Privacy Policy
Section 1Data Controller
The data controller for personal data processed through FanSpeak within the meaning of Art. 4(7) GDPR is:
- Name: V-Tech Services s.r.o.
- Company ID: 24091995
- DPO contact: privacy [at] fanspeak.io
- General privacy contact: privacy [at] fanspeak.io
The controller processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Act No. 110/2019 Coll. on personal data processing (Czech law).
Section 2Data We Collect
2.1 Account data
The email address is used for:
- authentication and account management,
- notifying Users of material changes to this Policy or the Terms of Service,
- responding to queries or complaints from the User.
2.2 Connected Platform data
When the User connects the Service to a third-party platform (e.g. YouTube), FanSpeak retrieves and stores, on the basis of the User's authorisation:
- channel/page identifiers and publicly available metadata (name, avatar, subscriber count),
- content items (video titles, descriptions, publication dates, thumbnails),
- comments, replies and associated metadata (commenter username, text, timestamp, like counts),
- OAuth2 tokens (access and refresh), stored encrypted.
This data is retrieved solely on the basis of the authorisation granted by the User and is used exclusively to power the Service's features (inbox, search, reply tracking, analytics).
2.3 Operational data
- IP address and User-Agent string at login (stored for security purposes),
- reply actions and AI suggestion usage (for service improvement, in anonymised or pseudonymised form).
Section 3Legal Basis for Processing (GDPR)
| Purpose of processing | Legal basis | GDPR reference |
|---|---|---|
| Login and account management (email) | Performance of a contract | Art. 6(1)(b) |
| Retrieval of Connected Platform data | Performance of a contract | Art. 6(1)(b) |
| Security logs (IP, User-Agent) | Legitimate interest (security, fraud prevention) | Art. 6(1)(f) |
| Service improvement (anonymised analytics) | Legitimate interest | Art. 6(1)(f) |
| Marketing communications (opt-in only) | Consent | Art. 6(1)(a) |
| Compliance with legal obligations | Legal obligation | Art. 6(1)(c) |
Where processing is based on legitimate interest (Art. 6(1)(f) GDPR), the Controller has carried out a balancing test. The result is available on request at privacy [at] fanspeak.io.
Section 4Data Retention
| Category of data | Retention period |
|---|---|
| Email address (account data) | Duration of account + 30 days after closure |
| Connected Platform data (comments, metadata) | While channel is connected; deleted within 30 days of disconnection or account closure |
| Security logs (IP, User-Agent) | 90 days |
| Contact form / email submissions | 12 months |
| Accounting and tax records | As required by Czech Act No. 563/1991 Coll. (generally 5-10 years) |
Section 5Recipients and Processors
The Controller does not sell Users' personal data. Data may be shared with:
- Infrastructure providers: hosting, database and email delivery services (processors bound by data processing agreements under Art. 28 GDPR).
- Public authorities: only when legally required and to the minimum extent necessary.
A complete list of processors is available on written request to privacy [at] fanspeak.io.
Section 6Your Rights under GDPR
Under GDPR, you have the following rights:
To exercise any of these rights, contact privacy [at] fanspeak.io or privacy [at] fanspeak.io. The Controller will respond within 30 days; in complex cases the period may be extended by a further 2 months (Users will be informed of any extension).
Section 7Security (Art. 32 GDPR)
The Controller implements technical and organisational measures appropriate to the risk of processing:
- HTTPS for all data transfers,
- encrypted storage of OAuth2 tokens,
- HttpOnly and Secure cookie attributes (SameSite=Lax),
- database access restricted exclusively to application servers,
- regular security audits and monitoring.
No system is perfectly secure. Please report any security vulnerabilities to privacy [at] fanspeak.io.
In the event of a personal data breach, the Controller will act in accordance with Art. 33 and 34 GDPR: notifying the supervisory authority within 72 hours and informing affected data subjects where required.
Section 8Cookies
FanSpeak uses only strictly necessary (technical) cookies:
- an authentication session cookie (HttpOnly, Secure, SameSite=Lax),
- a refresh token cookie with the same attributes.
No advertising or tracking cookies are used. Consent is not required for these cookies under Art. 6(1)(b) GDPR and applicable Czech law (§ 89 of Act No. 127/2005 Coll.), as they are strictly necessary for the provision of the Service.
Section 9International Transfers
Users' data is generally processed within the European Economic Area (EEA). Where transfers outside the EEA occur, appropriate safeguards are in place:
- Standard Contractual Clauses under Art. 46(2)(c) GDPR (SCCs), or
- another transfer mechanism approved by the European Commission.
A copy of the relevant safeguards is available on request at privacy [at] fanspeak.io.
Section 10Automated Decision-Making and Profiling
FanSpeak does not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR that would produce legal or similarly significant effects on Users.
Section 11Changes to this Policy
The Controller reserves the right to update this Policy at any time. Users will be notified of material changes by an in-app notice at least 14 days before the changes take effect. The current version is always available at https://fanspeak.io/legal?tab=privacy.
Section 12Contact Details
Company ID: 24091995