Personal Data Processing and Privacy Policy

01Data controller

The controller (responsable del tratamiento) of the personal data described in this policy is [NOMBRE COMPLETO], a natural person resident in Colombia, holder of Colombian citizenship card (cédula de ciudadanía) No. [CÉDULA], with mailing address at [DIRECCIÓN DE CORRESPONDENCIA, CIUDAD, COLOMBIA] and telephone [TELÉFONO].

Privacy and data protection contact: privacidad@arenabragis.com. General contact: info@arenabragis.com.

This policy is adopted under Colombia's Statutory Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Regulatory Decree 1074 of 2015) and related Colombian rules. For people located in the European Economic Area or the United Kingdom, it also includes the information required by Regulation (EU) 2016/679 (GDPR).

02Scope and definitions

This policy applies to the Arena Bragis service and its “Punto de Encuentro” product (the “Service”): the streamer's web panel, the OBS overlay and this website. It covers three groups of data subjects:

• Streamers: people who connect their Twitch channel to the Service.
• Viewers: people who take part in the chat or events of a channel that uses the Service. They do not sign up to Arena Bragis; their data comes from Twitch.
• Visitors: people who browse this website or apply for the beta.

The terms “data subject”, “processing”, “controller”, “processor”, “authorization” and “public data” have the meaning given in article 3 of Law 1581 of 2012 and article 3 of Decree 1377 of 2013.

03Data we process

Streamers

• Twitch identifiers: user ID, login and display name.
• Twitch access credentials (OAuth tokens), encrypted at rest with AES-256-GCM, and the granted scopes: channel:bot, bits:read, channel:read:subscriptions and channel:read:redemptions.
• Panel session: we only store a SHA-256 hash of the session identifier, never the plain value. Sessions expire after 7 days without use and, in any case, after 30 days.
• Channel configuration: enabled interaction rules, magnitudes, cooldowns, limits and overlay settings.
• Acceptance of the Terms and this policy: accepted version and the date and time of acceptance.
• Audit entries for relevant account actions (for example rule changes or rotating the overlay URL), without people's names.

Viewers

When a streamer enables interaction rules, Twitch sends us that channel's events through its EventSub service. From them we process:

• Public Twitch user ID, login and display name.
• The event type and the data it needs: a chat command from the closed list, the number of Bits in a Cheer, the tier and months of a subscription or gift, and the title of a redeemed channel points reward.
• The chat message text, only to detect whether it contains a command from the closed list. It is erased once processed; it is only kept while the event is pending or in the failure queue, and it is never shown on the overlay.

The overlay only shows each viewer's avatar with their public Twitch display name and the reactions derived from those events. Free chat text is never shown.

Website visitors

• Aggregated usage and performance metrics through Vercel Web Analytics and Speed Insights, which use no cookies and do not identify individual people.
• A click event (beta_access_clicked) with the page language and the button location, so we know which beta invitation works best.
• If you apply for the beta: name or alias, e-mail address, Twitch channel and approximate community size, sent through a Tally form or by e-mail.

The application does not store IP addresses: rate limits are computed in memory and discarded. Hosting providers may log IP addresses on their edge servers for security and operations, under their own policies. We do not process sensitive data within the meaning of article 5 of Law 1581 of 2012.

04Purposes of processing

• Authenticate the streamer with Twitch and keep their panel session.
• Receive the channel events the streamer has enabled and turn them into visible reactions on the overlay.
• Keep the channel's persistent crew, so each viewer keeps their avatar between streams.
• Enforce limits, cooldowns and anti-abuse measures, and keep the Service secure.
• Handle beta applications, support requests and the exercise of rights.
• Measure website usage and performance in aggregate in order to improve it.
• Comply with legal obligations and requests from competent authorities.

We do not sell or rent personal data, we do not use it for advertising and we do not build commercial profiles of viewers.

05Authorization and legal bases

Streamers: we process their data with their prior, express and informed authorization, given by accepting the Terms and this policy when connecting their channel. We keep proof of that authorization (version and date of acceptance), as required by article 9 of Law 1581 of 2012 and Law 527 of 1999 on data messages.

Viewers: the Twitch user ID, login and display name, and taking part in a channel's chat or public events, are data of a public nature within the platform. Processing them does not require authorization (article 10(a) of Law 1581 of 2012) and is carried out on the instruction of the streamer who enables the Service on their channel, with a legitimate interest limited to showing participation in that channel. This does not limit the data subject's rights: any viewer may object and request erasure of their data at any time.

Visitors: aggregated metrics rely on our legitimate interest in maintaining and improving the website. Beta form data is processed with the authorization you give when you submit it.

GDPR: for people in the European Economic Area or the United Kingdom, the legal bases are performance of a contract (art. 6(1)(b)) for streamers; legitimate interests (art. 6(1)(f)) for viewers, metrics and security; consent or pre-contractual steps at your request (arts. 6(1)(a) and 6(1)(b)) for beta applications; and compliance with legal obligations (art. 6(1)(c)) where applicable.

06Data retention

Inactive accounts: if an account needs to reconnect to Twitch and has no session for 180 days, it is deleted together with all data linked to the channel.

07Processors and international transfers

To provide the Service we rely on the following providers, which process data on our behalf (processors) or as independent controllers:

These providers may store or process data outside Colombia, mainly in the United States. Transmissions to processors are governed by contracts requiring them to process data only on our instructions and with appropriate security measures (article 25 of Decree 1377 of 2013). The United States is among the countries the Superintendence of Industry and Commerce considers to provide an adequate level of protection. For data subjects covered by the GDPR, transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on standard contractual clauses.

Twitch's own processing is governed by its privacy notice.

08Your rights

Under article 8 of Law 1581 of 2012, as a data subject you have the right to:

• Know, update and rectify your personal data.
• Request proof of the authorization you gave, except where none is required.
• Be informed, on request, of how your data has been used.
• File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the law, once you have completed the inquiry or claim process with the controller.
• Revoke your authorization and request erasure of your data where the legal principles, rights and guarantees are not respected, or where there is no legal or contractual duty to keep it.
• Access your personal data free of charge.

If the GDPR applies to you, you may also exercise the rights of access, rectification, erasure, restriction, portability and objection, withdraw your consent at any time and lodge a complaint with your local data protection authority.

09How to exercise your rights

Write to privacidad@arenabragis.com with your name, your Twitch username (if you are a streamer or viewer), a clear description of your request, the address or e-mail where you want to receive the answer and, for a claim, any documents you wish to rely on. We may ask for reasonable additional information to verify your identity, for example confirming the request from your Twitch account.

• Inquiries: answered within 10 business days of receipt at most. If that is not possible, we will tell you why and give a new date, no more than 5 additional business days later (article 14 of Law 1581 of 2012).
• Claims (correction, update, erasure or breach): handled within 15 business days from the day after receipt at most, extendable by up to 8 more business days with prior notice. If a claim is incomplete, we will ask you to complete it within 5 days; if 2 months pass without a reply, it will be deemed withdrawn. While it is being resolved, the data will be flagged as “claim in progress” (article 15 of Law 1581 of 2012).
• If you are not satisfied with the answer, you may contact the Superintendence of Industry and Commerce.

Self-service tools for streamers

• From the panel you can export your data as JSON and delete your account at any time.
• If you revoke Arena Bragis's access in Twitch (Settings → Connections), your account and the data linked to your channel are deleted automatically.
• When an account is deleted, everything linked to the channel is erased immediately and the tokens are revoked at Twitch. The hosting provider's backups disappear once their retention window, of up to 30 days, has passed.

10If you are a viewer of a channel

You do not need an Arena Bragis account to exercise your rights. Write to privacidad@arenabragis.com with your Twitch username and tell us whether you want to know, correct, object to the processing of or erase your data. We will handle the request within the legal periods above. Erasure removes your avatar and your data from every channel that uses the Service.

Please note that if you later use commands, Cheers, subscriptions or rewards again on a channel with active rules, Twitch will send us those events again. If you do not want to appear, the simplest way is not to use the closed-list commands on those channels.

11Minors

The Service is not directed at minors. Streamers must be at least 18 years old. For viewers we only process the public identifiers Twitch already shows on its platform, without collecting age or any other data, and respecting the best interests of children and adolescents (article 7 of Law 1581 of 2012). If a minor or their legal representative asks us to, we will delete their data.

12Security

• Twitch tokens encrypted at rest with AES-256-GCM.
• Panel sessions and OBS URL tokens stored only as hashes; the overlay URL can be rotated at any time.
• Communications encrypted with TLS.
• Least privilege: we only request the Twitch scopes needed for the available interactions, and each channel can only access its own data.
• Technical logs without personal data.

No system is infallible. If a security incident affects personal data, we will notify the Superintendence of Industry and Commerce and the people affected as required by article 17(n) of Law 1581 of 2012.

13Cookies

This website does not use cookies. The streamer panel only uses strictly necessary first-party cookies. The details are in the Cookie Policy.

14Text to inform your audience

The Terms of Service ask every streamer to tell their audience that the channel uses Arena Bragis. You can paste this text into a panel or your channel description:

15Changes and effective date

We may update this policy to reflect changes to the Service or the law. Each version will be published on this page with its date, and we will announce substantial changes in the panel before they apply; when the purposes of processing change, we will ask for your authorization again.

This policy applies from the effective date shown at the top. Databases will be kept for the periods stated in the retention section and while the Service is operating.