This document is a provisional version, under review. It will be updated before the service opens to the public.
This policy explains how [company name — to be completed] processes the personal data of visitors to this site, of sellers who use Reborn and of buyers who shop during their lives. Capitalised terms are defined in the terms.
1. Controller
[company name — to be completed], [registered address — to be completed]. For any question about your data: privacy@rebornstream.com.
2. Who does what
- For accounts, Spaces, the security of the Service and this site, [company name — to be completed] is the controller.
- For Buyers’ data used by a Seller (shipping, customer service, invoicing), the Seller is the controller and [company name — to be completed] acts as their processor, under the terms.
- [company name — to be completed] remains a controller for its own obligations (fraud prevention, legal obligations).
3. The data we process
Visitors of this site
This site uses no analytics or advertising cookies. Our host processes technical logs (IP address, browser, page requested) for the security and proper operation of the site.
Sellers and Members
- Account: name, email address, password (stored irreversibly hashed), photo, language, passkeys (only the public key is kept), two-factor authentication settings.
- Space: shop name, logo, bio, links to your social networks, Members and invitations.
- Catalog and lives: products, images, prices, stock, lives, covers, category and tags sent to platforms.
- Broadcast: connected Third-party platform accounts (access tokens), stream keys, streaming statistics.
- Payments: the identity and bank details needed to open a Stripe Connect account are collected directly by Stripe; we receive the status of the account and of payouts.
- Community: posts and messages sent through the contact form, forwarded by email to their recipient.
- AI assistants: authorisations granted to assistants connected over MCP and the history of the actions they perform.
Viewers
During a live, comments published on Third-party platforms (username and text) are read in real time to show them in the control room and on the overlay, and for the copilot to spot buyers and questions. When the live ends, only aggregated figures are kept (peak viewers, number of comments). The username and platform of a viewer who was sent a payment link are kept with the related order.
Buyers
Email address, name, phone number, shipping and billing addresses, company name and VAT number where relevant, content, amount and status of the order. Card details are entered in a Stripe form and are never stored by Reborn.
4. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: accounts, Spaces, lives, broadcast, overlays, chat, copilot | Performance of a contract |
| Processing orders and payments, sending confirmations | Performance of a contract |
| Securing the Service, preventing fraud and abuse | Legitimate interest |
| Keeping accounts and meeting legal obligations | Legal obligation |
| Measuring use of the Service in aggregate to improve it | Legitimate interest |
| Telling Sellers about what is new in the Service | Legitimate interest, with the right to object at any time |
5. Recipients
Your data is never sold. It is available to the teams of [company name — to be completed] who need it and, for order data, to the relevant Seller and their Members. It is shared with the following providers, within the limits of their task:
- hosting of the app and its data: [host and region — to be completed];
- hosting of this site: Cloudflare;
- payments: Stripe;
- streaming engine (multistreaming, reading chats): [provider — to be completed];
- sending emails: [provider — to be completed];
- Third-party platforms you connect yourself (Google/YouTube, Meta/Facebook and Instagram, TikTok, Twitch, Kick);
- AI assistants you connect yourself (for example Anthropic or OpenAI), only for the data you ask them to access.
6. Transfers outside the European Union
Some providers are located outside the European Union, notably in the United States. These transfers are covered by the European Commission’s standard contractual clauses or by the EU–US Data Privacy Framework where the provider is certified.
7. Retention periods
- Account: for as long as it exists, then deleted three years after the last activity or as soon as its holder deletes it.
- Orders and invoices: ten years, for accounting obligations.
- Viewers’ comments: for the duration of the live, unless linked to an order.
- Technical logs: twelve months at most.
- Community posts: until their author deletes them.
8. Security
Traffic is encrypted (HTTPS). Passwords are irreversibly hashed, sign-in can be protected by passkeys and two-factor authentication, and data access is partitioned by Space. Overlay and OBS dock links are secret and can be renewed at any time.
9. Your rights
You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to set instructions on what happens to your data after your death. Write to privacy@rebornstream.com: we answer within one month.
If you are a Buyer, requests about your order may also be sent to the Seller, who is the controller of their own processing.
You may lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your country.
10. Cookies
This site sets no cookies. The Reborn app only uses cookies that are strictly necessary for it to work (session, form security, display and language preferences), which do not require consent.
11. Children
The Service is not intended for children under fifteen. Seller accounts are reserved for adults acting for professional purposes.
12. Changes
We may change this policy to reflect changes in the Service or in regulations. Account holders are informed of any significant change by email.