Privacy Policy

Deutsche Version

This English translation is provided for transparency and convenience. The German version is the legally authoritative privacy policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws and other applicable data protection provisions is:

Jens Blankenburg
Grafschafter Ring 1
49477 Ibbenbüren, Germany
Contact: contact form

2. General information on data processing

We process personal data only insofar as this is necessary to provide a functional website and our content and services. As a rule, personal data is processed only with the user's consent. An exception applies where prior consent cannot be obtained for practical reasons and processing is permitted by law.

3. Legal bases for processing

  • Article 6(1)(a) GDPR – user consent
  • Article 6(1)(b) GDPR – performance of a contract and provision of the platform
  • Article 6(1)(f) GDPR – legitimate interests, such as platform security

4. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, the server automatically records server log files containing:

  • IP address of the requesting device
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Requested content or page
  • Access status and HTTP status code
  • Amount of data transferred
  • Referring website
  • Browser, operating system and user interface

This processing is based on Article 6(1)(f) GDPR. We have a legitimate interest in the technically reliable and optimized operation of the website.

5. Authentication via Twitch (OAuth)

Registration and login may use the OAuth service of Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA. When a user signs in through Twitch, Twitch may send us:

  • Twitch user ID
  • Twitch username
  • Email address, if authorized
  • Profile image URL

Processing is based on Article 6(1)(b) and Article 6(1)(a) GDPR. Transfers to the United States are based on the EU-US Data Privacy Framework. Further information is available in the Twitch Privacy Notice.

6. Use of the Twitch API

We use the Twitch API to retrieve publicly available information about creator profiles, including:

  • Public profile information such as display name and profile image
  • Live or offline status
  • Follower count
  • Clip titles, thumbnails and view counts

This information is updated regularly and cached on our servers. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in providing current creator information.

7. Voluntarily connected social-media accounts and private analytics

Creators may voluntarily connect their YouTube (Google), Instagram (Meta) and TikTok accounts to NEXUS using the respective OAuth flow. Data retrieved from these services is processed in the creator's private analytics area and is not automatically displayed on the public creator profile. Authorized team members may access this data only where necessary to operate, support or secure the feature.

Data accessed and stored

Depending on the connected platform, we access and process both raw user data and derived, aggregated or anonymized data, including:

  • Platform user ID, username, display name and profile image
  • Public profile metrics such as follower, subscriber, like and content counts
  • Statistics for the user's own videos and posts, including views, watch time and interactions
  • OAuth access and refresh tokens needed for authorized API requests
  • Derived trend values and aggregated analytics snapshots

How Google and YouTube user data is used

Google and YouTube user data is used exclusively to provide and improve visible, user-facing NEXUS features requested by the creator: connecting the creator's YouTube channel, displaying private channel and video analytics, showing trends for selected periods and creating creator-controlled analytics summaries. The requested scopes are read-only. NEXUS does not publish, modify or delete content in the user's Google or YouTube account.

Recipients and transfer of Google and YouTube user data

The following disclosure applies equally to raw Google user data and to data derived from it, including aggregated or anonymized analytics. Such data is shared, transferred or disclosed only to the extent required for the stated purpose. Potential recipients are:

  • Hetzner Online GmbH, acting as our contracted data processor, solely for hosting, database operation and secure storage on servers in Germany;
  • specifically authorized NEXUS team members, solely where access is necessary for operation, support or security. The talent team may view connected analytics only after the creator has separately and voluntarily enabled talent consideration;
  • prospective customers, solely for a user-facing talent-matching feature requested by the creator, and only after the creator has accepted a talent invitation and separately consented to disclosure for a specific inquiry. Only selected aggregated metrics may be disclosed. OAuth tokens, direct account access, raw video-level analytics and any data not expressly approved by the creator are never disclosed to customers;
  • public authorities or other legally authorized bodies where we are required to disclose data by applicable law.

Google and YouTube user data is not sold and is not transferred to advertising networks, data brokers, information resellers or other unrelated third parties. It is not used for advertising, retargeting, credit assessment, lending or training generalized AI or machine-learning models. Our use and transfer of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data protection

Google user data is transmitted over encrypted HTTPS connections. OAuth tokens are stored only on the server and are not exposed in public profiles or to other users. Access to stored connection and analytics data is restricted through authentication, role-based authorization and the least-privilege principle. Access is limited to personnel who require it for the purposes described above.

Retention, disconnection and deletion

OAuth tokens are retained only while the YouTube connection remains active. When the creator disconnects YouTube, NEXUS attempts to revoke the authorization with Google, deletes the locally stored access and refresh tokens and stops retrieving new YouTube data. Existing analytics snapshots may remain to preserve the creator's history until the creator requests their deletion or deletes the Stream Nexus account. A deletion request may be submitted at any time as described on our data deletion page. Account deletion removes the associated connection and analytics data unless retention is required by law.

A creator may voluntarily allow the authorized talent team to use connected analytics for talent selection. This consent is recorded with its date and notice version and may be withdrawn at any time with effect for the future. It does not authorize public display or disclosure to customers. Customer disclosure requires a separate talent invitation and additional consent for the specific inquiry.

The legal basis is Article 6(1)(a) GDPR and, where the feature is provided as part of the platform, Article 6(1)(b) GDPR. Further information is available in the privacy policies of Google, Meta/Instagram and TikTok.

8. checkdomain SSL certificate seal

The website embeds an SSL certificate seal provided by checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. Loading the seal establishes a connection to checkdomain and transmits necessary connection data, particularly the IP address, browser and device information, referrer and time of access.

The seal demonstrates the secure encryption of our website. The legal basis is Article 6(1)(f) GDPR. Further information is available in the checkdomain privacy policy.

9. Cookies and session storage

We use only cookies that are technically necessary to operate the website. These include:

  • next-auth.session-token – authentication session cookie
  • next-auth.csrf-token – protection against cross-site request forgery
  • next-auth.callback-url – stores the redirect URL following login

Their use is based on Article 6(1)(f) GDPR. We do not use tracking, analytics or marketing cookies.

10. User data stored by NEXUS

Depending on platform use, our database may store:

  • Username and display name
  • Email address
  • Profile image URL
  • Twitch user ID
  • Connection data and OAuth tokens for voluntarily linked accounts
  • User-generated content such as comments, likes and profile information
  • Internal platform data such as Nexies, badges and module settings
  • Action timestamps such as registration and last login

Data is stored in a PostgreSQL database hosted on servers in Germany. Processing is based on Article 6(1)(b) GDPR.

11. Virtual currency (Nexies)

NEXUS uses an internal virtual currency called Nexies. Nexies have no monetary value, cannot be purchased with or exchanged for money and are used exclusively for gamification within the platform. Related transaction data such as earnings, expenditure and timestamps is stored.

12. Data subject rights

You have the following rights regarding your personal data:

  • Right of access under Article 15 GDPR
  • Right to rectification under Article 16 GDPR
  • Right to erasure under Article 17 GDPR, subject to statutory retention obligations
  • Right to restriction of processing under Article 18 GDPR
  • Right to data portability under Article 20 GDPR
  • Right to object under Article 21 GDPR
  • Right to withdraw consent under Article 7(3) GDPR with effect for the future

To exercise these rights, please use our contact form.

13. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The competent authority is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2-4, 40213 Düsseldorf, Germany
www.ldi.nrw.de

14. Deletion and storage period

Personal data is erased or blocked when the purpose for storage no longer applies. Data may be retained where European or national law requires it. When an account is deleted, associated personal data is deleted and publicly shared content, such as comments, is anonymized. Platform-specific details for connected accounts are provided on our data deletion page.

15. Status and amendments

This privacy policy is effective as of October 2026. It may need to be amended as our services develop or legal and regulatory requirements change. The current version is always available on this page.