Privacy Policy

Controller

The controller of your personal data is:

• Emir Achour EI, trade name Semirprod (micro-entreprise)
• 2 rue Charles Baudelaire, 76100 Rouen, France
• SIRET: 982 900 144 00014
• Email: contact@semirprod.fr

Semirprod has not appointed a data protection officer: its activity does not fall within any of the cases where Article 37 of the GDPR requires one. Requests are handled at the address above.

Two distinct roles

This policy describes what Semirprod does with your own data: account, billing, support, browsing. Semirprod is then the controller.

The situation is different for third-party data that you route through our services: messages from your viewers, people you film or record. For that data, you are the controller and Semirprod is only a processor: it does nothing with it other than perform the service you have requested. The corresponding commitments are set out in Article 12 of the General Terms and Conditions of Sale, which constitute a data processing agreement within the meaning of Article 28 of the GDPR.

In that case, it is up to you to inform these people and to have a legal basis, in particular for recording the people filmed.

Data collection

We collect the information you provide to us directly, in particular when you:

• Create an account on our platform
• Fill in our contact form
• Subscribe to our services
• Browse our website (with your consent for analytics cookies)

Types of data collected

We collect the following types of information:

• Identification data: surname, first name, email address
• Billing data: address, postcode, city, country, VAT number (for businesses)
• Communication data: messages, quotation requests
• Technical data: IP address (anonymised for statistics and forms; retained for login sessions for security purposes), browser type, pages visited (audience measurement only with consent)
• Payment data: processed directly by Stripe; we do not store your bank details

Mobile application

The Semirprod mobile application will be released later. This policy will be supplemented before its release.

Live streaming, chat and recordings

This processing concerns the data of your viewers and guests. You are responsible for it; Semirprod acts as processor.

• Chat messages: aggregated from the platforms you connect (Twitch, TikTok, YouTube). The message, the username and the public identifier of its author are processed, as provided by the platform.
• Audio and video streams: routed, transcoded and streamed to the destinations you configure. They are not retained unless you request a recording.
• Recordings and clips: kept in your workspace for as long as you keep them. You can delete them at any time.
• Technical streaming data: IP addresses of the participants in a direct link and connection logs, needed to establish the link and diagnose an incident.

Legal bases and purposes of processing

Your data is processed on the following legal bases (Art. 6 GDPR):

• Performance of the contract (Art. 6.1.b): management of your account, provision of the services, billing
• Consent (Art. 6.1.a): analytics cookies (PostHog), marketing communications
• Legitimate interest (Art. 6.1.f): website security, fraud prevention, handling of your support requests
• Legal obligation (Art. 6.1.c): retention of invoices, tax obligations

Processors and data transfers

We use the following processors to process your data:

• Stripe (United States, standard contractual clauses): payment processing
• PostHog (European Union): audience analytics (only with consent)
• Discord (United States, standard contractual clauses): role synchronisation if you link your Discord account (Discord identifier and username)
• Twitch / TikTok / YouTube (United States, standard contractual clauses): live chat aggregation if you connect these platforms
• Google (United States, standard contractual clauses): audience measurement and advertising measurement, only with your consent
• Hetzner Online GmbH (Germany and Finland): hosting of the servers, the database and the backups
• o2switch (France): delivery of the emails we send you
• Cloudflare (United States, standard contractual clauses): storage of your profile picture

No data is sold to third parties. Transfers outside the European Union are governed either by an adequacy decision of the European Commission or by standard contractual clauses (Art. 45 and 46 GDPR).

Retention periods

Your data is retained for the following periods:

• Account data: lifetime of the account; an account inactive for 24 months is deleted automatically, after a notice email and a 30-day grace period
• Contact messages: 6 months
• Quotation requests: 3 years from the request
• Audit logs: 2 years (anonymised afterwards)
• Billing data: 10 years (legal obligation)
• Your cookie choice: 13 months, after which you are asked again
• Proof of that choice: 2 years
• Expired sessions: deleted automatically
• Recordings and clips: kept for as long as you keep them in your workspace, deleted as soon as you delete them, and at the latest at the end of the export period provided for on cancellation
• Aggregated chat messages: kept for the duration of the live stream and while it is made available in your workspace; you decide when they are deleted
• Streamed audio and video: not retained, unless you request a recording
• Backups: when you request the deletion of your data, it is erased immediately from our active systems. Our backups are kept for a maximum of 5 days and then destroyed; your data is purged from them within that period, and is never reintroduced in the event of a restoration.

Your rights (Art. 15 to 22 GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of your data
• Right to rectification (Art. 16): correct inaccurate data
• Right to erasure (Art. 17): delete your account and your data
• Right to data portability (Art. 20): export your data in JSON format
• Right to object (Art. 21): object to the processing
• Right to restriction (Art. 18): restrict the processing of your data
• Withdrawal of consent (Art. 7.3): withdraw at any time any consent you have given, as easily as you gave it. Withdrawal does not affect processing carried out before it. For cookies, the banner can be reopened from the "Cookie settings" link at the bottom of the page; for the newsletter, the unsubscribe link appears in every email

To exercise these rights, log in to your customer area (export and deletion available in your account settings) or contact us at: contact@semirprod.fr

We respond within one month. If your request is complex, this period may be extended by two months; we will then inform you within one month of your request, explaining why.

Automated decisions (Art. 22 GDPR)

Two decisions are taken automatically, without human intervention, and may affect your access to the service:

• Blocking of streaming in the event of non-payment: after a one-week grace period and two reminders, a subscription whose payment has failed no longer allows streaming, until payment is made
• Deletion of an inactive account: after 24 months without login, a notice email followed by a 30-day period

No profiling is used for these decisions: they are based solely on the status of your payment or on the date of your last login. You can request a review by a person, express your point of view and contest the decision by writing to contact@semirprod.fr.

Data you must provide, and data received from third parties

Your email address and password are required to create the account: without them, the account cannot exist. Billing information (company name, address, VAT number) is required to issue compliant invoices. Everything else is optional: profile picture, display name, linked third-party accounts, newsletter subscription. Not providing it only limits the feature concerned.

Some data does not come from you directly. When you link an account or log in with it, we receive from Discord or Twitch your identifier on the platform, your username, your profile picture and, where the platform provides it, your email address. We receive from Stripethe status of your payments and the last four digits of your card, never its full number. This information comes from the service you chose to connect, and its transmission is governed by that service's own privacy policy.

Data security

We implement the following security measures:

• Encryption of communications between your browser and our servers
• Passwords never stored in plain text
• Two-factor authentication (2FA) available on your account
• Limits on the number of attempts on sensitive entry points
• Access to data restricted to the people who need it

Contact and complaints

For any question about this privacy policy or to exercise your rights, contact us at: contact@semirprod.fr

If you consider that the processing of your data does not comply with the regulations, you may lodge a complaint with the CNIL(Commission Nationale de l'Informatique et des Libertés, the French data protection authority):

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07