Privacy Policy

surstreaming (“we”, “us”, or “our”) respects your privacy. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and other applicable laws.

Data controller: Sahin Salincakli, SAHIN.TECH, Grünauer Street 78, 12557 Berlin, Germany (also in the Impressum).

Account data (via TikTok OAuth):

• TikTok Open ID (a pseudonymous identifier)
• Display name, username, and avatar URL

Billing data (via Stripe):

• Stripe customer ID and subscription ID
• We do not store card numbers or full billing addresses — these are held by Stripe, our payment processor.

Usage data:

• Stream session metadata (start/end times, TTS event counts)
• Server logs (IP address, timestamps) retained for up to 30 days

Voice API keys (only if you add one):

• If you connect your own Fish Audio API key, it is stored only in your browser’s local storage. When you use the Fish Audio engine, the text to be synthesized and your key are transmitted through our synthesis endpoint to Fish Audio; the key is used solely to authenticate and bill your request and is not stored on our servers. We do not persist the key and apply technical measures to prevent it from being written to access, application, error, or analytics logs.

To provide the Service, we connect to your active TikTok LIVE stream and process incoming live events — chat comments, gifts, likes and follows, including the sending viewer’s display name — in real time so they can be converted to speech and played back to you. We process this data on your behalf, as the streamer, solely to deliver the read-aloud feature you requested.

Local engines (Supertonic): When TTS runs in your browser or on our servers, event content is processed transiently: it is converted to audio, played once, and discarded. We do not record, store, publish, or redistribute TikTok video, audio, or chat content, and we do not build profiles of viewers.

Cloud engine (Fish Audio): When you select the Fish Audio engine, the text to be spoken is transmitted to Fish Audio (Hanabi AI Inc., United States) so it can be synthesized to speech. Fish Audio processes this content under its own Privacy Policy and Terms of Use, which may permit Fish Audio to retain and use submitted content and usage data to develop, train, or improve its AI models. If you use your own Fish Audio API key, the content is processed and billed by your own Fish Audio account. We do not store this content on our servers, but we cannot control how Fish Audio handles the data it receives.

• Service delivery: Authenticating your session, enabling TTS features, and managing your subscription.
• Billing: Processing payments via Stripe and enforcing plan entitlements.
• Support: Responding to your enquiries.
• Security: Detecting and preventing abuse.

We do not sell your personal data to third parties, and we do not use it for advertising.

• Contract performance (Art. 6(1)(b)): Account management, delivering the TTS feature, and subscription billing.
• Legitimate interests (Art. 6(1)(f)): Service security and fraud prevention.
• Legal obligation (Art. 6(1)(c)): Tax and financial record-keeping; we retain billing records as the seller, while card data is held by Stripe.

We share data only with the following processors, under data processing agreements:

• Stripe: Payment processing. See Stripe’s Privacy Policy.
• TikTok: OAuth authentication only. We receive only the data TikTok provides through the OAuth scope.
• Eulerstream: A third-party connection/signing provider used to establish the TikTok LIVE connection so we can receive live events.
• Fish Audio (Hanabi AI Inc., United States): Cloud text-to-speech synthesis when you select the Fish Audio engine, including when you connect your own Fish Audio API key (in which case content is processed and billed by your own Fish Audio account). See Fish Audio’s Privacy Policy.
• UpCloud (UpCloud Ltd, Finland): Hosting of our backend, database and self-hosted analytics server in a data center in Frankfurt, Germany.
• Vercel (Vercel Inc., United States): Hosting and delivery of this website. Vercel processes your IP address and standard request data to serve the pages.
• Hugging Face (Hugging Face, Inc., United States): When you use the in-browser voice engine in the dashboard, your browser downloads the voice model files directly from Hugging Face’s content delivery network. Hugging Face thereby receives your IP address and standard request data. No chat text or speech is sent to Hugging Face; the speech is generated on your device.

We do not sell or rent personal data to anyone.

Some of our processors (for example Stripe, Vercel and Hugging Face) may process data outside the European Economic Area, in particular in the United States. Where that happens, the transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

When you use the Fish Audio cloud TTS engine, the text content you submit is transferred to Fish Audio (Hanabi AI Inc.) in the United States and is handled under Fish Audio’s own terms and privacy policy, which you accept when you use that engine or connect your own Fish Audio API key.

• Account data is retained while your account is active and for 30 days after deletion.
• Subscription and invoice records are retained as required by tax law (up to 10 years under German law).
• TikTok LIVE event content is not retained by us — local engines process it transiently and discard it.
• Cloud TTS content (Fish Audio engine): text submitted for synthesis is processed and retained by Fish Audio under its own Privacy Policy and Terms of Use; we do not retain this content on our servers.
• Server logs are purged after 30 days.
• Analytics (only with your consent): events such as page views are deleted after 90 days. The IP address used to derive their approximate location is deleted at the latest together with those events. Your pseudonymous visitor ID is deleted after 14 months without a visit.

Under GDPR (and similar laws), you have the right to:

• Access a copy of the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability.

To exercise any of these rights, email surstreaming-support@sahin.tech. We will respond within 30 days. You also have the right to lodge a complaint with a data protection supervisory authority — in our case the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

We use only strictly necessary and analytics cookies. Analytics are optional: a consent banner asks before any analytics cookie or tracking starts, and disabling cookies stops all analytics tracking and removes the analytics cookies already set. You can change or withdraw your choice at any time with the “Cookie settings” link in the footer of every page; the withdrawal does not affect the lawfulness of processing before it.

• access_token: An HTTP-only authentication cookie that keeps you signed in (JWT session).
• tt_user: A functional cookie holding your TikTok display name, Open ID, and handle to populate the interface.
• tt_prompt: A short-lived, single-use HTTP-only cookie set when you log out, so the next login shows the TikTok consent screen again.
• temps_visitor_id / temps_session_id: Written to local storage only after you accept analytics. They hold random, unguessable session and visitor identifiers used to measure how the Service is used (pages viewed, chat events). The visitor id persists until you disable analytics; the session id rolls over after 30 minutes of inactivity. You consent to these via the banner and can disable them at any time under “Cookie settings”. With analytics enabled, your browser sends these events directly to our self-hosted analytics server (UpCloud, Frankfurt), which records your IP address and browser details and derives an approximate location (country, city) from the IP. Legal basis: your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG).
• tempsConsent: A local record of your banner choice so we don’t ask again. Strictly necessary to honor your decision; no analytics start if you declined.

If you decline analytics, we keep only an anonymous counter (no identifier, no browser or usage details) of the decline itself, so we can measure our consent rate. No analytics cookies are set or read in that case.

Stripe Checkout may set Stripe-managed cookies during payment; see Stripe’s privacy policy for details.

We use industry-standard measures including HTTPS, encrypted database storage, and access-controlled infrastructure. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

The Service is not directed at children under 13, and you must be at least 13 (the minimum age required by TikTok) to use it. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy periodically. The revised version will be posted here with an updated effective date. For material changes, we will notify you by email or in-app notice.

For privacy enquiries or to exercise your rights, contact: surstreaming-support@sahin.tech

SAHIN.TECH, Berlin, Germany