Pos-IT e.U. Pos-IT e.U. Mobspawner

Mobspawner · Legal information

PRIVACY POLICY FOR MOBSPAWNER

Effective date: 2 August 2026

1. CONTROLLER

The controller responsible for the processing of personal data in connection with Mobspawner is:

Pos-IT e.U.
Owner: Benjamin Pos
Herbststraße 71-75/8/2
1160 Vienna
Austria

Email: office@pos-it.at
Telephone: +43 664 2345701
Legal notice: https://pos-it.at/impressum/

Privacy-related requests, including requests for access, rectification, erasure or restriction of processing, may be sent to office@pos-it.at.

2. SCOPE

This Privacy Policy applies to the Mobspawner web application and its related websites, application programming interfaces, administration interfaces, clients and background services.

This includes, in particular, services provided at:

https://mobspawner.pos-it.at/

as well as any other subdomains or approved frontend domains expressly used for Mobspawner.

Mobspawner is an application for integrating streaming platforms. The application may provide, among other things, user accounts, platform connections, live chat commands, bot responses, roles, streamer dashboards, membership checks, access controls, rewards and an internal points system.

3. PRINCIPLES OF DATA PROCESSING

We process personal data only to the extent necessary to provide Mobspawner, manage user accounts and platform connections, perform requested functions, secure the application or comply with legal obligations.

Depending on the specific processing activity, we rely in particular on the following legal bases:

  • Article 6(1)(b) GDPR, where processing is necessary to provide Mobspawner or perform a function requested by the user;
  • Article 6(1)(a) GDPR, where separate voluntary consent is obtained;
  • Article 6(1)(f) GDPR, for the secure, stable and abuse-resistant operation of the application, error analysis, prevention of attacks and establishment, exercise or defence of legitimate claims;
  • Article 6(1)(c) GDPR, where we are legally required to process or retain data.

Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Marking note: Data fields shown normally are used and required by Mobspawner for the described feature. May be technically supplied by the platform, but is not required by Mobspawner for the relevant feature.

3.1. DATA SUBJECTS AND DATA SOURCES

The processing may concern, in particular:

  • registered Mobspawner users;
  • owners of connected Google, YouTube or Twitch accounts;
  • streamers, administrators or moderators authorised by the channel owner;
  • authors of messages or events in a YouTube or Twitch live chat processed through Mobspawner;
  • persons whose membership, subscription, role or status information is processed through an authorised platform interface.

Data is either collected directly from the data subject, transmitted through an OAuth connection initiated by the data subject or channel owner, or obtained through the application programming interfaces of Google, YouTube or Twitch. For live chat and platform data, the relevant platform or the connected channel on that platform is the source of the data.

Where data concerning chat participants is not collected directly from them, it is processed only to the extent required for the relevant function. Processing serves, in particular, to execute chat commands, assign roles and permissions, provide channel-related functions and protect against abuse and manipulation. Depending on the specific function, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. Where processing is based on legitimate interests, we take the reasonable expectations of the data subjects into account and do not process the data where their overriding interests, fundamental rights or freedoms prevail.

4. TECHNICAL ACCESS AND LOG DATA

When Mobspawner is accessed, technically necessary data may be processed. This may include, in particular:

  • IP address;
  • date and time of access;
  • requested address or API function;
  • HTTP method and response status;
  • browser type and browser version;
  • operating system and device type;
  • referrer address, where transmitted;
  • session and login information;
  • error, security and abuse events;
  • technical identifiers and request IDs.

This data is processed to deliver Mobspawner, detect errors, prevent attacks and manipulation attempts, investigate unauthorised access and ensure system stability.

Normal technical server logs are generally retained for no longer than 14 days. Where there is a specific security incident, suspected abuse or legal dispute, relevant log data may be retained for longer until the matter has been conclusively resolved.

5. MOBSPAWNER USER ACCOUNTS

When a Mobspawner account is created or used, the following data may be processed in particular:

  • internal user ID;
  • username and display name;
  • email address, where provided or released by a login service;
  • profile image or avatar;
  • assigned roles and permissions;
  • language, display and personal settings;
  • registration time and last login;
  • connected platform accounts;
  • login, session and security information;
  • password hash, where local login is offered;
  • support, suspension and security notes.

Passwords are not stored in plain text. Where local login is offered, only technically appropriate password hashes are stored.

Account data is generally processed for as long as the Mobspawner account exists. Following account deletion, the data is erased or anonymised unless statutory retention obligations or legitimate reasons require limited further retention.

6. SESSIONS, COOKIES AND BROWSER STORAGE

Mobspawner uses technically necessary cookies or comparable browser storage technologies in particular to:

  • maintain authenticated sessions;
  • manage login and security tokens;
  • store user and display settings;
  • configure language, font size, colour mode or contrast;
  • provide security and abuse protection;
  • where such a choice is offered, store a previously selected privacy or cookie preference.

Depending on the technical implementation, session information may be stored in a secure cookie or in local or session-based browser storage.

Google/YouTube OAuth tokens and Twitch OAuth tokens are not stored in the browser or made publicly visible. They are processed exclusively on the server side.

Mobspawner does not use Google/YouTube API data for personalised advertising, advertising profiles or cross-platform tracking.

7. GOOGLE AND YOUTUBE API DATA IN MOBSPAWNER

7.1. Use of YouTube API Services

Mobspawner uses YouTube API Services and Google OAuth 2.0 to provide Google and YouTube functions that users choose to activate.

Connecting a Google or YouTube account is voluntary. Before the connection is established, the user is redirected to Google's OAuth consent screen, where the specific permissions requested are displayed.

Mobspawner requests only those Google and YouTube permissions that are required for the functions currently enabled.

7.2. Google account data processed

When a user connects Mobspawner to a Google account, the following data may be processed depending on the permissions granted:

  • unique Google account ID;
  • name and display name;
  • email address;
  • profile image May be supplied as part of a standard response; not required by Mobspawner for the relevant feature.;
  • language or other released basic profile information, where applicable May be supplied as part of a standard response; not required by Mobspawner for the relevant feature.;
  • time of account connection;
  • granted OAuth permissions;
  • validity period and status of the authorisation.

7.3. YouTube channel data processed

Depending on the functions enabled and the permissions granted, the following YouTube data may be processed in particular:

  • YouTube channel ID;
  • channel name and display name;
  • channel URL;
  • channel and profile image;
  • information linking the channel to a Mobspawner account;
  • identifiers of active and recently completed live streams and live chats;
  • channel and live-stream metadata required for the relevant function, including lifecycle and visibility status;
  • status, attempts and result of an expressly enabled automatic privacy change for YouTube recordings.

7.4. YouTube live chat data

Where live chat functions are enabled, Mobspawner may process the following data from YouTube live chat in particular:

  • live chat ID and message ID;
  • content of a live chat message;
  • date and time of the message;
  • YouTube channel ID of the author;
  • display name of the author;
  • profile image of the author May be supplied as part of the requested YouTube response; not required by Mobspawner for the relevant feature.;
  • role and status information made public or provided through the API, such as channel owner, moderator or member May be supplied as part of the requested YouTube response; not required by Mobspawner for the relevant feature.;
  • type of live chat event;
  • detected Mobspawner commands;
  • result of command processing;
  • technically necessary error and abuse information.

Live chat messages are generally processed in real time. Mobspawner does not create a permanent and complete archive of all YouTube live chat messages.

Where temporary logging is necessary to execute a command, analyse an error, prevent abuse or process an internal Mobspawner points transaction, only the information required for that purpose is stored. Live chat message content, message IDs and other YouTube API raw data that is no longer required are erased no later than 30 calendar days after collection. Where an ongoing account mapping or another permitted function continues to require YouTube API data, the authorisation and accuracy of the stored data are checked at least every 30 calendar days and the data is updated or erased as necessary.

After processing has been completed, only Mobspawner's own transaction or functional data may continue to be stored, provided that it does not contain YouTube API raw data that is no longer required and is not used as a substitute for YouTube data or as a metric derived from YouTube data.

7.5. YouTube membership data

Where a channel owner enables membership functions, Mobspawner may process the following data depending on the approved permissions:

  • YouTube channel ID of the member;
  • display name and profile image of the member;
  • membership status;
  • membership level and its name;
  • duration or start of membership, where provided by the API;
  • association between the membership and the internal Mobspawner account;
  • time of the last verification.

This data is used to provide membership functions configured by the channel owner. These may include access rights, roles, rewards and, where permitted by YouTube's policies, a benefit or bonus factor defined by the channel owner in the internal Mobspawner points system. Membership status is not used to create a metric concerning the performance, reach or quality of a YouTube channel.

Membership information is updated regularly. Outdated YouTube membership data is updated or erased no later than 30 calendar days after the previous verification.

7.6. OAuth access and refresh tokens

To provide authorised functions on an ongoing basis, Mobspawner may process the following authorisation data:

  • OAuth access token;
  • OAuth refresh token;
  • granted permissions;
  • expiry time;
  • token status and revocation information.

OAuth tokens are stored exclusively on the server side and in encrypted form. They are not displayed publicly, included in live chat messages or disclosed to streamers, moderators or other users.

Technical access to OAuth tokens is restricted to the system components required for communication with Google or YouTube.

7.7. Purposes of Google and YouTube data processing

Mobspawner uses Google and YouTube data exclusively for clearly identifiable, user-requested functions. These include, in particular:

  • login and identity matching;
  • linking a Mobspawner account to a Google or YouTube account;
  • assigning streamers, channels, moderators and viewers;
  • detecting and processing YouTube live chat commands;
  • issuing bot responses;
  • displaying channel-related information in the dashboard;
  • automatically changing a completed YouTube recording to “private” where the channel owner expressly enabled this function beforehand;
  • checking memberships;
  • assigning roles and access rights;
  • providing reward functions;
  • applying membership benefits or bonus rules configured by the channel owner within the internal Mobspawner system;
  • fraud, abuse and security controls;
  • troubleshooting and support at the user's express request.

Google and YouTube data is not used for other purposes incompatible with these functions.

7.8. Actions taken on behalf of a user

Depending on the enabled functions and OAuth permissions, Mobspawner may:

  • read data from a connected YouTube channel;
  • retrieve membership information;
  • read live chat messages;
  • publish bot messages in YouTube live chat through an expressly connected or configured account;
  • after YouTube has confirmed that a live stream ended, change the visibility of the associated recording to “private” where the channel owner enabled the relevant switch.

Mobspawner does not perform hidden actions on behalf of a user. Write functions are used only where they have been expressly enabled by the relevant user or channel owner.

Bot responses are published in the relevant YouTube live chat and are visible to all persons who can view that live chat. This also applies where a response was triggered by the message or command of a single user. Where a bot response contains a username, command status, points balance or another publicly visible identifier, that information is also visible in the live chat.

7.9. Internal visibility and recipients

Google and YouTube data may be accessible, to the extent necessary, to the following recipients:

  • Google and YouTube in connection with technical API and OAuth communication;
  • the user whose account was connected;
  • the owner of the relevant connected YouTube channel;
  • administrators, streamers or moderators expressly authorised by the channel owner, where required for their assigned role;
  • technical hosting, server, network, database and backup providers, where engaged as processors;
  • authorised persons at Pos-IT e.U., solely where necessary for security, troubleshooting, support at the user's express request or compliance with legal obligations;
  • all persons who can view the relevant YouTube live chat, where Mobspawner publishes a bot message or bot response there.

Permissions within Mobspawner are assigned in accordance with the principle of least privilege. A channel owner must expressly determine which persons may access channel-related data.

7.10. No sale and no advertising use

Google and YouTube data is:

  • not sold;
  • not transferred to data brokers;
  • not used for personalised advertising;
  • not used to create advertising profiles;
  • not used for creditworthiness assessments;
  • not used to make credit, insurance or employment decisions;
  • not combined with other data sets without a permitted purpose.

Data is transferred only where necessary to provide a Mobspawner function requested by the user, for security, to comply with legal obligations or on the basis of separate express consent.

7.11. Google API Services User Data Policy and Limited Use

The use and transfer of information received by Mobspawner through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Google and YouTube data is used only for the functions described in this Privacy Policy and visible to the user.

Human access to Google or YouTube data takes place only:

  • with the user's express consent to access specific data;
  • to handle a specific support request;
  • where necessary to investigate a security or abuse incident;
  • where required by law;
  • in aggregated or anonymised form for internal operations, provided that individual users cannot be identified.

7.12. Retention of Google and YouTube data

Google and YouTube data is retained only for as long as required for the authorised functions.

The following principles apply in particular:

  • OAuth tokens are retained only while the account connection exists and the permission remains necessary;
  • non-statistical YouTube API data is erased or refreshed through the YouTube API no later than every 30 calendar days;
  • automatic privacy-action logs containing the YouTube broadcast identifier, processing status and error message are erased no later than after 30 calendar days;
  • complete live chat histories are not stored permanently;
  • membership data is updated regularly and rechecked or erased no later than every 30 calendar days;
  • after a Google/YouTube connection is disconnected, OAuth tokens are revoked and the associated Google/YouTube API data is erased as soon as possible and no later than seven calendar days after disconnection;
  • when a Mobspawner account is deleted, the associated Google/YouTube API data is likewise erased as soon as possible and no later than seven calendar days after account deletion;
  • the validity of the authorisation is checked regularly; if a token can no longer be validated or refreshed, further API requests are stopped;
  • where access is revoked outside Mobspawner through Google's security settings, the affected API data is erased after the revocation is detected, as soon as possible and no later than 30 calendar days after revocation;
  • statutory retention obligations remain unaffected where they actually apply in the specific case.

Mobspawner's own data, such as internal points, rewards or anonymised statistical information, may continue to be stored only where it does not contain identifying Google/YouTube API data and cannot be used to reconstruct such data.

7.13. Revocation and disconnection of the Google/YouTube account

Users may remove the connection to Google or YouTube at any time by using the “Disconnect Google/YouTube” function in the connected accounts section.

Mobspawner will then:

  • technically revoke the OAuth authorisation;
  • erase stored access and refresh tokens;
  • erase the associated Google/YouTube API data;
  • stop future API requests.

Alternatively, access may be removed directly in the Google account security settings:

https://security.google.com/settings/security/permissions

or:

https://myaccount.google.com/connections

Deleting or disconnecting data within Mobspawner does not delete videos, comments, live chat messages, memberships or other content directly on YouTube. Such data must be managed within the relevant Google or YouTube account where applicable.

A request for erasure or revocation may also be sent to office@pos-it.at. Where the request relates to YouTube API data stored by Mobspawner, that data is erased as soon as possible and no later than seven calendar days after the request, unless a mandatory statutory retention obligation applies.

7.14. Google and YouTube privacy information

Further information on Google's processing of personal data is available at:

https://policies.google.com/privacy

Use of YouTube is also subject to the YouTube Terms of Service:

https://www.youtube.com/t/terms

Information about YouTube API Services is available at:

https://developers.google.com/youtube/terms/api-services-terms-of-service

The Google API Services User Data Policy is available at:

https://developers.google.com/terms/api-services-user-data-policy

The YouTube API Services Developer Policies are available at:

https://developers.google.com/youtube/terms/developer-policies

8. TWITCH INTEGRATION

8.1. Connecting Twitch

Mobspawner uses Twitch OAuth and Twitch application programming interfaces to provide Twitch functions that users choose to activate. Connecting a Twitch account is voluntary. Before the connection is established, the user is redirected to Twitch's authorisation page, where the specific permissions requested are displayed.

Mobspawner requests only those Twitch permissions that are required for the functions actually enabled.

8.2. Twitch account, channel and stream data processed

Depending on the permissions granted and the functions enabled, the following data may be processed in particular:

  • Twitch user ID;
  • username and display name;
  • profile image May be supplied as part of a standard Twitch response; not required by Mobspawner for the relevant feature.;
  • email address, where expressly released;
  • time and status of the account connection;
  • channel information;
  • stream information Currently neither requested nor required by Mobspawner.;
  • identifiers of chat channels;
  • identifiers of active streams Currently neither requested nor required by Mobspawner.;
  • subscription information, where required for an enabled function;
  • role, moderator or badge information May be supplied as part of a Twitch event payload; not required by Mobspawner for the relevant feature.;
  • granted OAuth permissions and validity or revocation information.

8.3. Twitch live chat data and bot messages

Where Twitch live chat functions are enabled, Mobspawner may process the following data in particular:

  • content of a chat message;
  • message, user, channel and chat-room identifiers;
  • date and time of a chat event;
  • username and display name of the author;
  • roles and badges of the author May be supplied as part of a Twitch chat event; not required by Mobspawner for the relevant feature.;
  • detected Mobspawner commands;
  • result of command processing;
  • technically necessary error, security and abuse information;
  • bot messages and bot responses triggered by Mobspawner.

Twitch live chat messages are generally processed in real time. Mobspawner does not create a permanent and complete archive of all Twitch chat messages. Where temporary logging is necessary to execute a command, analyse an error, prevent abuse or process an internal Mobspawner points transaction, only the information required for that purpose is stored. Twitch chat raw data that is no longer required is generally erased no later than 30 calendar days after collection.

Bot messages and bot responses are published in the relevant Twitch chat and are visible to all persons who can view that chat. This also applies where a message was triggered by the command or message of a single user. Where a bot response contains a username or another publicly visible Twitch identifier, that information is also visible in the chat.

8.4. Purposes and actions

Twitch data is used in particular for the following purposes:

  • login and identity matching;
  • linking a Mobspawner account to a Twitch account;
  • assigning streamers, channels, moderators and viewers;
  • detecting and processing Twitch chat commands;
  • publishing bot messages and bot responses;
  • determining live or stream status;
  • displaying channel-related information in the dashboard;
  • checking roles, subscriptions or other released status information;
  • assigning roles and access rights;
  • providing Mobspawner reward and points functions;
  • fraud, abuse and security controls;
  • troubleshooting and support at the user's express request.

Write actions through Twitch are performed only where the relevant function has been expressly configured or enabled by the channel owner or by the owner of the bot account being used.

8.5. OAuth tokens and security

To provide authorised Twitch functions, Mobspawner may process OAuth access and refresh tokens, granted permissions, expiry times and token status.

Twitch OAuth tokens are stored exclusively on the server side and in encrypted form. They are not displayed publicly, included in chat messages or disclosed to streamers, moderators or other users.

The validity of Twitch tokens in use is checked regularly. If a token becomes invalid or the connection is disconnected through Twitch, the associated API sessions are terminated and no further requests are made using that token.

8.6. Retention

Twitch OAuth tokens are retained only while the connection exists and the relevant permission is required for an enabled function.

Channel, role, subscription and status information is updated regularly or erased once it is no longer required for the enabled function. Twitch chat raw data that is no longer required is generally erased no later than 30 calendar days after collection.

After a Twitch connection is disconnected or a Mobspawner account is deleted, stored OAuth tokens and Twitch data that is no longer required are erased or anonymised as soon as possible, generally no later than seven calendar days after disconnection or deletion, unless a statutory retention obligation or compelling security reason requires limited further retention.

8.7. Recipients and no sale

Twitch data may be accessible, to the extent necessary, to the following recipients:

  • Twitch in connection with API and OAuth communication;
  • the user whose account was connected;
  • the owner of the relevant connected Twitch channel;
  • administrators, streamers or moderators expressly authorised by the channel owner, where required for their assigned role;
  • technical hosting, server, network, database and backup providers, where engaged as processors;
  • authorised persons at Pos-IT e.U., solely where necessary for security, troubleshooting, support at the user's express request or compliance with legal obligations;
  • all persons who can view the relevant Twitch chat, where Mobspawner publishes a bot message or bot response there.

Twitch data is not sold, transferred to data brokers, used for personalised advertising or advertising profiles, or used for creditworthiness, insurance or employment decisions.

8.8. Disconnecting a Twitch account

The Twitch connection may be removed at any time in the Mobspawner account settings. Mobspawner will then:

  • stop further API requests through the connection;
  • erase stored OAuth tokens;
  • erase or anonymise Twitch data that is no longer required;
  • terminate associated background processes and subscriptions.

Alternatively, the user may disconnect the application in the “Connections” section of the Twitch account settings:

https://www.twitch.tv/settings/connections

Disconnecting Twitch within Mobspawner does not delete messages, videos, subscriptions or other content directly on Twitch. Such content must be managed within the Twitch account where applicable.

A request for erasure or revocation may also be sent to office@pos-it.at.

8.9. Twitch privacy information and developer terms

Further information on Twitch's processing of personal data is available at:

https://www.twitch.tv/p/legal/privacy-notice/

Use of Twitch application programming interfaces is also subject to the Twitch Developer Services Agreement:

https://www.twitch.tv/p/legal/developer-agreement/

9. MOBSPAWNER POINTS, ROLES AND REWARDS

Mobspawner may process its own application data, including in particular:

  • internal points balance;
  • points credits and deductions;
  • time and reason for a transaction;
  • executed commands and redemptions;
  • rewards;
  • cooldowns and usage limits;
  • assigned roles;
  • approvals and access restrictions;
  • stream and session context;
  • security and abuse flags.

This data is used to provide the Mobspawner points and rewards system, maintain transaction traceability, troubleshoot errors and protect against manipulation.

Mobspawner points, bonus rules and roles are the application's own functional and reward data. They are not official metrics, ratings or statistics of Google, YouTube or Twitch. They are not used as a substitute for platform data and are not used to assess the performance, reach, quality, advertising suitability or financial situation of a channel or user.

Where released platform information, such as membership, subscription or role status, is used as an eligibility condition for a Mobspawner function configured by the channel owner, Mobspawner processes only the status information required for that purpose. Platform data from different channel owners is not combined into cross-channel performance metrics or rankings.

Where a platform event is used for a points transaction, Mobspawner generally stores only the result required to execute and document the Mobspawner function. Platform raw data that is no longer required is erased or updated within the applicable period.

Points and transaction data are generally stored for the lifetime of the Mobspawner account. Following account deletion, the data is erased or anonymised unless legitimate or statutory reasons require further retention. Following disconnection of a platform account, internal points data may be retained only where it is no longer linked to Google, YouTube or Twitch API data that is not required.

10. AUTOMATED RULES

Mobspawner performs rule-based automated processing. This may include:

  • detection of a chat command;
  • checking a points balance;
  • applying a cooldown;
  • checking a role or membership;
  • crediting or deducting points;
  • triggering a reward;
  • granting or denying access to a Mobspawner function;
  • automated bot responses.

This processing serves only the operation of Mobspawner. Mobspawner does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person within the meaning of Article 22 GDPR.

In particular, Mobspawner does not carry out credit assessments, employment decisions, insurance assessments or comparable evaluations of natural persons.

11. SUPPORT AND COMMUNICATION

Where users contact us by email, contact form or through a support function, we may process in particular:

  • name and contact details;
  • Mobspawner user identifier;
  • content of the request;
  • technical error and diagnostic data;
  • communication history;
  • screenshots or files voluntarily submitted, where applicable.

This data is processed to handle the request, troubleshoot errors and document the communication. Support data is erased when it is no longer required and no statutory or legitimate reason requires further retention.

12. RECIPIENTS AND PROCESSORS

Personal data may be disclosed, to the extent necessary, to the following categories of recipients:

  • hosting, data-centre, network and infrastructure providers;
  • database, backup and security providers;
  • Google or YouTube when the relevant functions are used;
  • Twitch when the relevant functions are used;
  • authorised streamers, channel owners, administrators or moderators within their expressly assigned roles;
  • legal, tax or other professional advisers, where necessary;
  • public authorities and courts, where disclosure is legally required.

Processors may process data only on our instructions and on the basis of an appropriate data processing agreement.

Data is not disclosed to other third parties unless there is a legal basis, a statutory obligation or express consent.

13. PROCESSING OUTSIDE THE EEA

Mobspawner's own application infrastructure is generally operated within Austria or the European Economic Area.

When Google, YouTube or Twitch is used, personal data may be processed outside the European Economic Area depending on the infrastructure of the relevant platform operator.

Where required, such transfers are based on an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses or other safeguards permitted under the GDPR.

Further information is available in the privacy notices of the relevant platform operators.

14. DATA SECURITY

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised disclosure and unauthorised access.

These measures include in particular:

  • encrypted data transmission using TLS/HTTPS;
  • encryption of stored OAuth tokens;
  • role-based access controls;
  • the principle of least privilege;
  • separation of application, database and administration access;
  • logging of security-relevant events;
  • regular security updates;
  • controlled backups;
  • access restrictions for administrators;
  • protection against automated attacks and abuse.

Despite appropriate safeguards, absolute security cannot be guaranteed for internet-based systems.

15. BACKUPS AND ERASURE

Backups are used solely to restore systems following technical failures or security incidents.

OAuth tokens and short-lived raw data from Google, YouTube or Twitch APIs are either excluded from long-term backups or protected by appropriate technical measures so that they cannot be used productively again after authorisation has been revoked.

Where data is restored from a backup, previously completed erasures and revocations are reapplied.

Backups are overwritten or erased in accordance with a defined rotation and deletion schedule.

16. RIGHTS OF DATA SUBJECTS

Subject to the statutory requirements, data subjects have in particular the following rights:

  • right of access under Article 15 GDPR;
  • right to rectification under Article 16 GDPR;
  • right to erasure under Article 17 GDPR;
  • right to restriction of processing under Article 18 GDPR;
  • right to data portability under Article 20 GDPR;
  • right to object under Article 21 GDPR;
  • right to withdraw consent with effect for the future;
  • right to lodge a complaint with a data protection supervisory authority.

Requests may be sent to:

office@pos-it.at

To prevent unauthorised disclosure, we may require appropriate proof of identity.

17. RIGHT TO LODGE A COMPLAINT

Data subjects may lodge a complaint with the competent data protection supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria

Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

18. CHANGES TO THIS PRIVACY POLICY

We update this Privacy Policy where functions, processing activities, legal bases or legal requirements change.

If Mobspawner intends to use Google, YouTube or Twitch data for a materially new purpose, this Privacy Policy and, where appropriate, the user interface will be updated before the new processing begins. Where required, new consent, acknowledgement of this Privacy Policy or OAuth authorisation will be obtained in advance.

The current version is available at:

https://mobspawner.pos-it.at/privacy

19. LANGUAGE VERSIONS

This Privacy Policy is provided in German and English. Both versions are intended to convey the same content. In the event of linguistic ambiguity or inconsistency, data subjects may contact office@pos-it.at at any time. The provision of a translation does not restrict any statutory rights of data subjects.