Privacy policy

Who we are

NOALBS Cloud is made and run by Brian Spit, known as 715209, from the Netherlands. That makes us responsible (the “controller”) for the personal data described here.

For anything about your data, email [email protected]. We answer within a month.

What we keep and why

Your account

When you sign in with Twitch, Kick or YouTube we keep that account’s ID, username and profile picture (on YouTube: your channel’s ID, handle and picture), to sign you in and to show who did what in your workspace. We don’t ask for your email address, and we don’t keep the sign-in tokens. Why: to provide the service you signed up for (GDPR art. 6(1)(b)).

Sessions

For each browser you sign in with: when, which browser (its user agent) and when it was last used, so you can see and sign out your sessions. A session cookie keeps you signed in. Why: to provide the service and keep your account safe (6(1)(b) and 6(1)(f)).

Workspaces and switchers

Your workspaces, their members and invites, your switchers and their settings, and your stream servers. Your OBS password, your BELABOX remote secret URL (if you connect a BELABOX), your Moblin remote control password (if you connect Moblin) and the passwords and API keys of your stream servers are stored encrypted; stream server URLs, which can contain a key, are only shown to people who manage the switcher. Why: to provide the service (6(1)(b)).

Organizations and managed workspaces

A company that runs workspaces for its customers is an organization: we keep its name, who is on its team (their account and role), its team invites and the limits we gave it. A workspace an organization manages (a client workspace) belongs to the organization and is listed under it, together with the people who joined it. The organization’s admins can read an audit log of what its team and its customers changed in it (who, what, when: creating, renaming or deleting a client, invite links, who joined, left or was removed, roles, allocations, settings and its chat bot), kept for a year with the names as they were then. See “When an organization manages your workspace” below. Why: to provide the service (6(1)(b)).

Stream data

While your OBS is connected we read your stream server’s stats every second (bitrate, latency, and what the server reports, which can include stream names or the IP address of the device that’s streaming), and OBS’s scenes, sources and whether you’re live or recording. While you stream we save this as stream history, with an activity log of scene switches and who made them. Preview images of your scene are passed straight to the dashboard and not stored. While you aren’t streaming they go only to the people the workspace’s owner (or the organization that manages it) chose (nobody until they change it), and never to NOALBS support. Who is watching is kept in memory for a few seconds, to show on the Live page. With a BELABOX connected we also read its status (network interfaces and their throughput, mobile network and signal, sensors, notifications) and pass it to the dashboard without storing it (IP addresses stay on our server); starting, stopping and changing it are logged in the activity log. While someone who controls your switcher has its settings open, we also pass on the WiFi networks it sees and has saved, its hotspot’s name and its modems’ settings and operators; network names can say where you are, so support doesn’t see these. The WiFi, hotspot and modem passwords you or the BELABOX give us are kept only in our server’s memory, are never shown, and are gone when the connection to BELABOX Cloud restarts. With Moblin connected, your phone sends us its status (live or recording, bitrate, bonding, battery and heat, its scenes and bitrate presets), which we pass to the dashboard without storing it; its Wi-Fi name and location are ignored, and so is the Twitch access token Moblin can send to remote controls (we never read it). Going live, stopping and changing it are logged in the activity log. Markers you or a moderator add to a stream (the text typed, the time, and the name of who added it, such as a chat display name) are saved with that stream. Why: to provide the service (6(1)(b)).

Chat

When you link a Twitch, Kick or YouTube channel, our bot reads the chat in that channel to find commands and replies there (on YouTube only while you’re live: we look for your live broadcast while your OBS streams). Chat messages aren’t stored. We keep the channel’s ID and name, the access you granted (Kick’s and YouTube’s tokens, encrypted), and the chatters you choose to ignore. Why: to provide the chat commands you turned on (6(1)(b)).

Your chatters

People in your chat aren’t NOALBS users, but when one of them uses a command, their display name goes into your activity log with what the command did (and into the stream’s markers for !marker), and their message ID is kept for 10 minutes so it’s handled only once. To check their role we look at the badges the platform sends with the message. Names you ignore are kept on the Chat page. Why: the streamer’s legitimate interest in seeing who controlled their stream (6(1)(f)). Chatters can ask us, or the streamer, to remove their name.

Payments

Paid plans are handled by Stripe, which processes your payment details; we never see your card. We keep the Stripe customer ID and your subscription and plan. The customer belongs to the workspace: when its owner hands it to another member, we remove their cards, billing email, address and tax IDs from it at Stripe. Invoices already issued keep the details that were on them. Why: to provide the service (6(1)(b)) and to keep financial records as Dutch tax law requires (6(1)(c)).

Server logs

Our servers log errors and events to keep NOALBS Cloud running and secure. These logs mostly contain internal IDs of accounts, workspaces and switchers, and the platform ID of a chatter who ran a command; when something fails they can include a name involved, such as a workspace’s or a chatter’s. They don’t contain IP addresses, chat messages or passwords. We also record traces: which page or chat command was used, by which account ID, and how long each step took, so we can find what’s slow or broken. Logs and traces are sent to Grafana Labs and Axiom (below) to search them. To stop abuse we count requests per IP address, in memory only, for a few minutes. Why: our legitimate interest in running a secure, working service (6(1)(f)).

How long we keep it

• Your account, workspaces and switchers: until you delete them.
• Sessions: until you sign out, or after 30 days without being used.
• Stream history: as long as your workspace’s plan says (7 days on Free, 90 days on Pro), counted from the end of each stream, or in a workspace managed by an organization, as long as that organization’s limits say. This includes its markers.
• The activity log: as long as the stream history, and at least 30 days.
• Ignored chatters and linked channels: until you remove them.
• The support access log and past support permissions: one year.
• Our staff’s own log of what they did, such as suspending a workspace: one year.
• Invoices and payment records, kept at Stripe: 7 years, as Dutch tax law requires, even when the workspace is deleted.
• Server logs on our servers: they’re overwritten as they fill up and removed whenever we update NOALBS Cloud. Logs and traces at Grafana Labs: 14 days; at Axiom: 30 days.

Deleted data is removed from our database straight away.

Cookies and local storage

We use one cookie to keep you signed in (id; your browser keeps it up to 400 days, but the sign-in behind it ends after 30 days without use) and short-lived cookies while you sign in or connect an account. Your browser also remembers a few preferences for you, like the theme and which scenes and sources you’ve hidden; those stay on your device and aren’t sent to us. All of this is needed for NOALBS Cloud to work, so we don’t ask for consent. We don’t use analytics, ads or trackers.

When NOALBS support looks at your workspace

NOALBS staff can only open your workspace with your permission. Owners and admins give it under Settings → General → NOALBS support access, for 24 hours or 7 days, to only look or to also change switchers and their settings, and can end it at any time. Support never gets your members, billing, or the power to delete or hand over the workspace.

Only for abuse, a legal obligation or a security problem can staff open a workspace without permission: for one hour, with a reason, to look or, when something has to be stopped, to act on its switchers (never its members, billing or secrets). Its owners and admins see who did it, how and why until they mark it as seen.

Everything staff do in your workspace is listed there for you: who, what, on which switcher, when, and under which permission (looking around is listed once an hour per page, every change each time). Changes also show in the activity log as “NOALBS support”. Staff see your stream servers’ stats URLs and settings (a wrong stats URL is the most common problem), but never their passwords or API keys, your raw stats, Moblin password or browser-source link. They see the OBS preview only while you’re live. Why: to help you when you ask, and to keep the service working and safe (6(1)(b) and 6(1)(f)).

To stop abuse or protect an account, staff can also suspend a workspace (its switchers pause and its chat commands stop; its members see the reason), sign an account out everywhere, disable an account (it can’t sign in; we keep the reason), unlink a chat channel, or make a switcher’s browser source reconnect. What touches a workspace shows in its support log, and every staff action is kept in a staff log for a year so staff can check each other. Why: to keep the service and its users safe (6(1)(f)).

When an organization manages your workspace

Some workspaces are managed by an organization, such as a streaming host or an agency. It owns the workspace and pays for it, and you join with the invite link it gave you. Its team (the people it added to NOALBS Cloud) can then see and run everything in that workspace without asking you: your switchers and their settings, your members, your stream servers’ stats URLs and settings, your stream history and the activity log, and they can control your OBS and the devices you connected, as you can. The passwords and API keys of your stream servers are never shown to anyone, the team included. You join as an admin: you run the workspace with them, but you never see billing and you can’t delete the workspace or hand it over.

The workspace shows who manages it (Settings → General and its menu). You can leave it at any time, which ends your access to it, and you can still create workspaces of your own, which no organization can see. The organization keeps a line when you join, rename the workspace, or invite, remove or change the role of someone in it. What the organization does as a team is listed in the activity log under the team member’s name and the organization’s (like “kate (Nomad Hosting)”). If you leave, the organization keeps the workspace and what is in it; ask it to delete what you don’t want kept. Why: the organization runs the workspace and the service for you (6(1)(b)); it is responsible for what its team does with it.

The organization can connect a chat bot account of its own, which then answers in the chat of the channels you link instead of the shared NOALBS bot (we keep that account’s access, Kick’s and YouTube’s tokens encrypted, for the organization). It also decides whether you may connect a bot account of your own; if it doesn’t allow it, one you connected stays stored but doesn’t answer.

NOALBS staff can suspend an organization (every switcher in its workspaces pauses and their chat commands stop; the team sees the reason, its customers only that their workspace is paused and who manages it). That is recorded in the staff log like any other staff action.

Who else handles your data

• Our hosting provider, Hetzner Online GmbH, runs our servers in Nuremberg, Germany, in the EU.
• Cloudflare carries all traffic between you and our servers, to keep the site fast and protected, so it sees your IP address and what you send. Cloudflare may process data in the United States, under the EU-US Data Privacy Framework and the EU’s standard contractual clauses.
• Stripe processes payments for paid plans. Stripe may transfer data to the United States, under the EU-US Data Privacy Framework and the EU’s standard contractual clauses.
• Grafana Labs stores our server logs and traces (described above) in the EU, for 14 days, so we can find and fix problems. Grafana Labs is a US company, so the data may also be reached from the United States, under the EU-US Data Privacy Framework and the EU’s standard contractual clauses.
• Axiom stores the same logs and traces in the EU (Frankfurt), for 30 days, while we compare it with Grafana Labs. Axiom is a US company, so the data may also be reached from the United States, under the EU’s standard contractual clauses.
• Twitch, Kick and YouTube sign you in and carry chat. What you do there is covered by their own privacy policies. We use YouTube through the YouTube API Services, so by using it with NOALBS you also agree to the YouTube Terms of Service, and Google’s handling of your data is covered by the Google Privacy Policy.
• BELABOX Cloud, only if you connect a BELABOX: while your OBS is open we connect to it with your secret URL to read your BELABOX’s status and send it the commands you give. What BELABOX Cloud keeps is covered by its own policy.
• The stream servers you add: we ask them for stats from the address you give, every second while your OBS is connected.
• Migadu (Migadu-Mail GmbH, Switzerland) hosts our email, so it receives what you send to [email protected]. The EU recognises Switzerland as protecting personal data adequately.

We don’t sell your data or share it with anyone else, unless the law requires us to.

Your rights

• Get a copy of your data: under Account, choose Download my data for your account, sign-ins, workspaces, switchers and their settings, billing, and the records that name you (invites, chat links, support access, organization and staff logs), and Download stream history for the stream history, stats, markers and activity log of your own switchers. Both are JSON. Passwords, API keys and tokens are left out. Activity logs and markers in other people’s workspaces record your display name, not your account, so we can’t reliably find them for you. If you think we hold something else about you, email [email protected] and tell us where to look.
• Delete your account: under Account, choose Delete account. Workspaces you own alone are deleted with it. Your name stays in the activity logs and markers of workspaces you were a member of until they expire, as the record of who did what there.
• Correct your data: your name and picture come from Twitch, Kick or YouTube and update each time you sign in; you can change everything else in the dashboard.
• Withdraw access: unlink channels on the Chat page, or revoke NOALBS in your Twitch or Kick settings, or at Google’s third-party connections for YouTube.
• Object to or restrict how we use your data, for anything the dashboard doesn’t cover: email [email protected].

If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We’d appreciate hearing from you first.

Security

Everything travels encrypted (HTTPS), passwords, API keys and chat tokens are stored encrypted, and only the people who run NOALBS Cloud can reach the servers.

Age

NOALBS Cloud isn’t meant for anyone under 16.

Changes

When this policy changes we update the date at the top, and tell you in the dashboard or on our Discord if it matters.