Privacy Policy

1. Data Controller

xDreams GmbH, Musterstraße 1, 10115 Berlin, Germany. Contact email: [email protected]

2. Data We Collect

• Account data: stage name, email address, country and language.
• Verification data: real name, date of birth, identity document and selfie (Creators only).
• Usage data: platform activity, streams, messages and transactions.
• Payment data: handled exclusively by Stripe — xDreams does not store card details.
• Technical data: IP address, device type, browser and session cookies.

3. Purpose of Processing

• Provision of the streaming service and user communication.
• Identity verification and regulatory compliance (KYC/18+).
• Payment processing and earnings management.
• Fraud detection and prevention.
• Platform improvement through usage analytics.
• Sending relevant account notifications.

4. Legal Basis (GDPR)

• Contract performance: processing necessary to provide the service.
• Legal obligation: age verification and compliance with applicable regulations.
• Legitimate interest: fraud prevention and platform security.
• Consent: optional marketing communications.

5. Data Retention

Account data is retained while the account is active. After cancellation, data is deleted within 90 days, unless legally required to retain it. KYC documents are retained for 7 years due to legal obligations.

6. Third Parties & International Transfers

• Supabase (data storage, EU servers).
• Stripe (payment processing, PCI-DSS certified).
• OpenAI (automatic message translation, no personally identifiable data).
• We do not sell or transfer data to third parties for commercial purposes.

7. Your Rights

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data (right to be forgotten).
• Portability: receive your data in machine-readable format.
• Objection & restriction: restrict certain types of processing.
• To exercise your rights: [email protected]

8. Security

xDreams applies industry-standard technical and organisational measures: TLS encryption in transit, encryption at rest, role-based access control and regular security audits.