This Privacy Policy describes how Kappapps (the "Service") collects and processes your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act. It supplements our Cookie Policy. This is a courtesy translation; the French version prevails.
1. Data controller
The data controller is Kappapps / AProds, a sole proprietorship (see legal notice). For any question about your data or to exercise your rights: contact@aprods.fr
2. Data collected
- Twitch identification data: ID, username (login), avatar and, where you authorise it, email address, transmitted when signing in via Twitch (OAuth).
- Account and connection data: authentication tokens, preferences, the state of your Channel, roles and access (including beta access).
- Payment data: for subscriptions, payment data is collected and processed directly by Stripe; we only receive limited information (subscription status, billing dates, customer/subscription identifier).
- Content you provide: uploaded media, configurations, announcements, and requests sent to AI features (prompts).
- Player / viewer data: Twitch ID, internal currency, inventory and participation on a Channel.
- Bot social memory (when enabled by the streamer): short summaries derived from public chat messages, memory category, usernames/aliases and technical references to at most three messages. Full transcripts and the sensitive categories excluded by the Service must not be retained.
- Channel-event memory (when enabled separately by the streamer): short summaries of results, events, community moments or ongoing stories derived from public chat, without attaching them to a viewer profile.
- Technical data: connection logs, usage data and cookies (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Service and managing the account | Performance of the contract (Art. 6.1.b GDPR) |
| Managing subscriptions, payments and invoicing | Performance of the contract / legal (accounting) obligation |
| AI-assisted features (processing of prompts) | Performance of the contract |
| Optional bot social memory: providing temporary contextual references across streams | Legitimate interest in providing the feature enabled by the streamer, subject to the viewer's right to object |
| Optional channel-event memory: temporarily retaining the overall context of a stream | Legitimate interest in providing the feature enabled separately by the streamer |
| Security, fraud prevention and proper operation | Legitimate interest (Art. 6.1.f) |
| Service improvement and statistics | Legitimate interest / consent (cookies) |
| Service-related communications / newsletter | Consent or legitimate interest |
| Compliance with legal obligations | Legal obligation (Art. 6.1.c) |
4. Recipients and processors
Your data is intended for the publisher and, where applicable, for the providers (processors) that contribute to the operation of the Service, within the limits of their tasks:
| Provider | Role |
|---|---|
| Twitch (Twitch Interactive, Inc.) | Authentication, webhooks, stream integration |
| Stripe | Payment and subscription management |
| Infomaniak (Infomaniak Network SA) | Platform hosting |
| Bunny.net | Media delivery (CDN) |
| Pusher | Real-time communication |
| OpenAI | Generative AI features, including social-memory extraction and selection when enabled |
| ElevenLabs, Google Cloud (TTS) | Text-to-speech |
| Discord, Mattermost | Communication / notifications (depending on use) |
We do not sell your personal data. It may be disclosed to authorities where required by law.
5. Transfers outside the European Union
Some providers (for example in the United States) may process data outside the European Union. In that case, such transfers are governed by appropriate safeguards: the European Commission's standard contractual clauses and/or adherence to the EU–US Data Privacy Framework, in accordance with Articles 44 et seq. of the GDPR.
6. Retention periods
Data is kept for as long as necessary for the purposes pursued: for the duration of your account, then archived or deleted within reasonable timeframes after its closure. Billing data is retained in accordance with accounting and tax obligations (in principle up to 10 years). Technical logs are kept for a limited period for security purposes.
Viewer social memory is automatically rotated by stream sessions: depending on its type, an active memory
expires after 2 to 8 streams, with an absolute cap of 10 streams and 90 days. The separate channel-event
memory expires after 4 to 6 streams, with an absolute cap of 8 streams and 90 days. Candidates and technical
proof references are purged within 7 days. Related requests are sent to OpenAI with store:false;
this disables retrievable response storage but is not a “Zero Data Retention” guarantee, as the OpenAI
account's applicable retention and abuse-monitoring rules still apply.
7. Your rights
In accordance with the GDPR, you have the following rights:
- right of access, rectification and erasure;
- right to restriction and right to object to processing;
- right to data portability;
- right to withdraw your consent at any time, where processing is based on it;
- right to set guidelines on the fate of your data after your death.
For social memory, the viewer dashboard also lets you access and erase your memories for a Channel, or object to further collection. If you object, a minimal tombstone containing only the Channel and Twitch ID is retained to prevent collection from starting again.
You may exercise these rights by writing to contact@aprods.fr. You also have the right to lodge a complaint with the CNIL (French data protection authority, www.cnil.fr) or your local supervisory authority.
8. Security
The publisher implements reasonable technical and organisational measures to protect your data against unauthorised access, loss or disclosure. As no transmission over the Internet can be guaranteed to be fully secure, the publisher cannot guarantee absolute security.
9. Minors
The Service is intended for users who meet Twitch's age requirements (at least 13 years old, and subject to the rules applicable in their country). The publisher does not knowingly collect data from children below the required age; where applicable, such data will be deleted.
10. Changes
This Policy may be updated to reflect changes to the Service or to regulations. The date of the last update appears at the top of the page.