Privacy policy

1. Who is responsible for your data

musicbot.gr is a product of virtualmachine.gr, run by a sole trader in Greece, who is the data controller:

[Full name / business name], [address], VAT number (ΑΦΜ) [VAT number], tax office (ΔΟΥ) [tax office].

Contact for anything about your data: [email protected]. We have no data protection officer, as the law doesn't require one for a service of our size and kind; the owner handles privacy requests personally.

2. What we collect and where it comes from

We collect only what the service needs. Most of it you give us, or it comes from Twitch or Google when you connect them:

• Account: your name, email address, language and profile picture (from you, Twitch or Google), and your password if you create one. We store passwords only as a salted hash, never in readable form.
• Sign-in and security: your passkeys (only their public part), your authenticator-app secret (encrypted), backup codes, and your sessions: when you signed in, the IP address and browser that did it. Failed sign-in attempts are logged with the IP address.
• Linked Twitch and Google/YouTube accounts: their account ID, the permissions you granted, and the access tokens that let the bot act on your channel (encrypted).
• Channels: the channels you connect (ID, name), your bot settings, chat commands, alert rules and moderation rules. Overlay links are stored only as a hash of the secret link.
• Sounds: the audio and video files you upload or import from a link, their name, size, duration and a checksum. When you import from a link, our server downloads the file from that link; the link isn't stored with the sound.
• Your viewers: the bot reads your channel's chat to answer commands and moderate. Messages are processed in memory and not stored, except a short excerpt (up to 200 characters, with the viewer's user name and platform ID) when the bot takes a moderation action. Song requests store the requested title and the requester's user name. Follows, subscriptions and other events are used only to show alerts.
• Plan and payments: your plan and its dates, your orders (amount, VAT, invoice number, PayPal order and subscription IDs), your PayPal payer ID and PayPal email, gifts you send (recipient channel and message), license keys you redeem, and at checkout the time, IP address and browser with which you asked us to start immediately. PayPal handles your card or bank details; we never see them.
• Support: what you write to us through the support form or by email, with your account email and ID.
• Security logs: IP addresses, request times and addresses on our site in our web server and security logs, the IP addresses our firewall (CrowdSec) blocks, and an audit log of important account and payment actions (account ID, time, IP address, browser).

3. Why we use it, and on what legal basis

The GDPR (Art. 6) requires a legal basis for each use:

• Running the service you signed up for (your account, the bot, sounds, alerts, overlays, song requests, moderation): performance of our contract with you (Art. 6(1)(b)).
• Taking payments, issuing invoices and keeping accounting records: the contract (Art. 6(1)(b)) and our legal obligations under Greek tax law (Art. 6(1)(c)).
• Keeping the service and your account secure (sign-in protection, rate limits, blocking attacks, checking new passwords against known data breaches, the audit log): our legitimate interest in a secure service (Art. 6(1)(f)) and our duty to protect your data (Art. 32).
• Service emails (address verification, password reset, important changes to the service or these terms): the contract (Art. 6(1)(b)). We don't send marketing email.
• Processing your viewers' chat and requests: the legitimate interest (Art. 6(1)(f)) of the streamer and of us in running the features the streamer turned on.
• Answering support requests: the contract or, if you aren't a customer, our legitimate interest in answering you (Art. 6(1)(f)).
• Establishing or defending legal claims (for example a payment dispute): our legitimate interest (Art. 6(1)(f)).

4. Who else receives it

We don't sell your data and don't use it for advertising. It is shared only with the services below, each for its own purpose:

• Hosting: our own servers in Greece (EU). The database and the file storage for your sounds run on them; no outside company hosts them.
• Email: our mail server, hosted by Hetzner Online GmbH in Germany, sends our emails and receives support mail.
• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): processes payments and subscriptions. PayPal is responsible for its own processing under its privacy statement.
• Twitch Interactive, Inc. (USA): sign-in with Twitch, reading and writing chat, channel events. Twitch is responsible for its own processing.
• Google LLC / Google Ireland Ltd: sign-in with Google and the YouTube API for your channel and song requests. The overlays you add to OBS use the official YouTube and Twitch players, which connect to those platforms directly.
• Have I Been Pwned (password breach check): when you set a password, only the first 5 characters of its SHA-1 hash leave our server (k-anonymity). Your password, email and account are never sent.
• CrowdSec SAS (France): when an IP address attacks our service (for example by guessing passwords), that IP address and the type of attack are shared with CrowdSec's community blocklist, and we receive their list of known attackers.
• Authorities, courts and our accountant, only when the law requires it or to keep our accounts.

5. Transfers outside the EU

Twitch, Google and PayPal may process data in the USA. Those transfers are covered by the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for companies certified under it, and otherwise by the European Commission's Standard Contractual Clauses (Art. 46 GDPR). Everything else we use stays in the EU (Greece, Germany, France).

6. How long we keep it

• Account, channels, settings and sounds: while your account exists. When you delete your account they are deleted at once, and sound files are removed from storage within minutes. Backups are overwritten within [backup retention, e.g. 30 days].
• Sounds that fail processing, and unfinished uploads: deleted right away (unfinished uploads after 30 minutes).
• Sessions (sign-in IP address and browser): until you sign out or the session expires (at most 30 days); expired sessions are deleted every night.
• Moderation excerpts: 90 days. Song request history: 90 days after the request ends.
• Payment notifications received from PayPal: 180 days.
• Orders, invoices and plan history, with the checkout record: as long as Greek tax law requires, normally 5 years from the end of the year they belong to (longer if a tax audit or dispute is pending). They are kept after you delete your account.
• Audit log: kept as a tamper-proof record of what happened, for at most 6 years. After you delete your account, its entries show only an anonymous account number.
• Web server and security logs: rotated automatically, normally within a few weeks. Firewall blocks of an IP address expire after hours or days.
• Support messages: up to 2 years after your request is resolved.

7. Your rights

Under the GDPR you have the right to: access your data and get a copy (Art. 15); have it corrected (Art. 16); have it deleted (Art. 17); restrict its use (Art. 18); receive it in a machine-readable format and take it elsewhere (Art. 20); object to uses based on our legitimate interest (Art. 21); and withdraw any consent you gave, at any time.

Most of this you can do yourself in Dashboard → Account: change your name, email and password, "Download my data" (a JSON file of everything we store about you) and "Delete my account". For anything else, email [email protected] from your account's email address. We may ask you to confirm it's you. We reply within one month; if a request is complex we may need up to two more months and will tell you why within the first month. It's free.

8. Complaints

If you think we handle your data wrongly, please tell us first so we can fix it. You also have the right to complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, Greece, www.dpa.gr, or to the authority of the EU country where you live or work.

9. Age

musicbot.gr is for people aged 15 and over (the age of digital consent in Greece, Law 4624/2019 art. 21). Paid plans can only be bought by adults (18+). You also need to meet Twitch's and YouTube's own age rules. If we learn that someone under 15 has an account, we delete it.

10. Cookies

We use only cookies that are strictly necessary for the site to work, so we don't ask for consent (Greek Law 3471/2006 art. 4(5), ePrivacy Directive art. 5(3)). No analytics, tracking or advertising cookies. They are set on musicbot.gr and its subdomains:

• __Secure-better-auth.session_token: keeps you signed in. Until you sign out, at most 30 days (or until you close the browser, if you choose so).
• __Secure-better-auth.session_data: a signed, short-lived copy of your session that makes pages faster. 60 seconds.
• __Secure-better-auth.dont_remember: set only if you choose to stay signed in until the browser closes. Until the browser closes.
• __Secure-better-auth.state: protects sign-in with Twitch or Google against forgery. 5 minutes, during sign-in.
• __Secure-better-auth.two_factor: remembers that you passed the password step while you enter your authenticator code. 10 minutes.
• __Secure-better-auth-passkey: the one-time challenge for a passkey sign-in. 5 minutes.
• mb_locale: your language choice. 1 year.
• mb_next (browser session storage, not a cookie): the page to return to after a two-step sign-in. Until you close the tab.

11. How we protect your data

Encrypted connections (HTTPS) everywhere; passwords stored only as salted hashes and checked against known breaches; two-step sign-in and passkeys; Twitch/Google tokens and authenticator secrets encrypted at rest; overlay links and license keys stored only as hashes; a tamper-evident audit log; firewalls and automatic blocking of attackers; uploaded files re-encoded in isolation; link imports allowed only from public internet addresses; and access to the servers limited to the owner. If a data breach puts your data at risk, we notify the Hellenic Data Protection Authority within 72 hours and tell you without delay when the risk to you is high.

12. Automated decisions

We don't profile you and we make no decisions about you by automated means that have legal or similarly significant effects (Art. 22). The bot's chat moderation only applies the rules the streamer configured (for example a short timeout for certain characters); the streamer's moderators can undo it.

13. Changes to this policy

When we change this policy we update the date at the top. If a change matters for how we use your data, we tell you by email or in the dashboard before it takes effect.