Privacy Policy

Effective date: 7 October 2026 · broldo.com

1. Controller and scope

This Privacy Policy describes how personal data is processed in connection with the services made available at broldo.com and its subdomains (the "Service"). The controller of that processing within the meaning of Regulation (EU) 2016/679 (the "GDPR") is Dmitrii Gorovoi, operator of the Service (the "Controller", "we"), reachable at gorovoi.dmitrii@gmail.com.

This Policy applies to (i) registered users of the Service ("Users") and (ii) individuals whose chat messages are processed by the toolkit's configured chat features or were processed by Mopsy's retired automated moderation feature ("Channel Participants").

2. Categories of personal data processed

2.1 Account data

Authentication is provided by Clerk Inc. Upon registration the Controller receives and stores the User's primary email address and assigns an internal account identifier. Passwords and authentication credentials are processed exclusively by Clerk and are not accessible to the Controller.

2.2 Platform connection data

Where the User connects a third-party platform account (Twitch, Kick, Spotify, StreamElements), the Controller stores the access and refresh tokens issued by that platform in encrypted form. Such tokens are used solely to perform the functions the User has configured and are deleted upon disconnection of the platform.

2.3 Configuration and operational data

The Controller stores the User's service settings, request and queue history necessary for the operation of the Service, moderator invitations (invitee email address and granted access levels), and a log of actions performed by moderators on the User's account. The Service also processes chat messages as needed for the User's configured chat commands, chat overlays and manual moderation tools.

2.4 Historical Mopsy data

Mopsy's automated chat moderation and stream transcription have been retired. Mopsy no longer processes new chat messages or broadcast audio for these features. Existing Mopsy settings and historical moderation data, including chat messages, surrounding context, moderation decisions and any stored broadcast transcripts, have been retained. Retirement of these features has not deleted this data; the retention rules in Section 6 and the rights in Section 8 continue to apply.

2.5 Billing data

Subscriptions are administered by Clerk Billing with payment processing by Stripe, Inc. Payment card data is processed exclusively by Stripe and is at no time accessible to the Controller. The Controller stores the subscription plan associated with an account.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — provision of the Service to Users: account management, platform connections, configuration, moderator management, and billing.
• Legitimate interests (Art. 6(1)(f) GDPR) — processing of Channel Participants' messages for the User's configured chat tools; retention of historical Mopsy records following retirement of the feature; maintenance of security and audit records, including the moderator action log; and access to account information by a limited number of authorized operators for the purposes of service administration, support and billing. Authorized operators cannot access platform tokens or credentials.
• Compliance with legal obligations (Art. 6(1)(c) GDPR) — retention of payment and tax records by the Controller or Stripe where required by applicable law.

4. Automated decision-making

The retired Mopsy feature no longer takes automatic actions on chat messages or Channel Participants. A Channel Participant with a concern about a historical moderation action may raise it with the channel operator or contact the Controller for human review.

5. Recipients and international transfers

Personal data is disclosed to the following processors and recipients to the extent necessary for the purposes stated above:

• Clerk Inc. (USA) — authentication and subscription management;
• Stripe, Inc. (USA) — payment processing;
• the configured AI model provider (e.g. OpenAI, USA) — historical processing of chat messages and transcripts for the retired Mopsy moderation and stream-summary features; no new data is sent to an AI provider for these features;
• Hetzner Online GmbH (Germany) — hosting; all Service databases are located in the European Union;
• the third-party platforms the User connects (Twitch, Kick, Spotify, StreamElements), which process data under their own terms and privacy policies as independent controllers.

Where a processor is established outside the EU/EEA, transfers are carried out on the basis of an adequacy decision (including the EU–US Data Privacy Framework, where certified) or the European Commission's Standard Contractual Clauses.

The Controller does not sell personal data, does not process it for advertising purposes, and does not use it to build profiles of Channel Participants. The Service sets only the cookies required for authentication; no analytics or advertising cookies are used.

6. Retention

• Account and configuration data — for the duration of the account;
• platform tokens — until disconnection of the platform;
• the moderator action log — up to 12 months;
• moderation decisions and context — for the duration of the User's account, subject to earlier deletion at the User's initiative;
• billing records — for the period required by applicable law.

Upon account deletion, personal data is erased except where retention is required by law. Deletion may be requested at the address in Section 1; the Controller will confirm completion.

7. Security

The Controller applies technical and organisational measures appropriate to the risk, including encryption of platform tokens at rest, transport encryption (TLS) for all connections, per-service database segregation, and restriction of administrative access to named, authorized operators.

8. Data subject rights

Subject to the conditions of the GDPR and other applicable law, data subjects have the right to obtain access to their personal data and a copy thereof, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Requests may be addressed to gorovoi.dmitrii@gmail.com and will be answered within one month. Data subjects further have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence.

9. Children

The Service is not directed at children. Use of the Service requires the minimum age applicable to the connected platforms (13 years for Twitch) and, where the GDPR so requires, the age of digital consent in the relevant Member State. If the Controller becomes aware that personal data of a child has been collected contrary to this Section, such data will be deleted; notice may be given at the address in Section 1.

10. Amendments

The Controller may amend this Policy. Material amendments will be published on this page with an updated effective date. Continued use of the Service after the effective date of an amendment constitutes acceptance of the amended Policy.