payment processing. Stripe receives payment method details, transaction amounts, and identity information necessary to process payments and comply with financial regulations. Stripe's privacy policy applies to data they process: stripe.com/privacy.
Mux, Inc.: Video streaming infrastructure. Mux receives stream data necessary to deliver live video. Mux's privacy policy: mux.com/privacy.
Law Enforcement: We may disclose information when required by law, subpoena, court order, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity.

We do not sell your personal information to third parties. We do not share your data with third-party advertisers.

5.2 Anonymized and Aggregated Data

Streamster may create, use, and share anonymized, de-identified, or aggregated data derived from your use of the Service with third parties for analytics, research, industry benchmarking, marketing, and other lawful business purposes. Such data does not identify you personally and is not subject to the restrictions applicable to personal information.

5.3 Law Enforcement and Legal Disclosures

Streamster may access, preserve, and disclose your information to law enforcement agencies, government authorities, or other third parties without prior notification to you where: (a) required by law, subpoena, court order, or legal process; (b) we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Streamster, our users, or the public; (c) to detect, prevent, or address fraud, security, or technical issues; or (d) as otherwise permitted or required by applicable law. Where legally permitted, Streamster may comply with such requests without notifying the affected user.

6. Email and Communication Preferences

You may opt out of marketing emails and promotional communications at any time through your account notification preferences or by clicking the "unsubscribe" link in any marketing email.

The following communications cannot be opted out of, as they are essential to the operation of the Service and your legal rights:

Order confirmations and shipping notifications
Payment and payout notifications
Security alerts (password changes, suspicious activity)
Legal notices (Terms updates, Privacy Policy changes)
Account-related communications (verification, suspension, termination)

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: You may request a copy of the personal data we hold about you.
Correction: You may request correction of inaccurate or incomplete personal data.
Data Portability: You may request your data in a structured, machine-readable format.
Opt-Out of Marketing: You may opt out of marketing communications at any time.

Right to Deletion: You may ask us to delete your personal data, and we will. Sellers can request this from Dashboard → Settings → Danger Zone, or by writing to us. We will action your request within 30 days and tell you what we did.

We will erase your profile, your login, your streaming keys and your connected-platform credentials. We will not be able to erase everything, and we would rather say so plainly than surprise you later: records attached to completed orders are kept, in a reduced form, because tax law requires us to keep transaction records and because a buyer may still raise a payment dispute. Where a retained record contains information about you that is not actually needed for that purpose, we remove that information rather than the whole record.

If we cannot fulfil part of your request, we will tell you which part, why, and that you have the right to complain to your data protection authority.

To exercise any of these rights, contact us at support@streamster.shop.

8. Data Retention

We do not retain personal data indefinitely. Each category is kept for the period set out in Section 4, on one of the following grounds:

Legitimate Interest: Maintaining platform integrity, preventing fraud, and enabling dispute resolution;
Legal Obligation: Compliance with tax, financial reporting, and record-keeping requirements under applicable law;
Contractual Necessity: Fulfillment of our obligations under these Terms, including commission calculations and transaction records;
Legal Claims: Retaining what is necessary to establish, exercise or defend a legal claim — for example, defending a chargeback.

Active account data (profile information, preferences, session data) is kept for the duration of your account. When an account is closed or erased, that data is deleted; only the categories listed in Section 4 are retained, and only for the reasons given there.

9. Security Measures

We implement robust security measures to protect your data, including:

Encryption: Data encrypted at rest by our cloud infrastructure provider; TLS 1.2+ for all data in transit;
Access Controls: Role-based access controls (RBAC) with principle of least privilege;
Audit Logging: Administrative actions on accounts are recorded in an audit log;
Authentication: Multi-factor authentication available for all accounts; secure password hashing;
Infrastructure: Hosted on enterprise-grade cloud infrastructure with redundancy and disaster recovery;
Regular Reviews: Periodic security assessments and vulnerability scanning.

While we implement commercially reasonable security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

10. Children's Privacy

The Service is not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will restrict the account and delete the personal information we hold, retaining only what Section 4 requires us to keep. If you believe a child under 18 has provided us with personal information, please contact us at support@streamster.shop.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Correct: You may request correction of inaccurate personal information.
Right to Delete: You may request deletion of your personal information. We will action the request within 30 days, subject only to the retention exceptions described in Sections 4 and 7 (records we are legally required to keep, and records needed to defend a legal claim).
Right to Opt Out of Sale: We do not sell your personal information. No opt-out is necessary.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise your California privacy rights, contact us at support@streamster.shop. We will verify your identity before processing your request.

Categories of personal information collected in the past 12 months: Identifiers (name, email, IP address); commercial information (transaction records, purchase history); internet or electronic network activity (browsing history, interactions with the Service); geolocation data (derived from IP address).

12. Cookie Policy

We use the following types of cookies:

Essential Cookies: Required for the Service to function (authentication, session management, security). Cannot be disabled.
Functional Cookies: Remember your preferences and settings (language, theme).
Analytics Cookies: Help us understand how users interact with the Platform to improve performance and features.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Service.

13. Data Breach Notification

In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, Streamster will:

Investigate and take immediate steps to contain the breach and mitigate harm;
Notify affected users via email and/or Platform notification without unreasonable delay and no later than seventy-two (72) hours after becoming aware of the breach, where feasible;
Provide a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach;
Notify applicable regulatory authorities as required by law, including the appropriate state attorneys general and, where applicable, the relevant supervisory authority under GDPR;
Provide recommendations for steps you can take to protect yourself (e.g., changing passwords, monitoring financial accounts).

Streamster maintains an incident response plan and conducts periodic breach preparedness exercises. The notification obligations in this section apply to confirmed breaches involving unencrypted personal information or encrypted information where the encryption key is also compromised.

14. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your jurisdiction. By using the Service, you consent to the transfer of your information to the United States. We make reasonable efforts to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will provide at least thirty (30) days' prior written notice of material changes via email to the address associated with your account and/or by posting a prominent notice on the Platform. The "Last Updated" date at the top of this policy will be revised accordingly. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Streamster
Email: support@streamster.shop
Website: www.streamster.shop