The short version: we need an email, a URL and a payment we never see. We use them to make your videos and tell you about your order. No ads, no ad trackers, no selling anything to anyone.
1. Who is responsible
The controller of your data is the operator of shillstream.lol: COMEY SAS, Bureau 562, 59 rue de Ponthieu, 75008 Paris, France. For anything about your data, write to contact@shillstream.lol. More about us in the Legal notice.
2. What we collect
- When you buy: the email address Stripe collects at checkout (it is your account: no password), the URL you submit and its domain, and your orders (offer, amount, date, status, the version of the Conditions you accepted).
- X handle (optional): used to tag you when we post your ads on X.
- The public content of your page: its title, description and a text excerpt, read to run the safety check and write the scripts; for Take the Stage, a capture of the top of your home page. We only read what anyone can see on that URL.
- Payment: handled by Stripe. We never see or store your card. From Stripe we keep your email, the amount and the payment status.
- Waitlist: your email, when you signed up, the campaign tag of the link you came from (if any) and your browser's user agent.
- My videos: when you ask for a sign-in link, a one-time token, stored hashed, valid 15 minutes.
- Emails you send us at contact@shillstream.lol or takedown@shillstream.lol: your address, the subject and the content.
- Audience measurement: Vercel Web Analytics and DataFast count visits to our pages without any cookie; Google Analytics counts them with its own cookies (see section 7). We only look at aggregated figures (pages, referring sites, countries, browser and device types, and how many visitors press each step of our buy buttons, never what they type): no profile, no tracking across sites.
- Visit counts: to show how many people are here (the « online » pill and the
/statspage), each page view is counted anonymously: your IP address and browser are turned into a code that changes every day, and only that code enters our counters (the « online » list forgets it after 2 minutes, the day's count after 3 days; the totals are numbers only). Your IP address is never stored. Robots are not counted. - Where you came from: when the link you arrive on carries a campaign tag (
?ref=orutm_source, for example one of our ads), we keep that tag for 7 days and record it with the order you place, to know which ad brought it. The tag says nothing about you. - Your country: when you pay, we read the country your connection comes from (as our host reports it) and keep only its two-letter code, on your order and on your Stripe checkout session, to set the scenes of your videos in your part of the world when your site's address names no country. We keep neither your IP address nor your city for this.
- Technical logs: like every website, our host records requests (IP address, browser, page, time). Our own server logs never contain your email or your private link. To stop abuse, sign-up and sign-in attempts are counted per IP address for 10 minutes; the address is stored hashed.
3. Why, and on what basis
| What for | Legal basis |
|---|---|
| Making and delivering your videos, your private page, My videos, airing Take the Stage | Performance of the contract |
| Order emails: payment received or refunded, videos ready, couldn't air, sign-in links | Performance of the contract |
| Payments, refunds, invoices and accounting records | Performance of the contract; legal obligation |
| The “you've been outstaged” email (Take the Stage), with one-click unsubscribe | Legitimate interest: telling you what happened to your own order |
| Safety check, abuse and fraud prevention, security logs, takedown requests | Legitimate interest: keeping the service safe and lawful; legal obligation where one applies |
| Waitlist: one email when the stage opens | Your consent, withdrawn anytime with the unsubscribe link |
| Audience figures and which of our ads bring orders (visit counts, the campaign tag on an order) | Legitimate interest: knowing what works, without profiling you |
| Answering what you send to our addresses | Legitimate interest; performance of the contract when it is about an order |
No newsletter, no marketing emails, no profiling, no automated decision about you beyond the safety check on the URL you submit.
4. What is public
Take the Stage is public by design: your domain and link, the amount you paid, your videos and the capture of your home page appear on the homepage, the leaderboard and your channel page, as the Conditions say. Your email is never shown. Just Make the Videos stays private: the videos live on your private link only, unless you share them.
5. Who processes it for us
These providers process data on our behalf and only for the purposes above. We don't sell or rent your data.
| Provider | What for | Which data | Where |
|---|---|---|---|
| Vercel | Hosting, server functions, file storage, request logs, cookieless audience measurement (Web Analytics) | Everything below passes through it | United States (global network) |
| DataFast (JustShipIt Pte. Ltd.) | Cookieless audience measurement (its script runs on our pages) | Your IP address, browser and device type, country, the pages you visit and where you came from — no cookie, and never the private link to your order (removed in your browser before anything is sent) | Singapore company, servers mostly in the United States |
| Google (Google Analytics) | Audience measurement (its script runs on our pages and sets the _ga cookies) | Your IP address (used for the country, not kept by us), browser and device type, the pages you visit and where you came from, a random visitor id in a cookie — never the private link to your order (removed in your browser before anything is sent) | United States |
| Upstash | Our database (Redis) | Orders, buyer emails, waitlist, sign-in tokens (hashed), safety journal | Cloud servers, possibly outside the EU |
| Stripe | Payments and refunds | Your email and payment details (we never see your card) | EU / United States |
| Resend | Sending our emails, receiving mail sent to our addresses | Your email address, the emails we send you, the emails you send us | United States |
| Bunny.net | Video storage and delivery (CDN) | The videos and stills; your IP address when you watch, like any CDN | EU (global network) |
| fal | Video and image generation | Scripts and prompts written from your page. Never your email | United States |
| OpenRouter | Access to the language models that run the safety check and write the scripts | Your URL and the public content of your page; for a pack we offer, a web search for the country its maker is based in (the country only). Never your email | United States (and the model provider it routes to) |
| TypeSafe (Jev) | Automatic safety check before anything is made | Your URL, your page's title, description and a text excerpt. Never your email | Possibly outside the EU |
| Telegram | Internal alerts for our team (payments, orders, safety, incoming mail) | Order reference, domain, amount, status. Never your private link; order alerts never carry your email. Mail you send to our addresses is relayed with its sender, subject and first 500 characters | Outside the EU |
Stripe also processes some payment data on its own account (for example fraud prevention), under its own privacy policy. Mail sent to our addresses is also forwarded to a mailbox our team reads.
Transfers outside the EU. Several of these providers are based in, or use servers in, the United States or other countries outside the European Union. Where they do, the transfer relies on the safeguards each provider offers in its own terms, typically the EU-US Data Privacy Framework (for certified providers) or the European Commission's standard contractual clauses. To know which one applies to a given provider, write to contact@shillstream.lol.
6. How long we keep it
| Data | Kept |
|---|---|
| Your email and orders | As long as needed to provide the service (while your videos are online and you can reach them from My videos) and meet our legal obligations. You can ask us to delete them at any time (section 8). |
| Invoices and accounting records | As long as the law requires. |
| Waitlist | Until the launch email is sent or you unsubscribe. |
| Sign-in links | 15 minutes, and spent after one use |
| Safety check journal | The last 500 checks, older ones overwritten |
| Anti-abuse counters (hashed IP) | 10 minutes |
| Visit counts (a daily anonymous code, no IP) | 2 minutes for « online », 3 days for the day's count; the totals keep numbers only |
| Emails you send us | As long as needed to handle your request and meet our legal obligations. |
| Hosting logs | Per our host's log retention. |
8. Your rights
Under the GDPR you can ask to access your data, correct it, erase it, restrict or object to its use, and get a copy in a portable format. You can withdraw your consent to the waitlist at any time. Write to contact@shillstream.lol, ideally from the address concerned, so we can check it's you. We answer within one month.
Erasing your data deletes your email and account. We keep the accounting records the law requires. Public Take the Stage content (your domain, row, channel and videos) follows the takedown process in section 9 of the Conditions.
If you think we got it wrong, you can complain to the data protection authority of the country where you live or work.
9. Age
The Shillstream is for people aged 18 and over. We don't knowingly collect data about anyone younger.
10. Changes
We'll update this page when what we collect or who processes it changes. The version date is at the top.