YOUR TRUST. OUR RESPONSIBILITY.
Privacy Policy
Last updated: 2026-11-03
1. Who is responsible
Systema Systems operates cloudstreamer.me from House 77, Road 13, Sector 13, Uttara, Dhaka 1230, Bangladesh. For our own account, security, support, and platform billing purposes, we act as a data controller. Contact support@cloudstreamer.me or use our privacy request form.
For audience data processed solely on a streamer's instructions, the streamer may be the controller and we may act as processor. The actual role depends on the processing. Audience members can contact the streamer or submit a request here so we can help identify the responsible party.
2. Information we process
- Account information: name, email, password hash where password login is used, profile slug, introduction, and account status.
- Connected-account information: provider identifiers, account identifiers, permissions, and encrypted authorization tokens when connections are enabled.
- Content metadata: titles, descriptions, album membership, publication preferences, thumbnails, access settings, and broadcast references. Video media resides in the streamer's own Cloudflare account when that integration is used.
- Audience and transactions: names and emails provided by streamers or viewers, access associations, delivery preferences, and purchase records when those features are enabled. A streamer may supply audience information before the viewer contacts us.
- Platform subscriptions: checkout references, customer and subscription identifiers, subscription status, and period dates. Payment-card details are entered with the payment provider and are not stored in our application database.
- Security and support information: session data, request timestamps, technical information such as IP addresses in hosting/session logs, and information you send with support or privacy requests.
Some described features are planned or not yet connected. We only process the relevant information when the feature is actually used. Please do not send passwords, identity-document copies, or payment-card numbers through the privacy form.
3. Purposes and legal bases
| Purpose | Basis where GDPR applies |
|---|---|
| Provide accounts, requested features, and platform subscriptions | Performance of our contract with you, or steps you request before entering it |
| Protect accounts, investigate abuse, and maintain service reliability | Legitimate interests in operating a secure service, balanced against your rights |
| Meet applicable tax, accounting, and regulatory duties | Compliance with the applicable legal obligation |
| Handle support, privacy requests, and legal claims | Contract, applicable legal obligations, or legitimate interests as appropriate to the request |
| Process audience information on a streamer's instructions | The streamer's documented lawful basis and our applicable processing agreement |
| Any future optional marketing or tracking requiring consent | Your separate, freely given consent before that activity starts |
Accepting service terms does not constitute consent to all processing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Required account details are needed to provide the requested service; optional profile information can be left blank.
4. Sharing and international processing
Cloudflare receives data necessary for the connected streaming services you use. Polar processes platform checkout and subscription information as merchant of record. If streamer PayPal purchases are enabled, PayPal processes their payment information. Our hosting and any configured email providers may process operational data. We do not sell personal information.
The operator is in Bangladesh, and provider infrastructure may process information outside your country or the EEA. Transfers subject to GDPR require a valid transfer mechanism, such as an applicable adequacy decision or appropriate contractual safeguards, and any necessary supplementary measures. Contact us for information about the safeguards relevant to your processing and our EU representative where required. Provider privacy information: Cloudflare, Polar, and PayPal.
5. How long information is kept
We keep account and content metadata while needed to provide your account and requested features. After an account-closure or deletion request, we review what can be erased and what must be retained. Tax and payment records may need to remain for the legally required period; security and dispute records are limited to what is necessary for their purpose. Privacy-request records are retained as necessary to resolve the request and demonstrate its handling, subject to applicable legal obligations and claims.
Backup copies may remain until the relevant backup cycle expires and must not be restored into ordinary use after deletion without applying the deletion again. Ask support for the retention periods relevant to your records. Cloudflare media and payment-provider records have separate retention controls; removing a platform record does not automatically delete them.
6. Cookies and browser features
The application uses necessary first-party session and anti-forgery cookies for sign-in, security, and form submissions. Session lifetime follows the server's configured session duration, normally 120 minutes of inactivity. We currently install no optional analytics or advertising trackers. Site fonts and the demo portrait are served from our own domain. If optional tracking is added, it must remain off until any required consent is given, with a way to withdraw that consent. The Cookie preferences control lets you revisit your choice at any time. We store your current notice choice, policy version, and timestamp in first-party browser storage for up to 180 days, without a visitor identifier. Both choices leave optional cookies off because none are used. A future optional purpose requires a fresh choice. Third-party checkout pages have their own cookie information.
Your camera and microphone are requested only when you choose a feature that needs them. Browser permission is separate from consent to unrelated processing. Initial video-player loading and audience checks depend on the selected feature; no live broadcasting should be inferred from a demo preview.
7. Your rights
Where GDPR applies, you can request access, correction, erasure, restriction, portability where applicable, or object to processing, including direct marketing. You can withdraw consent for processing based on it. Rights have legal conditions and exceptions. We do not use solely automated decisions with legal or similarly significant effects as part of the current platform.
Use the privacy request form without creating an account, or email us. We may need proportionate information to verify your identity. We aim to respond without undue delay and normally within one month of receipt. If a lawful extension is necessary, we will explain it within that initial period. If a request cannot be granted, we will explain the reason and available remedies.
You may lodge a complaint with your local supervisory authority, including in the EEA country where you live or work or where the alleged infringement occurred. See the EEA supervisory authorities. You do not have to contact us first.
8. Access, security, and updates
Signed-in users can download account profile and creator metadata from the privacy request page. This export excludes credentials, other people's audience data, and video files; request any additional personal data through the same form. Passwords are hashed, provider tokens are encrypted, and dashboard access is scoped by role and account. No system is risk-free; contact support about suspected exposure. We will update this notice when processing materially changes and provide notice where required.