Privacy and Evidence Policy
1. Who is responsible
StreamClash, a Wyoming corporation managed from Florida, operates StreamClash Finance and determines how StreamClash Finance customer information is used. Business mailing address: 680 S Cache St, STE 100-8790, Jackson, WY 83001. Privacy contact: [email protected]; identify your message as a privacy request.
This notice concerns the finance portal and its finance-specific game integration. It is not a substitute for the separate privacy information applicable to all gameplay or the independent practices of Discord, payment providers, and game-platform operators.
2. Information we process
Identity and contact
Discord user ID and username snapshots; verified email; legal name, residence, and billing information where collected for the transaction or legal requirements; age/capacity affirmation; relevant guild membership; and support correspondence. We do not request government identity documents or a full date of birth in the ordinary MVP flow. Additional collection requires a defined purpose and notice.
Character and vehicle linkage
Stable player references, license/license2 identifiers needed to resolve character ownership, selected character identifier/display name, target server, permanent vehicle UUID, vehicle model, and current or historic plate information needed for operations and claims. These identifiers are personal data when linked to a person even if they are not the person's civil name.
Contract and payment records
Offer and agreement references; signed documents; consent text/version and actual choices; signature and audit timestamps; schedules and adjustments; payment amounts and statuses; provider transaction identifiers; masked payment details; permitted authentication outcomes; refunds, disputes, defaults, and eligibility decisions. StreamClash Finance must not store complete card numbers or card security codes. Payment providers process payment details directly.
Technical and delivery records
Relevant IP address and browser/device metadata from authentication and signing, session/security events, document hashes, delivery/grant verification, webhook events, email status and bounce information, attempted Discord notification results, and operational error data. Error reports should be scrubbed of secrets and unnecessary personal information.
Vehicle-use evidence
When instrumented and applicable, finance records can include garage withdrawal/return, driver entry/exit, session start/end and derived duration, customization categories, repairs, storage interactions including relevant container/item/quantity/direction, and blocked finance-related transfers or retrievals. The published notice must identify the actual enabled event categories; it must not imply that missing events were recorded.
Finance telemetry is not intended to include unrelated chat content, voice recordings, continuous location trails, or unrestricted surveillance of other gameplay. We do not read a customer's Discord DMs beyond interactions actually sent to our finance service or staff.
3. Where information comes from
Information comes from you, Discord authentication and permitted membership checks, the relevant server's identity and character data, server-side finance integration, payment and signing providers, notification providers, and staff support/administrative actions. We do not treat unverified client-provided telemetry as authoritative delivery proof.
4. Purposes and applicable legal bases
We use necessary information to prepare requested offers, authenticate users, resolve the selected character, administer contracts and payments, deliver and restrict vehicles under applicable terms, communicate with customers, investigate mistakes or disputes, secure the service, and keep legally required records.
Where a law requires identification of a lawful basis, contract preparation/performance may support processing genuinely necessary for the purchase; legal obligation may support required records; legitimate interests may support proportionate security, fraud prevention, and claim defense after the required balancing assessment. Consent is used where required for optional processing, rather than labeling every operation consent-based.
StreamClash must document the actual basis and necessity for each category. Signing the agreement or acknowledging this notice does not waive privacy rights or authorize unrelated data collection. Optional marketing or nonessential tracking requires a separate choice where applicable.
5. Automated restrictions and human review
The intended service applies defined rules to payment failures, disputes, one-agreement eligibility, and vehicle restrictions. For example, a formal dispute pauses billing and normally suspends access and creates a future-financing bar, subject to applicable law. There is no MVP repayment-history tiering or internal credit score. Payment providers may apply their own security assessments.
You can ask support for human review of inaccurate identity linkage, payment status, or a consequential eligibility/enforcement decision. Review must be meaningful and performed by someone authorized to correct errors. Where local law restricts solely automated decisions with legal or similarly significant effects, we must implement the required safeguards or avoid that automated decision in that location. This notice is not a blanket waiver of those safeguards.
A senior administrator can forgive future-financing ineligibility. The original history is retained for a documented lawful period, not erased or hidden by that override. The business desire for durable audit records does not justify indefinite retention of all personal data.
6. Evidence, hashes, and AI-assisted summaries
We preserve relevant contract, payment, delivery, usage, notification, and administrative records to evaluate claims. Hashes and timestamp records can help detect changes; they do not conclusively prove a person's identity or that a disputed event was authorized. A grant record is not represented as proof of actual gameplay.
We may use automated tools to organize evidence. If an AI service receives personal data, it must be approved, restricted to necessary information, covered by appropriate arrangements, and reflected in our inventory and disclosures. No named external AI provider is represented as approved by this policy. Staff review evidence before submitting substantive claims; generated text must not fabricate facts or conceal uncertainty.
Correction requests are linked to original records and considered in decisions and submissions. An append-only audit design does not permit knowingly repeating an inaccurate allegation.
7. Recipients
Access is limited to authorized personnel and providers needed for the service. Intended provider categories include payment processing (Stripe where used), identity and finance messaging (Discord), email delivery (Twilio SendGrid), hosted database services (Prisma), private storage/network services (Cloudflare), application error reporting (Sentry), and our self-hosted application/signing infrastructure.
Using self-hosted Documenso does not by itself mean the Documenso company receives your documents. Actual external access and processor roles depend on deployment and contracts, not branding alone. A public timestamp authority should receive only the signing/hash material required by the configured protocol; do not assume that a hash is automatically anonymous.
Relevant evidence may be shared with payment processors, issuers, dispute reviewers, authorized advisers, courts, regulators, or authorities when legally justified. We do not publish dispute dossiers or customer identifiers to public Discord channels as punishment.
This policy prohibits sale of personal information and sharing for cross-context behavioral advertising. Business-transfer disclosures must preserve applicable rights and required notices.
8. International processing
StreamClash is managed in the United States, and providers may process data in the United States and other countries. A customer's location may require contractual safeguards, transfer assessments, representative appointments, or other measures.
We do not claim that accepting this policy universally authorizes restricted international transfers or that every named provider participates in an applicable adequacy framework. Before offering affected transactions, StreamClash must identify and implement a valid mechanism for the actual transfer and provide required information.
9. Retention and deletion
We keep information for the time necessary for the stated purposes, legal obligations, and proportionate claim defense, then delete or appropriately de-identify it. A legal hold may temporarily preserve specifically relevant records. It is reviewed and released when no longer justified.
The planned retention period for core signed agreements, payment ledgers, and material audit/dispute records is the agreement life plus up to seven years after closure, subject to a documented legal and necessity assessment. That is not a seven-year mandate for every raw telemetry event, IP log, or backup. Each category requires an approved period or sufficiently specific retention criterion.
Raw operational logs, detailed gameplay events, abandoned offers, and unsuccessful sign-in data require separately minimized periods. A retained summary does not automatically justify indefinite raw-event retention.
Backups and retained document versions may not support immediate selective deletion. They must expire on a defined schedule, remain access-restricted, and not reintroduce deleted operational data after restoration without applying deletion records. Retention locks must match justified periods, not create permanent unnecessary storage.
10. Cookies and similar technology
The portal uses necessary session/security technology for sign-in and request protection. Additional measurement, replay, advertising, or nonessential device access must not be enabled by this notice alone. Where consent is required, decline must be available before the optional technology operates and withdrawal must be supported.
StreamClash must inventory actual cookies, names/providers, purposes, and durations before publishing a cookie table. No claim that the service is cookie-free is made.
11. Your requests and rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, obtain a portable copy, withdraw optional consent, receive information about consequential automated decisions, and complain to a relevant supervisory authority. Not every right applies identically in every location.
Contact [email protected]. We verify identity proportionately and do not require unnecessary sensitive documents by default. An authorized-agent request is evaluated under applicable rules. We respond within applicable deadlines, explain any lawful limitation or extension, and provide available review/appeal information.
Requests do not automatically erase a valid balance or legally necessary claim records. Conversely, an outstanding balance does not justify refusing every privacy right. We do not charge or retaliate merely because you exercise a protected right.
12. Security and incidents
The intended safeguards include role-limited access, isolated credentials, private storage, authenticated integrations, and audit records. No system is guaranteed completely secure. We investigate incidents and provide required notifications under applicable law. Do not include payment credentials or unnecessary sensitive data in a support report.
13. Children and changes
The financing service is not intended for minors or people lacking capacity to contract. If we learn that a minor's data was collected contrary to applicable requirements, we restrict processing and address deletion or other obligations. An age checkbox is not described as verified identity.
We give appropriate notice of material changes. Changes do not retroactively expand the purposes for existing personal data without a valid basis and any required further notice or consent.