Scope: Streamlists is independently operated. This notice covers the private Studio, the public Arcade, this information site and the secure contact form. The Studio has no public registration.
1. Who is responsible and how to contact us
The independent Streamlists operator is responsible for personal data handled for the project. No legal company, postal address or public email address is stated on this site. Privacy and rights requests can be made through the secure contact form.
2. Private Studio data
Connected accounts
Only when a platform is configured and authorised, the Studio may receive account identifiers and profile or capability fields made available by TikTok, Zernio, or another connected publishing platform. For TikTok this can include an open_id, display name, avatar and account-status information.
Permissions and credentials
The Studio may process OAuth scopes shown on a provider’s consent screen, access tokens and refresh tokens, or comparable connection credentials. Exact permissions depend on features enabled for that account and may include basic account information, upload or direct-post permissions and publication-status access. Streamlists does not request a connected platform’s password.
Content operations
The Studio may process content files or references, thumbnails, captions, hashtags, rights or disclosure selections, plans, intended times, destinations, review decisions, publishing metadata, post identifiers, processing status, errors and a limited operational history.
3. Public site, Arcade and contact data
This public site has no accounts and uses no analytics, ads, behavioural tracking or marketing cookies. Vercel may process normal request data such as IP address, user agent, requested path, time and security or diagnostic logs to host and protect the site.
The Arcade stores only validated high scores in browser localStorage, under one versioned key. Scores remain on that browser and device, are not sent to Streamlists, and can be cleared in the Arcade or by clearing site data. Sound preference is not stored and sound starts off on every load.
If you use the contact form, Streamlists processes your name, email address, subject, message and any information you include to assess and respond. The server-side endpoint is hosted by Vercel. When configured, Resend processes the message for email delivery. The private recipient and delivery credentials are not exposed to browser code or API responses.
4. Purposes and legal bases
Data is used only to authenticate authorised connections; create, plan, review and distribute operator-approved content; retrieve publishing status; secure and troubleshoot the project; keep proportionate operational records; respond to enquiries and rights requests; and meet applicable legal or platform requirements. Depending on context, UK data-protection bases may include legitimate interests in operating and securing the private Studio, performance of requested operations, consent for a connection where appropriate, and legal obligations. Consent may be withdrawn without affecting earlier lawful processing.
5. Sharing and processors
Data may be handled by providers necessary for private application hosting, storage, databases, security and logs. Vercel hosts this public site and contact endpoint. Resend processes contact-message delivery when configured. TikTok, Zernio, or another connected platform receives content, instructions and required account data only when that integration is configured and the operator directs an operation. Providers apply their own terms and privacy practices.
Information may also be disclosed where law requires it or where reasonably necessary to protect security or legal rights. Personal data is not sold or shared for behavioural advertising.
6. International transfers
Connected platforms and infrastructure providers may process data outside the United Kingdom. Where transfer rules apply, the project relies on the lawful mechanism available for the relevant provider and transfer, such as an adequacy regulation or approved contractual safeguards. Locations and mechanisms depend on which optional providers are configured.
7. Retention and deletion
- Connection tokens are retained only while needed for an active connection and are deleted or made unusable after disconnection, revocation or expiry.
- Studio drafts, plans and publishing records are kept while operationally needed, then deleted or anonymised when no longer required, subject to backups and legal obligations.
- Contact enquiries and replies are retained only as long as reasonably needed to respond, maintain necessary records or meet legal obligations.
- Hosting and security logs follow the relevant provider’s operational retention and may be kept longer when required to investigate an incident.
- Arcade scores remain only in local browser storage until you clear them or site data.
Deletion from active systems may not immediately remove isolated backups; these expire through normal rotation. Limited records may be retained where law requires or to establish or defend legal claims.
8. Revocation and deletion requests
Revoke a publishing connection in the relevant platform’s connected-app settings, or request disconnection or deletion through the secure contact form. Identity or authority may need to be verified. Streamlists will delete data not required to be retained and explain any exception. Revocation prevents future access once effective but does not delete posts already published on a third-party platform.
9. Security
Proportionate measures are used, including private access restrictions, HTTPS, separated secrets and limited public exposure. No internet-connected system can be guaranteed completely secure. Do not submit authorisation codes, tokens, passwords or unnecessary sensitive information through the contact form.
10. Your rights
Depending on applicable law and circumstances, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent. Use the secure contact form to make a request. You may also complain to the UK Information Commissioner’s Office. This notice is operational information, not legal advice.
11. Changes
This notice may change as Streamlists, configured processors, platform permissions or law changes. The effective date identifies the current version.