Legal

VPZONE is operated by Solutions Techno-Rédac inc., a Québec company, which is responsible for the personal information described here. This policy follows Québec's Act respecting the protection of personal information in the private sector as amended by Law 25, and Canada's PIPEDA. Where the European GDPR applies to you, it applies as well. Our person in charge of the protection of personal information (privacy officer) is:

Our governance rules (roles, retention, privacy impact assessments, incidents, complaints) are published on the governance page.

• Account: email, username, hashed password, declared age range (14–15, 16–17, 18+), optional display name / bio / avatar / banner, notification preferences.
• Parental consent (users 14–17): the parent or guardian email address you give us and the date the parent confirmed.
• Streaming: video and audio you choose to broadcast, stream title, description, tags, category, viewer counts. Recording (VOD) is opt-in per channel.
• Chat: messages you send, moderation actions (timeouts, bans).
• Activity: follows, subscriptions, likes, clips, channels watched, Pixels and case activity (case openings are public: username, item and tier).
• Billing and payouts: handled by Stripe — we receive subscription status, amounts and dates, and Stripe Connect status for creators; never your card or identity documents.
• Technical: IP address, browser/user agent, approximate country, request and error logs, mobile push token.
• Linked accounts (optional): Discord, Twitch, Kick, TikTok, YouTube or Gamefolio user id and encrypted tokens, only if you connect them.
• Consent records: Terms acceptance (version, date, IP, browser), cookie choice, deletion-request proof.

Plioz (voice): when a streamer opens a Plioz after a live, the voice of the people on the mic (the host and those they invite, only while their mic is on) is transmitted live through VPZONE's own LiveKit server in Canada and is never recorded. Everyone in the Plioz can see the list of participants (display name and avatar; signed-out visitors appear as guests). We keep the Plioz's metadata (title, start and end times, listener counts, who was given the mic, who was removed) for 90 days after it ends. Minors (14–17) can listen and chat but can never speak.

• Provide the service: accounts, streaming, chat, notifications, payments and creator payouts.
• Safety and moderation: detecting abuse, multiple accounts, fraud and illegal content; handling reports.
• Apply age rules: block accounts under 14, require parental consent for purchases by 14–17-year-olds, reserve monetization to adults, never show ads to minors.
• Compute creator tiers and fees (see section 8).
• Transactional emails (security, receipts, renewal notices). Marketing emails (newsletter, activation reminders, win-back, weekly digest) are sent only if you opted in; you can opt out in Settings → Notifications or with the unsubscribe link.
• Advertising only if you accept advertising cookies (see section 4).
• Meet legal obligations (tax, accounting, mandatory reporting).

We do not sell your personal information (see section 13 for US residents).

Legal bases (UK and EU GDPR). Where the GDPR applies to you, each purpose relies on the following legal basis:

For Québec and the rest of Canada, we rely on your consent — express consent where the law requires it, for example for advertising cookies and marketing emails — and on the exceptions provided by the applicable law (for example, uses consistent with the purposes for which the information was collected, or preventing and detecting fraud).

We ask for your consent in a clear, separate way for each purpose that needs it. Essential cookies (sign-in, security, your settings) are always on. Advertising cookies, including Google's, load only after you click “Accept all” or enable them under “Customize”. “Refuse” is as easy as accepting; without consent you see only VPZONE's own house ads or no ad. This applies everywhere in the world. You can change or withdraw your choice at any time with the “Cookie preferences” link in the footer. Full list: Cookie Policy.

You may also withdraw any other consent (marketing emails, linked accounts, parental consent) at any time; withdrawal does not affect what was done before.

Global Privacy Control and Do Not Track. If your browser or an extension sends the Global Privacy Control (GPC) signal, we honour it automatically as a refusal of advertising cookies and personalized ads, both in the page and on our servers, whatever you chose before; the cookie banner does not ask you again. The “Do Not Track” setting of some browsers is not a recognized standard, and we do not act on it; use GPC or the cookie preferences instead.

We share personal information only with providers that need it to run VPZONE, under written agreements requiring confidentiality and security:

Some of your information is stored or processed outside Québec: elsewhere in Canada, in the United States (Cloudflare, OpenAI, Stripe, MailBaby, Resend, Google, Expo, Giphy, GitHub, IGDB, Twitch, Unsplash, Discord (VPZONE's own server and bot), browser push services and the optional linked platforms), in India (Gamezop Arcade games), in Finland (Supercell, only when game stats are on), in France (European streaming servers) and on Cloudflare's global network. Before such a communication we carry out a privacy impact assessment (s. 17 of the Act) covering the sensitivity of the information, the purpose, the safeguards and the legal framework of the destination; these assessments have been completed for the providers listed above. Safeguards include contracts, encryption in transit, data minimization (e.g. chat is never sent to OpenAI; Giphy searches are proxied) and provider no-training commitments.

Images loaded by your browser. Some images are loaded by your browser directly from third-party hosts: game covers from IGDB (images.igdb.com), avatars of channels imported from Twitch and some category images from Twitch's CDN (static-cdn.jtvnw.net), and background photos on the sign-in pages from Unsplash (images.unsplash.com). When such an image loads, that host receives your IP address and browser information (user agent, the page that requested it), as with any web request.

Transfers from the UK and the EEA. Where the UK or EU GDPR applies, transfers to Canada rely on the European Commission's adequacy decision for Canadian commercial organisations subject to PIPEDA (also recognized by the UK). Transfers to the United States and other countries rely, depending on the provider, on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or on the provider's certification under the EU-U.S. Data Privacy Framework and its UK Extension, as set out in each provider's data processing terms.

VPZONE's optional "multistream to YouTube" feature uses YouTube API Services. By connecting your YouTube account to VPZONE, you agree to be bound by the YouTube Terms of Service. Google's handling of any data it receives is governed by the Google Privacy Policy.

What we access. Only when you click "Connect with YouTube", and only with your explicit consent, we request the youtube.force-ssl scope and call exactly two endpoints once: liveStreams.list to read your own persistent live stream's RTMP ingest address and stream key, and — only if your channel has no persistent live stream yet — liveStreams.insert to create one for you. We also read the email address of the Google account you connect, so we can show you which account is linked.

How we use it. The ingest address and stream key are used for one purpose only: to relay the broadcast you start on VPZONE to your own YouTube channel, at your request. We do not use this data for advertising, we do not sell or share it, and no human at VPZONE reads it except where strictly necessary to resolve a support issue you raise, to comply with the law, or to investigate abuse.

What we never do. We never read, upload, edit, publish or delete your YouTube videos, comments, captions, playlists or subscriber data, and we never post anything to your channel. The feature is limited strictly to obtaining your own live stream ingest credentials.

Storage and retention. Authorization is one-shot: we request an online-only access token, revoke it as soon as the two calls above complete, and never request or store a refresh token. The stream key is encrypted at rest and is deleted when you remove the YouTube destination or delete your account.

Revoking access. You can remove the YouTube destination at any time from Dashboard → Stream. You can also review and revoke VPZONE's access to your Google account directly at myaccount.google.com/permissions.

We keep information only as long as needed for its purpose, then destroy or anonymize it with automated jobs:

When you delete your account, after a 14-day grace period we anonymize your profile, erase your channel title/description/tags, and delete your chat messages, follows, push subscriptions, IP history, linked accounts, email logs, clips and recordings. Financial records are kept with an anonymized reference for 7 years.

Some decisions are made by automated processing alone. When that happens we tell you, and you can ask a person to review it.

• AI screening of stream title, description and tags (OpenAI moderation, on every save). Factors: categories detected in the text (e.g. hate, sexual content involving minors, violence, harassment). Result: the text may be rejected.
• Creator tier computation (daily). Factors: followers over 30 days (a follower counts as “qualified” only if the account passes anti-abuse checks, including that it does not come from the same IP network as the creator or many other followers), hours streamed, active subscribers, inactivity. Result: tier and platform fee.
• Chat AutoMod. Factors: words on the platform's and the channel's blocked-term lists. Result: message blocked and a short (30-second) chat timeout.

To get a human review, use the “Request review” option shown with the decision, or write to the privacy officer. You may also submit observations and ask for the personal information and the main factors used.

• Access and portability: download your data in a structured JSON format from Settings → Privacy, or ask the privacy officer.
• Rectification: edit your profile, or ask us to correct inaccurate information.
• Withdraw consent: cookie preferences, notification settings, disconnecting linked accounts.
• Deletion: Settings → Privacy → Delete account (14-day grace period).
• Restriction: ask us to limit the use of your information while we examine a request (for example a correction or an objection), or in the other cases provided by law.
• Objection: object at any time to direct marketing (we then stop it) and, on grounds relating to your situation, to processing based on our legitimate interests; we then stop unless we have compelling legitimate grounds or need it for legal claims.
• De-indexation / cessation of dissemination (s. 28.1): ask us to stop disseminating your information or to de-index a link to your name where the legal conditions are met.
• Complaint: write to the privacy officer; if you are not satisfied, you may complain to the Commission d'accès à l'information du Québec (CAI, cai.gouv.qc.ca), to the Office of the Privacy Commissioner of Canada (priv.gc.ca), and, if you are in the UK, to the Information Commissioner's Office (ico.org.uk) or, in the EU/EEA, to the data protection supervisory authority of the country where you live or work or where the alleged infringement took place.

We reply in writing within 30 days. If we refuse a request, we give the written reasons, the legal provision relied on and your recourses (CAI and the authorities above).

You must be at least 14 to have an account; accounts of younger children are closed. Users aged 14 to 17 can use VPZONE, but every purchase needs verified consent from a parent or guardian (email confirmation), they never see ads, and monetization and payouts are reserved for adults (18+). We store the declared age range (14–15, 16–17, 18+) to apply these rules. A parent can contact the privacy officer to access, correct or delete their child's information or to withdraw consent.

We record the IP addresses used to sign in to your account (kept 12 months after last use) to prevent abuse (ban evasion, multiple accounts, fraud) and to check that followers counted toward creator tiers are genuine. We do not use them for advertising or to locate you beyond the country level.

On every visit, VPZONE derives your country — and only your country — from your IP address, using the country code our host Cloudflare attaches to each request (our chat server does the same lookup for chat connections). We use it to pick the nearest video server and a suitable player buffering profile so live video loads quickly, to recommend the closest ingest server to streamers, and to give creators country-level audience statistics for their streams. These statistics are viewer counts per country, aggregated and anonymous, never linked to your name or account. The country is also stored with your Terms acceptance as part of the proof of consent.

We never determine a finer location (region, city or coordinates), and we never use your country for advertising profiling. This function cannot be turned off, because delivering video to you depends on it; you can still pick a video server region yourself in the player, which is remembered on your device.

• We do not sell personal information.
• Personalized Google ads shown after you accept advertising cookies may count as “sharing” or “targeted advertising” under some US state privacy laws. You can opt out at any time with the “Cookie preferences” link in the footer, or by sending Global Privacy Control, which we honour automatically (see section 4).
• To access, correct, delete or get a copy of your information, write to info@technoredac.ca.
• If we refuse your request, you may appeal by replying to our answer with “Appeal” in the subject line. We answer appeals within 45 days. If you disagree with the outcome, you can then contact your state attorney general.

Web, API, authentication, chat and playback traffic use encrypted HTTPS/WSS connections. Mobile live ingest currently uses RTMP and is not TLS-encrypted; do not broadcast sensitive content. Passwords are hashed, access to data is limited by role and protected by Row-Level Security. We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we promptly notify the CAI and the persons concerned.

We will announce material changes in the app and by email at least 14 days before they take effect. Changelog:

• 20 October 2026 — legal bases (GDPR), restriction and objection rights, complaints to the OPC, the UK ICO and EU authorities, UK/EEA transfer mechanisms, images loaded from IGDB, Twitch and Unsplash, Cloudflare Web Analytics, country location (s. 8.1), Global Privacy Control, US residents; Sentry error monitoring removed.
• 17 October 2026 — provider list: Gamezop, Discord bot and webhooks, browser push services, Supercell / deltaforceapi.com, Techno-Cloud (WHMCS), Google sign-in; recordings kept 14 days (3 days on Cloudflare ingest).
• 16 October 2026 — Plioz (voice hangout after a live): voice relayed live in Canada, never recorded, metadata kept 90 days.
• 16 October 2026 — full rewrite: privacy officer, consent and cookie preferences, complete provider list, transfers outside Québec, retention schedule, automated decisions, minimum age 14, opt-in marketing.
• 2 September 2026 — previous version.