Privacy Policy
Last updated: 29 October 2026
Contents
- Who we are
- Our role
- What we collect
- Why we use it and our legal bases
- Guests, broadcasts and audience chat
- Connected platforms and Google API data
- Creator tools and AI
- Cookies, analytics, advertising and referrals
- Emails
- Who receives your data
- International transfers
- How long we keep data
- Security
- Your rights
- Information for residents of specific countries
- Children
- Changes to this policy
Who we are
Upstream is operated by Zukunft d.o.o., Grožnjanska ulica 32, 10000 Zagreb, Croatia (OIB 62560895839). We are the controller of the personal data described in this policy. Our full company details are in the legal notice.
This policy covers upstream.so, the Upstream app at studio.upstream.so, our free creator tools and our support, including when you connect a platform account or join a studio as a guest.
For any privacy question or request, email contact@upstream.so.
This policy explains what we do. Reading it, or using Upstream, is not consent to optional marketing or tracking. Where we need your consent, we ask for it separately.
Our role
We decide how personal data is used to run accounts, billing, security, support, our websites and our marketing. For these activities we are the controller.
When we store, process or broadcast content that you upload or create (for example videos, recordings and studio sessions), we do so to provide the service you asked for. If you are a business and you need a data processing agreement for personal data in your content, email us. You are responsible for your own use of your content, including telling people who appear in it and getting any permissions you need.
Platforms you connect, such as YouTube or Twitch, also use data for their own purposes under their own privacy policies.
What we collect
Account details. Your name, email address, password (stored only in hashed form) and account settings. If you sign up or sign in with Google, we receive your name, email address and profile picture from Google.
Billing details. Your plan, subscription status, payments and invoices, billing name and address, VAT number if you give one, and Stripe customer references. Stripe processes your card. We do not receive your full card number or security code. We may see limited card details, such as the brand, last four digits and expiry date.
Your content and streams. Files you upload or import, recordings, thumbnails, file names and media information, stream settings, schedules, destinations, and the stream keys and connection details needed to deliver your broadcasts. Your content may include people's images, voices and messages.
Connected accounts. When you connect a platform, we receive what you authorise, such as your account or channel ID and name, profile picture, access tokens, broadcast details, stream keys, viewer numbers and live chat messages. When you import from Google Drive, we receive the files you select.
Guests and audiences. When someone joins a studio, we process their display name, a participant ID, connection details and the audio, video, screen and messages they share. When a creator uses audience chat, we receive viewers' platform usernames, profile pictures, messages and badges from the platform.
Support. Messages, attachments and contact details you send us, plus the account information we need to help you.
Technical and security data. IP address, browser and device information, login records, activity and error logs, and approximate location based on your IP address. We also use IP reputation services to spot VPNs, proxies and abuse.
Analytics, advertising and referral data. Pages you visit, where you came from, campaign and ad click identifiers, browser identifiers, and events such as signing up, creating or starting a stream and buying a plan. If you arrive through an affiliate link, we record which affiliate referred you. How this works depends on your cookie choices, explained in Cookies.
Free tool inputs. What you enter or upload in our free tools, such as prompts, video links, titles, descriptions and images. Some tools work entirely in your browser; others send what you entered to us or a named provider to produce the result.
Please do not include sensitive information, such as health data, in content or messages unless you need to.
Why we use it and our legal bases
Where the EU or UK GDPR applies, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, providing streaming, storage, studio, imports, tools and support, and managing your subscription | Performance of our contract with you. If you use Upstream for a business, our legitimate interest in providing that business's service. |
| Taking payments, issuing invoices and keeping accounting and tax records | Performance of the contract and legal obligations under Croatian accounting, tax and fiscalisation law. |
| Keeping Upstream secure, preventing fraud and abuse (including duplicate free accounts), fixing problems and keeping logs | Our legitimate interests in running a secure and reliable service and protecting our users and our business. |
| Service messages about your account, security, billing and important changes | Performance of the contract, legal obligations and our legitimate interests. |
| Product news and offers by email | For account holders, the rule that allows us to email our existing customers about our own similar services, and our legitimate interest in promoting them. You can opt out at any time. For anyone else, your consent. |
| Analytics cookies and similar technologies | Your consent in the EEA, UK and Switzerland. Elsewhere, our legitimate interest in understanding and improving our websites and app; you can switch analytics off in cookie settings. |
| Advertising measurement, including sending Google and Meta information about sign-ups, streams and purchases, and affiliate attribution | Your consent in the EEA, UK and Switzerland. Elsewhere, our legitimate interest in measuring our advertising; you can switch advertising off in cookie settings. |
| Handling privacy requests, legal requests and complaints, and defending legal claims | Legal obligations and our legitimate interest in establishing, exercising or defending legal claims. |
If you do not give us the information needed to create an account, provide a feature you asked for, process a payment or meet a legal requirement, we may not be able to provide that part of the service. Your choices about marketing and advertising never affect access to your account.
You can withdraw consent at any time in cookie settings or by emailing us. This does not affect what we did before. You can also object to processing based on our legitimate interests, as explained in Your rights.
Guests, broadcasts and audience chat
The studio host decides who joins, what goes on air, where it is broadcast and whether it is recorded. A guest's name, voice, camera image, shared screen and messages can be seen or heard by other participants and, when the host puts them on air, by viewers on the destination platforms. A broadcast may be public and may be kept by the host or the platform.
We process this information to run the studio, broadcasts and recordings, and keep technical connection records to keep them working and secure.
If you have a concern about a creator's recording or broadcast of you, contact the creator, and contact us too if you want. We handle the processing we are responsible for and help our customers with requests about their content. Deleting a copy from Upstream does not remove copies already broadcast, downloaded or stored elsewhere.
Connected platforms and Google API data
You choose which accounts and destinations to connect. We use what you authorise only to provide the features you use, such as creating and managing broadcasts, sending your stream, importing files, showing viewer numbers and managing chat. You can disconnect a platform in Studio at any time or revoke our access in that platform's settings.
YouTube API Services
Upstream uses YouTube API Services. When you connect YouTube, we receive your channel ID and name, profile picture, access tokens, details of the broadcasts we create or manage for you, viewer numbers and live chat messages. We use them only to provide Upstream's YouTube features. By connecting YouTube you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.
Upstream's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google API data for advertising, do not sell it, and do not use it to train AI models. Our people only access it when you ask us to, for security reasons, to comply with the law, or when it is part of aggregated and anonymised data for running the service.
Information we receive from YouTube
- channel ID, channel name and profile picture;
- authorisation tokens for the permissions you grant;
- broadcast titles, descriptions, thumbnails, privacy settings and stream details for broadcasts created or managed through Upstream;
- live viewer numbers and live chat messages for your broadcasts.
Deletion and revoking access
You can revoke Upstream's access to your Google account at any time at Google's security settings. You can disconnect YouTube in Studio, delete your Upstream account in your profile settings, or ask us to delete your data at contact@upstream.so. When you disconnect YouTube in Studio, delete your account or ask us to delete your data, we delete the YouTube API data we hold about you within 7 days, except where we must keep something by law. This does not delete anything in your own YouTube account.
Other platforms
Twitch, Kick, Mixcloud and other connections work the same way: we receive the profile information, permissions and stream credentials needed for the features you use. When you add a destination manually with a stream key or URL, we only receive what you enter. Connecting a platform does not give us access to the rest of your account there.
Creator tools and AI
Some free tools process your images or videos entirely in your browser. Others send what you entered to our servers or a provider to produce the result.
Some tools use Google Gemini to generate or review text and images. Depending on the tool, Google receives your prompt or topic, video titles, descriptions or public video information, or a reduced copy of an image you ask us to review. Google processes these under its Gemini API terms. AI features are labelled as AI, and their output can be wrong, so check it before you use it.
To prevent abuse, our tools keep short-lived technical records, such as IP-based rate limits.
Cookies, analytics, advertising and referrals
We use cookies and similar technologies, such as local storage, to keep you signed in and secure, remember your settings and choices, measure how our websites and app are used, measure our advertising and attribute affiliate referrals.
Your choices. In the EEA, the UK and Switzerland, we ask before we use analytics and advertising cookies, and Google Analytics, Google Ads, Meta and Ahrefs only run after you accept them. Elsewhere they are on by default. Wherever you are, you can accept, reject or change your choice at any time with Privacy & cookie settings in the footer of our website and in Studio. We remember your choice for 180 days. Necessary cookies cannot be switched off because the service does not work without them.
| Type | Examples | Provider | Purpose | How long |
|---|---|---|---|---|
| Necessary | upstream_session, XSRF-TOKEN, device_fingerprint | Upstream | Keep you signed in, protect forms against forgery, recognise trusted browsers for security | Session to 365 days |
| Necessary | upstream_cookie_consent | Upstream | Remember your cookie choices | 180 days |
| Preferences | Local storage for theme, layout, filters, studio devices, dismissed notices and drafts | Upstream | Remember your settings and work in progress | Until you change or clear them |
| Support chat | crisp-client/* | Crisp | Keep your support conversation | Up to 6 months |
| Analytics | upstream_journey_id, upstream_first_touch_v2 | Upstream | Link a first visit to a later sign-up | Up to 90 days |
| Analytics | upstream_exp_id | Upstream | Show you a consistent version of a page during an experiment | Until you clear it |
| Analytics | _ga, _ga_* | Google Analytics | Measure visits and use | Up to 2 years |
| Analytics | No cookies | Ahrefs Web Analytics | Count visits and page views on upstream.so | Not stored on your device |
| Advertising | _gcl_au, _gcl_* | Google Ads | Measure ad clicks and conversions | Up to 90 days |
| Advertising | _fbp | Meta | Measure Meta ads | Up to 90 days |
| Advertising | upstream_paid_click_* | Upstream | Remember an ad click until sign-up | Up to 90 days |
| Affiliate referrals | Tolt referral cookie | Tolt | Credit the affiliate who referred you | Up to 60 days |
Advertising measurement. When you sign up, create or start a stream or buy a plan, we may tell Google Ads and Meta that this happened, together with the ad click identifier and a hashed (scrambled) version of your email address, so they can match it to an ad. A hashed email is still personal data. We do this according to your advertising choice, and we stop if you reject or withdraw it. Google explains how it uses this data at business.safety.google/privacy.
Affiliate referrals. If you arrive through an affiliate link, Tolt records the referral and, when you sign up, receives your email address so the affiliate can be credited.
Google Fonts. Studio loads fonts from Google, which receives your IP address.
Do Not Track and Global Privacy Control. We do not respond to the legacy Do Not Track browser signal. If your browser sends a Global Privacy Control signal, our servers do not send your hashed email or ad click data to Google Ads. To switch off advertising cookies too, use cookie settings.
Emails
We send service emails about your account, security, billing and important changes. You cannot unsubscribe from these while you have an account, because we need them to provide the service.
If you have an account, we may also email you product news and offers about Upstream. You can unsubscribe at any time with the link in every marketing email or by emailing us, and we keep a minimal record so we respect your choice. Our email provider tells us whether emails were delivered, opened and which links were clicked, so we can measure and improve them. You can block this by turning off images in your email app.
Who receives your data
We share personal data only as needed for the purposes in this policy:
- Hosting and infrastructure: Upstream runs on our own dedicated servers. Cloudflare provides content delivery, security and file storage.
- Payments and invoicing: Stripe (payments) and our Croatian invoicing and accounting providers.
- Email: Mailgun (sending and delivery).
- Support: Crisp (support chat).
- Error monitoring: Sentry.
- Analytics and advertising: Google (Analytics, Ads and Tag Manager), Meta and Ahrefs, as described in Cookies.
- Affiliate program: Tolt.
- Sign-in, platforms and integrations: Google (Sign in with Google, YouTube, Google Drive), and the platforms you connect, such as Twitch, Kick and Mixcloud.
- AI and media features: Google Gemini for AI tools, and KLIPY for GIF search in Studio.
- Security: IP reputation and geolocation services that help us detect abuse.
- People you share with: your team members, studio hosts and guests, and viewers on the platforms you stream to.
- Authorities and advisers: courts, authorities, lawyers and accountants, where the law requires it or to protect our rights.
- Business transfers: a buyer or successor if Upstream is sold or merged, with appropriate safeguards and notice.
Service providers that process data for us may only use it on our instructions and must keep it secure. Some recipients, such as Google, Meta, Stripe and the platforms you connect, also use data for their own purposes under their own terms.
We do not sell your personal data.
International transfers
Our main servers are in the EU. To make uploads faster, we also run upload servers in North America and Asia, so files you upload from those regions may first be received there. Some providers, such as Google, Meta, Stripe, Cloudflare, Crisp, Tolt, Mailgun and Sentry, may process data in the United States or other countries outside the EEA. When data leaves the EEA or the UK, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses (with the UK addendum where needed). You can ask us for more information or a copy of the safeguards.
How long we keep data
We keep personal data only as long as we need it for the purposes above, then delete or anonymise it.
| Data | How long |
|---|---|
| Account details | While your account is open. When you delete your account, we close it immediately and delete or anonymise your personal data within 30 days, except what we must keep by law or need for a legal claim. We keep a hashed (scrambled) copy of your email address so the free plan cannot be restarted by signing up again. |
| Invoices and accounting records | 11 years, as Croatian accounting law requires. |
| Uploaded files and recordings | While your account is active and your plan includes the storage. Files may be deleted after a paid plan ends, on inactive free accounts, or when you delete them or your account. |
| YouTube and other connected-platform data | While the connection is active. Deleted within 7 days after you disconnect, delete your account or ask us. |
| Login and activity logs | About 90 days. Stream activity records up to 180 days. |
| Copies of emails we send | 90 days. Delivery records may be kept longer to handle bounces and complaints. |
| Audience chat in Studio | About 1 hour, unless it is part of a recording. |
| Support conversations | As long as needed to handle your request and any follow-up. |
| Unsubscribe and opt-out records | As long as needed to respect your choice. |
| Cookie and browser data | As shown in Cookies. |
Security
We protect personal data with technical and organisational measures, including access controls, encrypted connections and restricted staff access. No service is completely secure. Keep your password and stream keys private, and tell us at once if you think your account has been misused. If a data breach affects you, we will inform you and the authorities as the law requires.
Your rights
Because we are established in the EU, the GDPR applies to our processing of your data wherever you live. You have the right to:
- access your personal data and get a copy;
- correct inaccurate or incomplete data;
- have your data deleted, where the legal conditions are met;
- restrict how we use your data in certain cases;
- receive the data you gave us in a portable format, or have it sent to another provider;
- object to processing based on our legitimate interests, on grounds relating to your situation;
- object at any time to direct marketing, after which we stop;
- withdraw consent at any time;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects, except where the law allows it.
We use automated checks, such as IP reputation and account signals, to prevent abuse of free plans. These can limit free streaming. If you think a restriction is wrong, email us and a person will review it.
To use your rights, email contact@upstream.so or use the controls in Studio. We may ask for information to confirm it is you. We reply within one month, which we may extend by two more months for complex requests, in which case we tell you why. Requests are free unless they are clearly unfounded or excessive.
You can complain to the Croatian data protection authority, the Agencija za zaštitu osobnih podataka (azop.hr), or to the authority where you live or work. In the UK you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to help first, but you do not have to contact us before complaining.
Information for residents of specific countries
United States. Some US state privacy laws give residents extra rights, such as to know, access, correct, delete and port personal data, and to opt out of targeted advertising, "sale" or "sharing". We do not sell personal data for money. Our advertising measurement may count as "sharing" or "targeted advertising" under some state laws. You can opt out with Privacy & cookie settings, and you can use your other rights by emailing us. If we refuse a request, you can appeal by replying to our answer. We will not treat you differently for using your rights. The categories of data we collect, their sources, purposes and recipients are described above.
United Kingdom. UK data protection law gives you the same rights as described above. You can complain to us first, and we acknowledge complaints within 30 days.
Canada and Quebec. The person in charge of protecting personal information is the director of Zukunft d.o.o., who can be reached at contact@upstream.so.
Other countries. If the law where you live gives you additional rights, email us and we will help.
Children
Upstream accounts are only for people aged 18 and over, and our services are not directed at children. If you believe a child has given us personal data, email us and we will delete it where the law requires. Creators are responsible for the rights of any children who appear in their content or join their broadcasts.
Changes to this policy
We update this policy when our practices or the law change, and show the date of the latest update at the top. If a change is significant, we tell you by email or in Studio before it takes effect, and we ask for your consent where the law requires it.
Earlier policies used the effective date 13 February 2023 and were last updated on 23 May 2024.
