Privacy policy

This English version is a courtesy translation. The legally binding version is the German one.

As of: 11.07.2026 · applies to vod4u.de

1. Controller

The controller responsible for the processing of data on this website is:
Paul Buyse, VOD4u, Heimstättenstraße 3 · 82166 Gräfelfing
E-mail: contact@vod4u.us

2. What data we process

• Account data: name, e-mail address, encrypted password — to provide your customer account.
• Channel data: your Twitch/Kick channel name and the link to your YouTube channel as well as your upload settings.
• YouTube access token: an OAuth token granted by you via Google login (stored encrypted) so that we can upload VODs to your YouTube channel on your behalf.
• Channel statistics (YouTube Analytics): views, watch time and estimated revenue of your connected channel — shown in your portal and used for the agreed revenue-share billing; cached for at most 6 hours.
• Payment data: processed exclusively by our payment service provider Stripe; we do not store full card details.
• Usage/log data: technical logs (e.g. the time of actions, job status) for the provision and security of the service.

3. YouTube / Google API Services

VOD4u uses the YouTube Data API to upload videos to your own YouTube channel on your behalf and to read the connected channel (e.g. the channel title). With your consent when connecting, VOD4u additionally uses the YouTube Analytics API to read the statistics of your own channel (views, watch time, estimated revenue) — we display them to you in your portal and use the estimated revenue for the agreed revenue-share billing. By using VOD4u you agree to the YouTube Terms of Service. The Google Privacy Policy also applies.

VOD4u's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use the access solely to provide the feature you requested (the automatic upload of your VODs, the statistics/revenue display and the billing). We do not share this data with third parties (other than the sub-processors required for the service), do not use it for advertising, and do not allow humans to read the data, except with your consent, for security purposes, or where required by law.

You can revoke the connection at any time – in your portal or in your Google account permissions. After that we delete the stored access token.

4. Data security — protection of sensitive data

We protect sensitive data – in particular the data obtained from Google APIs (your OAuth access/refresh token and the channel information required for uploading) – with the following mechanisms:

• Encryption in transit: all communication with your browser and with the Google/YouTube APIs takes place exclusively over encrypted HTTPS/TLS connections.
• Secure storage: OAuth tokens are stored server-side in an access-restricted database that is not publicly reachable; they are never exposed to the browser, never written to logs and never sent by e-mail. Passwords are stored exclusively as salted hashes (bcrypt), never in plain text.
• Access control: only authorized administrators can access production systems and stored tokens, following the principle of least privilege and via secured, key-based connections.
• No disclosure: Google user data is never sold, never used for advertising and never transferred to third parties (except for the contractually bound processors listed in section 6, where strictly necessary for operating the service).
• Deletion & revocation: if you disconnect the YouTube link or delete your account, we revoke the token with Google and delete it from our database without delay. You can additionally revoke access yourself at any time via your Google account permissions.
• Data minimisation: we only request the minimum permissions (scopes) required. Temporary video files are only kept for the duration of processing and are removed afterwards.
• Incident notification: in the event of a personal data breach we notify affected users and the competent supervisory authority in accordance with Art. 33/34 GDPR.

5. Twitch / Kick

To detect new VODs we retrieve publicly available information about your Twitch or Kick channel (via the official or publicly accessible interfaces). No login data for these platforms is stored with us.

6. Recipients / processors

• Google/YouTube (upload & analytics) – Google Ireland Ltd.
• Stripe (payment processing) – Stripe Payments Europe Ltd.
• Hosting of the website/database (All-Inkl / ALL-INKL.COM) and of the processing infrastructure (Hetzner Online GmbH, Germany).
• Resend (transactional e-mails).

7. Legal bases

Processing for the performance of a contract (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR, e.g. the YouTube link), for compliance with legal obligations (lit. c), and on the basis of our legitimate interest in a secure, functioning service (lit. f).

8. Cookies

We use technically necessary cookies (e.g. a session cookie so that you stay logged in). These are required for operation and do not require consent. We do not set tracking or marketing cookies.

9. Retention period

We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention periods apply. After you terminate your account, the associated data is deleted or anonymized, unless a retention obligation prevents this.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw a granted consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise these rights, please contact contact@vod4u.us.