Privacy Policy

Effective date: 16 August 2026 · mycreatortoolkit.com

1. Controller and scope

This Privacy Policy describes how personal data is processed in connection with the services made available at mycreatortoolkit.com and its subdomains (the "Service"). The controller of that processing within the meaning of Regulation (EU) 2016/679 (the "GDPR") is Dmitrii Gorovoi, operator of the Service (the "Controller", "we"), reachable at gorovoi.dmitrii@gmail.com.

This Policy applies to (i) registered users of the Service ("Users") and (ii) individuals whose chat messages are processed because a User has enabled automated moderation on a channel they operate ("Channel Participants").

2. Categories of personal data processed

2.1 Account data

Authentication is provided by Clerk Inc. Upon registration the Controller receives and stores the User's primary email address and assigns an internal account identifier. Passwords and authentication credentials are processed exclusively by Clerk and are not accessible to the Controller.

2.2 Platform connection data

Where the User connects a third-party platform account (Twitch, Kick, Spotify, StreamElements), the Controller stores the access and refresh tokens issued by that platform in encrypted form. Such tokens are used solely to perform the functions the User has configured and are deleted upon disconnection of the platform.

2.3 Configuration and operational data

The Controller stores the User's service settings, request and queue history necessary for the operation of the Service, moderator invitations (invitee email address and granted access levels), and a log of actions performed by moderators on the User's account.

2.4 Moderation data

Where a User enables automated moderation, chat messages posted in the User's channel — including messages of Channel Participants — together with surrounding chat context are processed for the purpose of detecting spam, fraudulent content and violations of the channel's rules. Moderation decisions and associated context are stored for review by the User. Where the User enables stream transcription, the audio of the User's own broadcast is transcribed; no audio of Channel Participants is captured beyond the broadcast itself.

2.5 Billing data

Subscriptions are administered by Clerk Billing with payment processing by Stripe, Inc. Payment card data is processed exclusively by Stripe and is at no time accessible to the Controller. The Controller stores the subscription plan associated with an account.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — provision of the Service to Users: account management, platform connections, configuration, moderator management, and billing.
• Legitimate interests (Art. 6(1)(f) GDPR) — processing of Channel Participants' messages to provide the moderation the User has configured; maintenance of security and audit records, including the moderator action log; and access to account information by a limited number of authorized operators for the purposes of service administration, support and billing. Authorized operators cannot access platform tokens or credentials.
• Compliance with legal obligations (Art. 6(1)(c) GDPR) — retention of payment and tax records by the Controller or Stripe where required by applicable law.

4. Automated decision-making

Automated moderation may result in automatic actions affecting Channel Participants, such as removal of a message or a temporary restriction in a channel. Every such decision is recorded and can be reviewed, marked as incorrect and reversed by the User or the User's moderators. A Channel Participant who considers a moderation action unjustified may raise it with the channel operator or contact the Controller, in which case the decision will be reviewed by a human.

5. Recipients and international transfers

Personal data is disclosed to the following processors and recipients to the extent necessary for the purposes stated above:

• Clerk Inc. (USA) — authentication and subscription management;
• Stripe, Inc. (USA) — payment processing;
• the configured AI model provider (e.g. OpenAI, USA) — processing of chat messages and transcripts for moderation and stream summaries;
• Hetzner Online GmbH (Germany) — hosting; all Service databases are located in the European Union;
• the third-party platforms the User connects (Twitch, Kick, Spotify, StreamElements), which process data under their own terms and privacy policies as independent controllers.

Where a processor is established outside the EU/EEA, transfers are carried out on the basis of an adequacy decision (including the EU–US Data Privacy Framework, where certified) or the European Commission's Standard Contractual Clauses.

The Controller does not sell personal data, does not process it for advertising purposes, and does not use it to build profiles of Channel Participants. The Service sets only the cookies required for authentication; no analytics or advertising cookies are used.

6. Retention

• Account and configuration data — for the duration of the account;
• platform tokens — until disconnection of the platform;
• the moderator action log — up to 12 months;
• moderation decisions and context — for the duration of the User's account, subject to earlier deletion at the User's initiative;
• billing records — for the period required by applicable law.

Upon account deletion, personal data is erased except where retention is required by law. Deletion may be requested at the address in Section 1; the Controller will confirm completion.

7. Security

The Controller applies technical and organisational measures appropriate to the risk, including encryption of platform tokens at rest, transport encryption (TLS) for all connections, per-service database segregation, and restriction of administrative access to named, authorized operators.

8. Data subject rights

Subject to the conditions of the GDPR and other applicable law, data subjects have the right to obtain access to their personal data and a copy thereof, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Requests may be addressed to gorovoi.dmitrii@gmail.com and will be answered within one month. Data subjects further have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence.

9. Children

The Service is not directed at children. Use of the Service requires the minimum age applicable to the connected platforms (13 years for Twitch) and, where the GDPR so requires, the age of digital consent in the relevant Member State. If the Controller becomes aware that personal data of a child has been collected contrary to this Section, such data will be deleted; notice may be given at the address in Section 1.

10. Amendments

The Controller may amend this Policy. Material amendments will be published on this page with an updated effective date. Continued use of the Service after the effective date of an amendment constitutes acceptance of the amended Policy.