Privacy Policy

1. Controller

2. Hosting and server logs

When you access 7Overlay, the hosting infrastructure necessarily processes technical request data such as your IP address, date and time, requested URL, referrer, browser/user-agent information and response status. This is required to deliver the service, prevent abuse and maintain security (Article 6(1)(f) GDPR). Log data is retained only as long as necessary for these purposes and legal obligations, then deleted or anonymised.

3. Twitch sign-in and account data

Authentication is provided through Twitch OAuth. Depending on the permissions you approve, we receive and process your Twitch user ID, login name, display name, profile image, OAuth tokens and information required for enabled Twitch features such as follower, subscriber, moderation or channel-event data. Processing is necessary to provide the account and features you request (Article 6(1)(b) GDPR). OAuth tokens are stored encrypted. Twitch processes data under its own privacy terms and may process it outside the EEA.

You can revoke 7Overlay's Twitch access in your Twitch account settings. Revocation may disable connected features but does not automatically erase data already stored by 7Overlay.

4. 7TV and StreamElements integrations

If you choose to connect or use these features, 7Overlay exchanges the identifiers, tokens, emote data, channel data and event information needed for the requested integration with 7TV and/or StreamElements. The legal basis is performance of the service you request (Article 6(1)(b) GDPR); security and reliable operation are also legitimate interests (Article 6(1)(f) GDPR). These providers act under their own privacy policies.

5. Overlays, chat bots and configurations

We store the overlay and game settings you create, including widget IDs, text, counters, timers, permissions, emote selections, bot status and event history. Where chat functions are enabled, Twitch usernames, display names and chat or event information may be processed in real time so the bot or overlay can function. Processing is based on Article 6(1)(b) GDPR for registered users and Article 6(1)(f) GDPR for other chat participants, with the legitimate interest of providing the stream feature selected by the channel owner.

6. Uploaded fonts

Fonts supplied with the interface (including Nunito and Pacifico) are hosted locally; visiting 7Overlay does not contact Google Fonts for them. If you upload a custom font, the file, its filename, font metadata and association with your account are stored and served so your overlays can display it (Article 6(1)(b) GDPR). Do not upload a font unless its licence permits this use.

7. Sessions, cookies and local storage

7Overlay uses session identifiers and browser storage for sign-in, security and interface preferences such as theme and language. These technologies are strictly necessary to provide the service you request and are used under Section 25(2) no. 2 TDDDG; related personal-data processing relies on Article 6(1)(b) or (f) GDPR. We do not currently use advertising or optional analytics cookies. If that changes, optional technologies will not be activated without any consent required by law.

8. Recipients and international transfers

Data is disclosed only where necessary to our hosting and technical service providers, the integrations you activate, professional advisers, or public authorities where required by law. Twitch, 7TV and StreamElements may process data in countries outside the EEA. Where required, transfers are based on an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another mechanism permitted by Chapter V GDPR.

9. Retention

Account and configuration data is generally retained while your account or the relevant feature remains active. Expired server-side sessions are deleted automatically. Integration tokens are retained until the connection is removed, the account is deleted or they are no longer required. Individual records may be kept longer where necessary to establish, exercise or defend legal claims or meet statutory retention duties.

10. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction, data portability and objection under Articles 15–21 GDPR. Where processing is based on consent, you may withdraw it at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority, in particular the authority for your habitual residence, workplace or the place of the alleged infringement.

To exercise your rights, email vgregor.business@gmail.com. We may need to verify your identity before acting on a request.

11. Security and required data

We use appropriate technical and organisational measures, including encrypted storage for OAuth tokens and restricted session cookies. Data required for Twitch authentication and core service functions must be provided if you wish to use those functions; there is no statutory obligation to provide it. We do not use solely automated decision-making that produces legal or similarly significant effects.

12. Updates

We may update this policy when the service, providers or legal requirements change. The current version and its revision date are always published on this page.