Privacy Policy

Last Updated: January 2025

---

1. Data Controller

The data controller responsible for data processing on this website and within the ModLog service is:

ModLog UG (haftungsbeschränkt)
(limited liability entrepreneurial company under German law)

Rheinstr. 20
36124 Eichenzell
Germany

Represented by: David Hermann (Managing Director)

Email: [email protected]

---

2. Overview of Data Processing

2.1 Types of Data Processed

• Master data (e.g., username, user ID)
• Contact data (e.g., email address)
• Usage data (e.g., access times, features used)
• Meta/communication data (e.g., IP address, device information)
• Authentication data (OAuth tokens)
• Content data (e.g., custom commands, moderation statistics)

2.2 Categories of Data Subjects

• Users of the ModLog service
• Website visitors

2.3 Purposes of Processing

• Provision of the service and its features
• User authentication and account management
• Processing of payment transactions
• Communication with users
• Security and fraud prevention
• Fulfillment of legal obligations

---

3. Legal Bases for Processing

We process personal data in accordance with the General Data Protection Regulation (GDPR). Processing is based on the following legal grounds:

• Art. 6(1)(a) GDPR (Consent): You have given consent to the processing for one or more specific purposes.
• Art. 6(1)(b) GDPR (Contract Performance): Processing is necessary for the performance of a contract or for pre-contractual measures.
• Art. 6(1)(c) GDPR (Legal Obligation): Processing is necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR (Legitimate Interests): Processing is necessary for the purposes of legitimate interests pursued by us or a third party, unless your interests override.

---

4. Your Rights as a Data Subject

You have the following rights regarding your personal data:

4.1 Right of Access (Art. 15 GDPR)

You have the right to obtain information about your personal data stored by us.

4.2 Right to Rectification (Art. 16 GDPR)

You have the right to have inaccurate personal data corrected.

4.3 Right to Erasure (Art. 17 GDPR)

You have the right to request the deletion of your personal data, provided there are no statutory retention obligations.

4.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of the processing of your data.

4.5 Right to Data Portability (Art. 20 GDPR)

You have the right to receive your data in a structured, commonly used, and machine-readable format.

4.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time to the processing of your data based on Art. 6(1)(f) GDPR for reasons arising from your particular situation.

4.7 Right to Withdraw Consent (Art. 7(3) GDPR)

If you have given consent, you may withdraw it at any time with effect for the future.

4.8 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(The Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden, Germany
Website: https://datenschutz.hessen.de

---

5. Contact

For questions about data protection or to exercise your rights, please contact us at:

Email: [email protected]

---

6. Website Provision and Log Files

6.1 Description and Scope of Data Processing

Each time our website is accessed, our system automatically collects the following data:

• IP address of the requesting device
• Date and time of access
• Page/file accessed
• Amount of data transferred
• Notification of successful retrieval
• Browser type and version
• User's operating system
• Referrer URL (previously visited page)

6.2 Legal Basis

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring system security and the stability of our website.

6.3 Purpose of Data Processing

The temporary storage of the IP address is necessary to deliver the website. Storage in log files serves to ensure functionality and to defend against attacks.

6.4 Storage Duration

Data is deleted as soon as it is no longer necessary for the purpose of collection. For log files, this is no later than 30 days.

6.5 Hosting

Our website and the ModLog service are hosted on servers in Germany. We have concluded a data processing agreement pursuant to Art. 28 GDPR with our hosting provider.

---

7. Registration and User Account

7.1 Description and Scope of Data Processing

Registration is required to use ModLog. Registration is performed via OAuth authentication with the following third-party providers:

Twitch (required):

• Twitch username and user ID
• Email address (if shared)
• Profile picture URL
• OAuth access token and refresh token

Discord (optional):

• Discord username and user ID
• Email address (if shared)
• Profile picture URL
• OAuth access token and refresh token

Additionally, we store:

• IP address at registration and during logins
• Time of registration and last login
• Selected plan and subscription status

7.2 Legal Basis

Processing is based on Art. 6(1)(b) GDPR for the performance of the user agreement.

7.3 Purpose of Data Processing

The data is required for:

• Creation and management of your user account
• Authentication when using the service
• Provision of ModLog features
• Communication regarding your account

7.4 Storage Duration

Data is stored for the duration of service use. After termination or deletion of the account, your data will be deleted within 30 days, unless statutory retention obligations apply.

7.5 Minimum Age

Use of ModLog is only permitted from the age of 16. By registering, you confirm that you are at least 16 years old.

---

8. Usage Data and Moderation Statistics

8.1 Description and Scope of Data Processing

During the use of ModLog, the following data is collected and processed:

• Moderation actions and statistics
• Custom commands and their configuration
• Chat logs and moderation logs (as required for functionality)
• Settings and preferences

8.2 Legal Basis

Processing is based on Art. 6(1)(b) GDPR for the performance of the user agreement.

8.3 Purpose of Data Processing

The data is required to provide the core functions of ModLog, including:

• Display of moderation statistics
• Execution of custom commands
• Management of moderators and VIPs

8.4 Storage Duration

Data is stored for the duration of service use and deleted 30 days after account deletion.

---

9. Payment Processing

9.1 Description and Scope of Data Processing

For paid plans, we use the payment service provider Stripe:

Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin, D02 H210, Ireland

During payment processing, the following data is transmitted to Stripe:

• Email address
• Selected plan and amount
• Payment information (entered directly at Stripe)

We do not store any credit card data or bank details ourselves. These are processed exclusively by Stripe.

9.2 Legal Basis

Processing is based on Art. 6(1)(b) GDPR for the performance of the user agreement.

9.3 Stripe Privacy Policy

For more information about data protection at Stripe, please visit:
https://stripe.com/privacy

---

10. Third-Party APIs

10.1 Twitch API

ModLog uses the Twitch API to provide its features. Data is exchanged with Twitch:

Twitch Interactive, Inc.
350 Bush Street, 2nd Floor
San Francisco, CA 94104, USA

Use is based on Art. 6(1)(b) GDPR. Twitch privacy notice:
https://www.twitch.tv/p/legal/privacy-notice/

10.2 Discord API

ModLog optionally uses the Discord API to provide Discord bot features:

Discord Inc.
444 De Haro Street, Suite 200
San Francisco, CA 94107, USA

Use is based on Art. 6(1)(b) GDPR. Discord privacy policy:
https://discord.com/privacy

10.3 Data Transfer to Third Countries

Twitch and Discord are US-based companies. Data transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and/or the EU-U.S. Data Privacy Framework.

---

11. Cookies and Local Storage

11.1 Description

We use cookies and local storage mechanisms for the operation of the service and, with your consent, for analytics purposes.

11.1.1 Technically Necessary Cookies

The following cookies are required for the operation of the service and do not require your consent:

11.1.2 Analytics Cookies (with Consent)

If you consent to analytics cookies, we use Google Analytics to analyze website usage:

11.2 Legal Basis

• Technically necessary cookies: Art. 6(1)(f) GDPR (legitimate interest in providing a functional service)
• Analytics cookies: Art. 6(1)(a) GDPR (your consent)

11.3 Cookie Consent Banner

When you first visit our website, you will be presented with a cookie consent banner. You can choose to:

• Accept All: Enables both necessary and analytics cookies
• Necessary Only: Enables only technically required cookies

You can change your cookie preferences at any time by clearing your browser's cookies for our domain, or by deleting the modlog_consent cookie specifically.

11.4 Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

11.4.1 Purpose

Google Analytics helps us understand how visitors interact with our website. This includes:

• Pages visited and time spent on pages
• Traffic sources and user journey
• Browser and device information
• Geographic region (country/city level)

11.4.2 Data Processing

Google Analytics uses cookies to collect information about your use of our website. The information generated is usually transmitted to and stored on Google servers in the United States.

We have enabled IP anonymization, so your IP address is truncated within the European Union before being transmitted to Google.

11.4.3 Legal Basis

Processing is based on Art. 6(1)(a) GDPR (your consent). Analytics cookies are only loaded after you have given your explicit consent via our cookie banner.

11.4.4 Opt-Out

You can withdraw your consent at any time by:

• Clearing your browser's cookies for our domain (or deleting the modlog_consent cookie)
• Using a browser extension to block Google Analytics (e.g., Google Analytics Opt-out Browser Add-on)

11.4.5 Google Privacy Policy

For more information about how Google processes data, please visit: https://policies.google.com/privacy

11.4.6 Data Transfer to Third Countries

Google is a US-based company. Data transfer is based on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and the EU-U.S. Data Privacy Framework.

---

12. Email Communication

12.1 Description and Scope of Data Processing

When you contact us by email, the following data is processed:

• Your email address
• Content of the message
• Time of inquiry

12.2 Legal Basis

Processing is based on Art. 6(1)(b) GDPR (for contract-related inquiries) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

12.3 Storage Duration

Email correspondence is stored for the duration of the business relationship and beyond in accordance with statutory retention obligations.

---

13. Data Security

We implement technical and organizational security measures to protect your data against accidental or intentional manipulation, loss, destruction, or unauthorized access. These include:

• Encrypted data transmission (TLS/SSL)
• Encrypted storage of sensitive data
• Regular security updates
• Access restrictions
• Regular backups

Our security measures are continuously improved in line with technological developments.

---

14. Data Storage Location

All personal data is stored on servers in Germany. Transfer to third countries only occurs within the scope of the third-party APIs described in Section 10 and payment processing via Stripe.

---

15. Changes to This Privacy Policy

We reserve the right to adapt this privacy policy to comply with changed legal requirements or to reflect changes to the service. The current version is always available on our website.

For material changes affecting your rights, we will notify you separately.

---

16. Severability Clause

Should individual provisions of this privacy policy be or become invalid, the validity of the remaining provisions shall remain unaffected.

---

Note: This English translation is provided for convenience only. In case of any discrepancy between the German and English versions, the German version shall prevail.

---

ModLog UG (haftungsbeschränkt)
Rheinstr. 20, 36124 Eichenzell, Germany
[email protected]