Privacy Policy

Overview

plain words What we collect, why, and what you can do about it.

ItsBagelBot is committed to protecting your privacy in accordance with GDPR (Europe), PIPEDA (Canada), Law 25 (Quebec), and the CCPA (California). This policy explains what data we collect, how we use it, and your rights.

Data We Collect

plain words Your Twitch handle, chat processed in the moment, aggregated usage stats, and an optional contact email.

We collect only what's necessary to provide the service:

• Twitch account information (username, channel ID) provided during OAuth connection
• Chat messages processed in real-time for moderation (not stored permanently)
• Usage analytics (aggregated, anonymized, no PII)
• An optional contact email address, if you choose to provide one, used for purchase receipts, gift notifications, and account-related messages. It is encrypted at rest and never used for marketing without your consent
• An optional Govee API key, only if you connect the Govee Lights feature. It lets the bot set your own smart lights when a viewer redeems a channel-points reward. It is encrypted at rest, decrypted only on our servers to send commands to Govee, never shown back to you, and deleted the moment you remove it or disable the integration
• Technical request and security data processed by Cloudflare, such as IP address, routing data, browser or device information, requested URL, and security events

Data We Don't Collect

plain words No personal browsing profiles, ad data, or IP-based tracking by us.

We never collect:

• Personal browsing data
• IP addresses to build profiles or track you across websites
• Information from third-party trackers
• Data for advertising purposes

Cloudflare, Cookies & Analytics

plain words Cloudflare hosts, protects, and delivers the service. Analytics are cookie-free; security cookies may be used when needed.

We use Cloudflare, Inc. to host, deliver, and protect our websites and services. Our website and documentation are hosted on Cloudflare Pages, and Cloudflare also provides content delivery, DNS, and protection against attacks and abusive traffic. Because requests pass through Cloudflare's network, Cloudflare necessarily processes technical data such as your IP address, traffic-routing data, system and browser information, requested URLs, and security signals. We use this processing to deliver content, prevent abuse, investigate security incidents, and keep the service reliable.

We also use Cloudflare Web Analytics to measure traffic and page performance in aggregate. Its browser beacon does not use cookies or browser storage and is not used to follow individuals across websites. The beacon receives an IP address as part of the network request, but Cloudflare states that it discards that address at the nearest data centre rather than storing it in Web Analytics logs.

Cloudflare may set strictly necessary security cookies, such as __cf_bm or cf_clearance, when bot protection or a security challenge requires them. These cookies support security and traffic management; we do not use them for advertising or behavioural profiling. For more information, see Cloudflare's Privacy Policy and cookie documentation.

How We Use Your Data & Legal Basis

plain words We use data to provide and secure the service. We never sell or rent it.

Solely to provide the ItsBagelBot service: moderate chat, execute commands, and run engagement features. Our legal basis for processing this data is the fulfillment of our contract with you (Terms of Service) and our legitimate interest in securing and improving our service. We do not sell or rent your personal data. We disclose it only to service providers described in this policy, when needed to provide the service, or when required by law.

Chat moderation is automated and follows the rules each broadcaster configures. Automated actions are limited to chat itself, such as removing a message or timing out a user, and have no legal or similarly significant effect on you.

Third-Party Services

plain words Tebex handles payments, Resend our automated emails, Zoho our correspondence, support runs on Discord, and Govee powers the optional smart-light feature.

To offer premium subscriptions, we integrate with Tebex. Tebex acts as the merchant of record for all transactions. When you initiate a checkout, we create a secure basket and redirect you to Tebex to complete the purchase. We do not process, collect, or store any payment details (like credit card numbers). We only receive the transaction ID and order status to fulfill your subscription. Tebex processes your payment data subject to their own Privacy Policy.

We use Resend, Inc. to deliver automated transactional emails, such as purchase receipts and gift notifications. When we send you such an email, Resend processes your email address and the message content for delivery purposes only, subject to Resend's own Privacy Policy.

We use Zoho Corporation's email services for non-automated correspondence, such as replies from our support team. When you email us, or we write to you directly, Zoho processes your email address and the content of the exchange to deliver and host that correspondence, subject to Zoho's own Privacy Policy. Aside from the processors described in this policy, we do not share your email address with anyone.

We also offer support through our Discord server. If you contact us there, Discord Inc. processes your Discord account information and messages under Discord's own Privacy Policy, which we do not control. Avoid posting sensitive information in public channels.

If you enable the Govee Lights feature, you provide a Govee API key that we store encrypted and use only to control your own Govee devices. When a viewer redeems the reward, we send a power and colour command to Govee's API on your behalf, authenticated with your key. Govee processes those requests under its own Privacy Policy. Your key is never shown back to you, and you can remove it at any time from the dashboard, which deletes it from our systems.

Data Storage, Retention & Transfers

plain words Chat is processed live, not kept. Settings stay encrypted in Canada for as long as your account exists.

Chat messages are processed in real-time and not permanently stored. Configuration data is encrypted at rest, and data in transit is encrypted using TLS. Account and configuration data is retained only for as long as your account exists and is deleted when you delete your account. Our application data is hosted in Canada, which benefits from an adequacy decision by the European Commission under the GDPR. Because Cloudflare operates a global network, technical request, security, and cookie data may be processed outside Canada, including in the United States and other countries where Cloudflare operates. Cloudflare handles those transfers under the safeguards described in its Privacy Policy and Data Processing Addendum.

Children's Privacy

plain words The service is not for children under 13, and we do not knowingly collect their data.

ItsBagelBot is not directed at children under 13 (or 16 in the EU/EEA), and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact support@itsbagelbot.com and we will delete it.

Your Rights (GDPR, PIPEDA, Law 25, CCPA)

plain words Ask for your data, portability, or its deletion any time. California residents get CCPA rights too. You can also complain to a privacy regulator.

Under GDPR, Law 25, and PIPEDA, you have the right to access, rectify, port, or erase your personal data. You can request data export or deletion at any time by contacting support@itsbagelbot.com. Deleting your account removes all associated data immediately, except for minimal records we are legally required to keep, such as transaction audit logs.

California residents: under the California Consumer Privacy Act (CCPA, as amended by the CPRA), you have the right to know what personal information we collect, to access it, to correct it, to delete it, and to not be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You can exercise these rights, yourself or through an authorized agent, by contacting support@itsbagelbot.com; we will verify your request and respond within the timelines the CCPA requires.

If you believe we have not handled your personal data properly, you also have the right to lodge a complaint with a supervisory authority: the Commission d'accès à l'information in Quebec, the Office of the Privacy Commissioner of Canada, your local data protection authority in the EU/EEA, or the California Privacy Protection Agency.

Changes

plain words If this policy changes meaningfully, you'll hear about it.

We may update this policy. Significant changes will be communicated via Discord and dashboard notifications.

Contact & Data Protection Officer

plain words Privacy questions go to support@itsbagelbot.com.

For questions about privacy, or to reach our designated Data Protection Officer (Person in charge of personal information under Law 25), email support@itsbagelbot.com.