Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email address, payment information (processed by Stripe), voice samples for AI cloning, facial images/videos for avatar creation, and product URLs for scraping.

We automatically collect: IP address (hashed for privacy), browser type, device information, usage analytics, streaming session data, and click/conversion tracking data for affiliate purposes.

2. How We Use Your Information

• To provide and maintain our AI live streaming service
• To process payments via Stripe (we never store card details)
• To create your AI persona (voice clone and avatar) — used exclusively for your account
• To track affiliate clicks and conversions (server-to-server, no third-party cookies)
• To improve our AI models and service quality
• To communicate service updates and support

3. AI-Generated Content Disclosure

Our service creates AI-generated video content using your uploaded persona data. All AI-generated streams are tagged with C2PA metadata declaring AI provenance, in compliance with platform guidelines (TikTok, YouTube, Facebook, etc.).

4. Data Storage & Security

Your data is stored securely on Supabase (PostgreSQL) with Row Level Security (RLS) ensuring users can only access their own data. Voice samples and facial data are encrypted at rest. Payment processing is handled entirely by Stripe — we never see or store your card numbers.

5. Data Sharing

We do NOT sell your personal data. We share data only with:

• Stripe — for payment processing
• Supabase — for database hosting
• GPU cloud providers — for AI inference (data is processed and not stored)
• Law enforcement — only when legally required

6. Your Rights (PDPA Malaysia & GDPR)

Under the Personal Data Protection Act 2010 (Malaysia) and GDPR (EU), you have the right to:

• Access — Request a copy of all your personal data
• Correction — Update or correct inaccurate data
• Deletion — Request complete account and data deletion ("right to be forgotten")
• Portability — Export your data in a machine-readable format
• Withdraw consent — Revoke consent for data processing at any time

To exercise these rights, contact us at [email protected] or use the account deletion feature in Settings.

7. Cookies & Tracking

We use minimal cookies for authentication (Supabase session) and language preference. Our affiliate tracking uses server-to-server (S2S) technology — we do NOT use third-party tracking cookies. Visitor fingerprinting uses privacy-safe hashing (IP + User-Agent → SHA-256 hash, not reversible).

8. Data Retention

Active account data is retained for the duration of your account. Stream recordings are retained for 90 days unless you request earlier deletion. After account deletion, all personal data is permanently removed within 30 days.

9. Contact

For privacy inquiries: [email protected]

AffiliateStream AI Sdn Bhd, Kuala Lumpur, Malaysia.