1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Streamlingo GmbH Ludwigsburger Str. 20 76228 Karlsruhe Germany
Email: info@streamlingo.net Website: https://streamlingo.net
Managing Director: Tim-Cedric Inhoff Commercial Register: Amtsgericht Mannheim, HRB 754728 VAT ID: DE455400444
2. Overview of Data Processing
We only process personal data to the extent necessary to provide our services. Processing is based on the GDPR, in particular:
- Art. 6(1)(b) GDPR – Performance of a contract
- Art. 6(1)(f) GDPR – Legitimate interest (e.g., IT security)
- Art. 6(1)(a) GDPR – Consent (where required)
3. Hosting and Technical Provision
Our website and the Streamlingo platform run on infrastructure provided by Google Cloud EMEA Limited, with whom a data processing agreement under Art. 28 GDPR is in place. Platform data (database and file storage) is stored in the EU region. The website is delivered via the provider's content delivery network.
When you access our services, the following data is automatically collected:
- IP address (anonymized)
- Date and time of access
- Page/file accessed
- Browser type and version
- Operating system
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure provision of the website).
Retention period: Server log files are stored for security purposes (e.g., to investigate abuse or fraud) for a period of 60 days and are then automatically deleted.
Prices in your local currency: To show prices in your currency, the website determines your country from your browser's time zone or uses the country you choose in the country selector. Only this country code is transmitted to our server, which requests the prices from our payment provider Paddle. Paddle receives no data from your browser. The country is only stored if you choose it yourself (see Cookie Policy).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing prices in the visitor's currency).
4. Streamlingo Platform (Translation Service)
On the platform we process personal data in two distinct roles. Registration, billing and usage data of our customers, as well as feedback sent to us, is processed by us as the controller. The content of transmitted events (audio, transcripts, translations) and the session data of participants is processed by us as a processor on behalf of the respective customer, who is the controller in that respect.
Processing on behalf of a customer is governed by a data processing agreement under Art. 28 GDPR. You can review it without registering:
- Data processing agreement (PDF)
- Supplementary agreement on church data protection supervision (PDF) for church customers under Sec. 30(5) of the EKD Data Protection Act
4.1 Registration Data
When using our live translation platform, we process:
- Email address
- Name
- Organization/congregation (optional)
- Billing address (for paying customers)
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
4.2 Usage Data
- Audio streams: Processed in real time and not stored. Only if a customer switches on audio diagnostics (it is off by default) are the audio tracks of their sessions recorded, used for error analysis and automatically deleted after seven days.
- Transcripts and translations: Processed only during the session and not stored.
- Listener session data: Listeners do not need an account. The listener page stores a random identifier in the browser so that listener numbers and listening time stay correct after a reconnect. For each session we process this identifier together with the browser identification (user agent), the chosen channel and the start and end of listening. We use this data for listener statistics, billing and troubleshooting.
- Feedback: Customers and listeners can send us feedback voluntarily, for example a rating, a message and an email address for follow-up questions. So that we can understand the issue, we store details such as the session, channel, settings and browser identification, and for customers also the account. We may forward feedback to our support team by email. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the service and answering questions).
- Technical data: IP address, device type, browser information.
4.3 Special Categories of Data
Audio and text data may contain special categories of personal data within the meaning of Art. 9(1) GDPR, insofar as such information occurs incidentally in the transmitted content, without its processing being a purpose of the processing (depending on the type of event, for example information about religious or philosophical beliefs). The platform is not designed to detect, categorize or evaluate such information; it processes the spoken word irrespective of its content.
Processing is carried out on behalf of the customer, who as the controller ensures lawfulness.
4.4 Retention Period
| Type of data | Retention period |
|---|---|
| Audio streams | Not stored (exception: audio diagnostics switched on by the customer, automatically deleted after seven days) |
| Transcripts and translations | Not stored, processed only during the session |
| Listener session data | Session logs for troubleshooting: automatically deleted after seven days. Statistics per session: until the customer deletes them in the customer portal or together with their account |
| Feedback | As long as we need it to handle the request and improve the service |
| Account data | Until termination, plus statutory retention periods |
| Invoice data | 10 years (§ 147 AO, § 257 HGB) |
| Backup copies | Up to 90 days in encrypted system backups |
| Server log files | 60 days (see section 3) |
Customers can delete the data of past sessions themselves at any time in the customer portal. Deleting the account removes the associated session, recording and usage data. Invoice and accounting data is retained in accordance with statutory retention periods.
4.5 Browser Storage
For logging in to the platform we store a login token in your browser's storage (localStorage or IndexedDB). It keeps you logged in until you log out (legal basis: Art. 6(1)(b) GDPR). The listener page stores the random identifier mentioned in section 4.2 there, along with your settings such as language, captions and font size. See our Cookie Policy for details.
5. Contact Form and Newsletter
5.1 Contact Form
When you use our contact form, we process:
- First name
- Last name
- Email address
- Your message
We store your inquiry in our database and pass it on to HubSpot (data hosting in the EU, see section 7). To prevent abuse, we also store the time and the IP address of the request.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual inquiry) or Art. 6(1)(f) GDPR (legitimate interest in responding).
Retention period: We store your inquiries and related correspondence to be able to refer to previous communication for follow-up questions (legitimate interest under Art. 6(1)(f) GDPR) and to fulfill statutory retention obligations for business correspondence (6 years per § 257 HGB). Non-binding inquiries that do not lead to a business relationship are deleted after the regular limitation period (3 years to the end of the year).
5.2 Newsletter
If you subscribe to our newsletter, we process your email address to send you news about Streamlingo. We store your subscription with its time and IP address in our database and manage it in HubSpot (see section 7).
Legal basis: Art. 6(1)(a) GDPR (consent).
Withdrawal: You can unsubscribe at any time, for example by emailing info@streamlingo.net.
Retention period: We use your address for the newsletter until you unsubscribe. After that, we keep the record of your subscription only as long as we need it to prove your consent.
6. Web Analytics with Plausible
We use Plausible Analytics to analyze website usage. Plausible is a privacy-friendly analytics service that:
- Uses no cookies
- Stores no personal data
- Operates exclusively on EU servers
- Requires no consent under the GDPR
Only aggregated, anonymous statistics are collected (page views, referrers, countries, device types).
Provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing website usage).
Objection: You can object to your visits being counted at any time by unticking the box below. We store your choice only in your browser (localStorage, no cookie). In another browser or after clearing your browser data you would need to make it again.
More information: https://plausible.io/privacy
7. Service Providers and Data Transfers
To provide our services, we use the following service providers. Where they process personal data on our behalf, we have concluded data processing agreements with them under Art. 28 GDPR.
Where personal data is transferred to countries outside the EU and the EEA, this is based on an adequacy decision of the EU Commission (in particular the EU-US Data Privacy Framework, Art. 45 GDPR) or on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
For transcription, translation and speech output we use AI services, which process the audio and text content of the events for this purpose. They are listed as “AI services” in the table.
| Provider | Purpose | Location | Legal basis |
|---|---|---|---|
| Google Cloud EMEA Limited | Cloud infrastructure (hosting, database, storage, login) | Ireland | EU processing; any intra-group transfers to Google LLC (USA) covered by the Data Privacy Framework and Standard Contractual Clauses |
| Google Cloud EMEA Limited (Gemini) | AI services | Ireland; processing possible worldwide, including the USA | EU-US Data Privacy Framework and EU Standard Contractual Clauses |
| Microsoft Ireland Operations Ltd. | Ireland | EU processing; any intra-group transfers to Microsoft Corporation (USA) covered by the Data Privacy Framework and Standard Contractual Clauses | |
| DeepL SE | AI services | Germany | Processing within the EU |
| Amazon Web Services EMEA SARL | Domain Name System (DNS) | Luxembourg | Processing within the EU |
| LiveKit, Inc. | Real-time audio transmission and operation of the sessions, including analytics (for example number of participants and connection quality) | USA | EU-US Data Privacy Framework |
| Functional Software, Inc. (Sentry) | Error and performance monitoring (data hosting in the EU) | USA | EU-US Data Privacy Framework |
| HubSpot, Inc. | CRM, customer communication and contact/form data (data hosting in the EU/Frankfurt) | USA | EU-US Data Privacy Framework and EU data residency |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland | EU processing; any intra-group transfers to Stripe, Inc. (USA) covered by the Data Privacy Framework and Standard Contractual Clauses |
| Paddle.com Market Ltd. | Payment processing (merchant of record) | United Kingdom | EU Commission adequacy decision for the United Kingdom |
Note on audio routing: Real-time audio is transmitted via LiveKit. For customers based in the EU, we use servers in the EU only. The table above shows where our AI services process the content.
8. Your Rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR): You may request information about your stored data.
- Rectification (Art. 16 GDPR): You may request the correction of inaccurate data.
- Erasure (Art. 17 GDPR): You may request the deletion of your data, provided no retention obligations apply.
- Restriction (Art. 18 GDPR): You may request the restriction of processing.
- Data portability (Art. 20 GDPR): You may receive your data in a machine-readable format.
- Objection (Art. 21 GDPR): You may object to processing based on legitimate interests.
- Withdrawal of consent (Art. 7(3) GDPR): You may withdraw any consent given at any time.
Contact: To exercise your rights, please contact info@streamlingo.net.
Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20 70173 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de
9. Data Security
We implement technical and organizational measures to protect your data, including:
- Encrypted data transmission (TLS/SSL)
- Encrypted data storage (encryption at rest)
- Access control and two-factor authentication
- Regular security audits
10. Changes to This Privacy Policy
We reserve the right to amend this privacy policy as necessary to adapt it to changes in the legal situation or changes to our services. The version currently published on our website applies.