The German version of this privacy policy is binding; this English version is provided for convenience.

Privacy Policy

for the StreamMeet website, the customer center and the host area

In accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR), this privacy policy explains which personal data we, as the operator of StreamMeet, process, for what purposes, on what legal basis and for how long, and what rights you have.

1. Controller and contact

The controller is:

Webvines
Hofgartenstraße 28a
86551 Aichach
Deutschland
Represented by: Christian Schmid (Inhaber)

• Email: support@streammeet.de
• Telephone: +49 8251 9048076
• Data protection contact: support@streammeet.de

2. What this policy covers and what it does not

StreamMeet is a video platform for online meetings of businesses and private individuals. We distinguish:

• Data for which we ourselves are responsible (Art. 4(7) GDPR): data when you visit this website and its legal texts, data of our customers and their contact persons in the customer center, i.e. account, order, contract, payment, connection of the booking system and communication with us, and the host accounts (sections 5a and 5c). This policy applies to this data.
• Data of participants in online meetings of business customers: we process this data only on behalf of the business that offers the meeting (processing on behalf under Art. 28 GDPR). That business is the controller; it informs you in its own privacy policy. Details are set out in section 12.
• Meetings of business customers: if a business customer plans meetings in the customer center or its hosts create meetings, we process the data of these meetings on its behalf; the business customer is the controller (section 5b). The host accounts themselves are excluded from this: we are responsible for them (section 5a).
• Data of participants of private customers: if a private individual invites people to a private meeting, their own use falls under the exemption for purely personal or household activity (Art. 2(2)(c) GDPR, recital 18). We then process the data of those participants as a controller, solely in order to run the meetings technically; details are set out in section 12.

3. Visiting the website

Which data. When you visit this website, our server necessarily processes your IP address, the date and time, the address requested, the request method, status code, amount of data transferred and duration of the request, as well as information sent by your browser (e.g. browser identifier, preferred language, referring page). In the server logs we store the IP address only in shortened form (IPv4 to the first three blocks, IPv6 to the first 48 bits); cookies and credentials are not logged. The application's error logs contain no names, no email addresses and no credentials.

Purpose and legal basis. Delivering the website, security and stability of operation, detecting and averting attacks and errors. The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). To protect against misuse we count requests per IP address; for this we store only a hash value for a few minutes.

How long. Server and error logs: 7 days.

The website, the customer center, the host area and the lobby and meeting do not load any content from third-party servers (no external fonts, scripts or content delivery networks) and do not use any analytics, tracking or advertising services. The only exception are the pages of the Outlook add-in (section 5c).

Desktop app and updates. You download the desktop app for macOS from our download page; this page does not set any cookies. The installed app asks our server about one minute after it starts and then every four hours whether there is a new version, but not while you are in a meeting. It downloads a new version and only installs it when you confirm this or quit the app. The app does not send any account, any device or user identifier or any information about your use. Our server only processes what every request brings with it: your IP address, the date and time, the file requested (which shows the update channel and, when an update is downloaded, its version) and the identifier of the update program. We log these requests like any other request (IP address shortened, 7 days). The purpose is to provide you with security and bug fixes; the legal basis is our legitimate interest in a secure and up-to-date app (Art. 6(1)(f) GDPR).

On Macs with Apple silicon, when you open an appointment, as a rule at most every six hours, the app downloads the model for the background effect from our server and stores it on your device. In doing so, it sends the access authorization for the meeting and a random number generated anew for each request, which we do not store. No account, no permanent device or user identifier. The request is logged like any other request (IP address shortened, 7 days). Picture and sound do not leave your device in this process. The legal basis is our legitimate interest in a working and up-to-date effect (Art. 6(1)(f) GDPR).

4. Cookies and browser storage

We only set cookies that are technically necessary to provide the functions you request (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); no consent is required for this:

The start page, the download page of the desktop app and the legal texts (privacy policy, legal notice, terms, withdrawal instructions) do not set any cookies. The cancellation page (“Cancel contracts here”) and the page “Join without a link” set a technically necessary session cookie and the XSRF-TOKEN, because their forms have to be protected against forged requests; both expire when the browser is closed or after 120 minutes. We do not use tracking cookies, third-party cookies or fingerprinting.

Browser storage. The lobby, the meeting and the host area only store settings that you choose yourself in the browser (localStorage), without names or other details about you: language, light or dark design, keyboard shortcuts, video quality, view of the stage, microphone and speaker settings, background effect and mirroring of your own view, size of the laser pointer, expanded settings and the tab chosen last, the quick mute buttons for hosts, whether invitation links should open in the desktop app or in the browser, and technical markers (e.g. that your device's video encoding was switched back). Your own background image is only kept in your browser (IndexedDB). If a host enters email addresses of guests, they are only kept in that browser window (sessionStorage) until they are sent; the window forgets an address as soon as it has been sent, and the rest is gone when the host closes the window or chooses “Forget addresses”. Addresses only reach us with “Send invitation”, and only for that sending (section 5b). Nothing else in this paragraph is transmitted to us.

5. Customer account

Which data. For an account in the customer center we process your name, email address, password (only as a hash value), language, the time your email address was confirmed and of the last login and, if you set it up, the data for two-factor authentication (secret and recovery codes, encrypted). In the session we store the IP address only in shortened form and the browser identifier. We count failed login attempts per email address and IP address as a hash value to limit attacks; we recognise a known device by the device cookie (section 4). If we invite an existing customer to the customer center, we process the email address of the invited person and the language for this purpose.

Purpose and legal basis. Providing the customer center, preparing and performing the contract (Art. 6(1)(b) GDPR). If you act for a business, the legal basis is our legitimate interest in working with the contact persons of our customers (Art. 6(1)(f) GDPR). If you order as a private individual, you are our contracting party yourself; the legal basis is then Art. 6(1)(b) GDPR throughout. We base the security of the accounts on Art. 6(1)(f) and Art. 32 GDPR.

How long. We delete unconfirmed registrations after 14 days, accounts without an order, acceptance or invitation 365 days after the last login, login data 90 days after the end of the contract, password reset links after 60 minutes and invitations 30 days after they expire or are accepted.

5a. Host accounts

A customer can create host accounts in the customer center for persons who create and run meetings for it. Hosts log in to the host area, in the desktop app or via the Outlook add-in, never to the customer center.

Who is responsible. We ourselves are responsible for the host accounts (Art. 4(7) GDPR), even if a customer (for example your employer or principal) creates the account for you: login, invitation, activation code, logged-in devices and sessions, the access of the Outlook add-in (section 5c) and the emails to you including the calendar entry. The customer decides who gets an account; it creates, blocks and removes accounts. The meetings that you create as a host for a business customer, on the other hand, we process on its behalf (section 5b). Please address requests about your account to us (section 1).

Purpose and legal basis. Providing the host accounts that a customer has ordered from us. If you are our customer yourself (for example as a private customer or as the owner of a customer account who creates a host account for themselves), the legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR). If a customer creates the account for you, the legal basis is our legitimate interest in providing the service ordered by the customer to its hosts (Art. 6(1)(f) GDPR). We base the security of the accounts on Art. 6(1)(f) and Art. 32 GDPR. We do not use the data for any other purpose, in particular not for advertising.

Which data. First and last name, email address and language entered by the customer; password only as a hash value, two-factor authentication data encrypted, invitation and activation code only as a hash value, the times of invitation, activation, blocking and last login, your setting “Calendar entry by email to me” and your meetings (section 5b). For your logged-in devices we store the browser identifier, the shortened IP address and the last activity; you are only shown the device and the time. We count failed login attempts per email address and IP address as a hash value; we recognise a known device by the device cookie (section 4).

Emails to hosts. We send you the invitation, on request password reset links and, as long as you do not switch it off, an email with the calendar entry to the address of your account for each meeting that you plan, change or cancel in the host area. The calendar entry contains your start link and the invitation for your guests, i.e. also the meeting ID, the passcode and any room password set. Emails are sent via our email service (section 8) and are only kept in encrypted form with us until they are sent.

How long. Until the customer removes the account, at the latest with the deletion of the data after the end of its contract (no later than 30 days afterwards). Invitations are valid for 7 days, activation codes for 24 hours, password reset links for 60 minutes. “Stay logged in” keeps a device logged in for at most 90 days; the access of the Outlook add-in ends 90 days after its last use. If the customer removes or blocks your account, all logins end immediately.

5b. Meetings without a booking system, invitations and joining without a link

Customers can create meetings in the customer center, hosts in the host area, in the desktop app or via the Outlook add-in. For meetings of business customers we process this data on their behalf; for meetings of private customers we are responsible ourselves (section 12).

Which data. Title, start, end, time zone, language and settings of the meeting, the host's name in the meeting and the organising host; for personal links the display names of the guests and co-organisers that the host enters; the links (as a hash value and in encrypted form); for a shared guest link the meeting ID and passcode (encrypted). We store a room password as a hash value and, for these meetings, also in encrypted form so that it can appear in the invitation and be shown to the host again.

Invitations by email. If a host invites guests by email address (on the meeting page, in the lobby or from the meeting), we immediately send each address its own email with the invitation (join link, meeting ID, passcode and, if set, the room password); replies go to the host. We use the address only for this one sending and forget it right afterwards: we do not store it, and it is in no log and no queue. Against misuse we count invitations per address for at most 24 hours, and only as a hash value. For personal links we only store the guest's name, as given by the host or derived from the address. We send these emails through our email service (section 8). If the host chooses “By email” instead, they send the invitation with their own email program; we then do not receive the addresses.

Joining without a link. On the page “Join without a link”, guests enter the meeting ID and passcode; we check both and forward them to the guest link. Against guessing, we count failed attempts per meeting ID and per IP address (as a hash value, for at most one hour); we do not log the passcode.

How long. Like meeting data, according to the customer's plan from the end of the meeting; earlier if the customer or the host deletes the meeting.

5c. Outlook add-in

Hosts can use an add-in for Microsoft Outlook. It creates a meeting in the Outlook appointment and writes the link, meeting ID, passcode and, where set, the room password into the appointment.

• Pages of the add-in: Outlook loads the pages of the add-in from our server. Microsoft requires these pages to load Microsoft's program library (Office JavaScript API) from Microsoft's servers (appsforoffice.microsoft.com); in doing so, Microsoft receives your IP address and technical details about your device. We block further connections of this library to Microsoft (telemetry). Microsoft is responsible for the processing in Outlook itself under the contract your organisation has concluded with Microsoft; information from Microsoft: https://privacy.microsoft.com. Microsoft may also transfer data to the USA; Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
• Login: you log in with your host account in a window on our page. The add-in receives an access key that Outlook stores in the add-in's settings in your mailbox; we only keep a hash value of it. It ends 90 days after its last use, when you log out, with a new password and when your account is blocked or removed.
• Appointment in Outlook: what the add-in writes into the appointment is then stored in your mailbox; you decide in Outlook who receives the appointment.
• Error diagnosis: the pages of the add-in report technical stages to us (e.g. “started”, “logged in”), the Outlook platform and messages of the browser's security policy. We store one line per report in the error log, without IP address, without access keys and without email addresses (7 days).
• Role and legal basis: as for the host account (section 5a).

6. Order, contract and acceptance of the contract documents

Which data. The customer's contract details: for business customers the company name with legal form, address, country, authorised representative, data protection contact and VAT identification number, for private customers first and last name, address and country; in addition language and tenant ID; for the order: plan, booked add-ons, price, billing period, status and points in time (receipt, approval, payment, cancellation, end of contract); for a change of plan, the previous and the new plan, the amount and the points in time. When you accept the terms, the data processing agreement or the withdrawal instructions online or take note of them, we store as evidence the time, the account, the name and email address of the accepting person, the shortened IP address, and the document with the language, version and checksum (SHA-256) of the German and the English version, as well as the contract details filled in. For private customers this also includes your express declaration that we should begin performance before the end of the withdrawal period, in its exact wording; you make it when ordering, when switching plans and when booking or increasing an add-on. For sole proprietors, the company name itself may be personal data.

Purpose and legal basis. Reviewing and accepting the order, performing the contract, activating and suspending access (Art. 6(1)(b) GDPR); evidence of the conclusion of the contract and of consent (Art. 6(1)(f) GDPR); retention under commercial and tax law (Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)).

How long. Contract details, orders and acceptances until six years after the end of the calendar year in which the contract ended. Orders that we rejected without a contract being concluded: 180 days after the last rejection.

6a. Withdrawal (private customers only)

What data. If you withdraw from your contract, we store your declaration with the time it reached us, the way it reached us (customer center, email, letter, phone), the link to the contract and the order, the number of days used, the proportionate amount, the refund and the id of the refund at Stripe. An internal note is stored only where it is needed to handle the case.

Purpose and legal basis. Handling the withdrawal and proving it towards authorities and courts (Art. 6(1)(b) and (c) GDPR; Sections 355, 357, 357a BGB), retention under commercial and tax law (Art. 6(1)(c) GDPR).

How long. Like the other contract data (section 6).

6b. Cancellation through the cancellation page

On the page “Cancel contracts here” you can cancel a contract without logging in (Section 312k BGB).

What data. Name, email address, your details identifying the contract (contract number or other details such as the tenant ID or order number), the type of cancellation with a reason for an extraordinary one, the date on which the contract should end, language, the time it reached us, a receipt number, your IP address shortened to /24 or /48 and whether and when the cancellation was confirmed through the link in our email. We also count the attempts per IP address, per network (/24 or /48) and per email address as a hash value so that the page cannot be misused.

Confirmation by the customer. If the email address and the contract number belong to the same customer account, we carry out the cancellation immediately. If the contract number is missing or does not match, we do not carry it out immediately but ask by email to the address stored in the customer account whether the cancellation comes from the customer. If the customer confirms it through the link in this email (valid for 30 days), it takes effect from its receipt. This protects customers against third parties cancelling their contract. The acknowledgement of receipt to the address given is sent in any case, normally immediately; only when an unusual number of declarations arrives within a short time, within one hour at the latest.

Purpose and legal basis. Receiving and handling the cancellation and the confirmation the law requires (Art. 6(1)(b) and (c) GDPR, Section 312k BGB); protection of the page against misuse and of customers against cancellations by third parties (Art. 6(1)(f) GDPR).

How long. If we can match the cancellation to a contract, we keep it like the other contract data (section 6). Cancellations that do not belong to any contract of ours, or that were never shown to come from the customer and that we did not handle, are deleted after 180 days.

7. Payment via Stripe

We process payments via Stripe (Stripe Payments Europe, Limited and Stripe Technology Europe, Limited, both Dublin, Ireland). You enter your payment details (e.g. the card number) directly on Stripe's pages; we do not receive them. We transmit to Stripe the company name or name, email address, address, language, VAT identification number and tax classification, plan, add-ons and price, and an identifier of the order. From Stripe we receive the status of payments and subscriptions, the invoices, and the type and last four digits of the payment method.

• Purpose and legal basis: processing payments, invoicing, refunds and dunning (Art. 6(1)(b) GDPR); retention of invoices (Art. 6(1)(c) GDPR).
• Role of Stripe: Stripe processes the data partly on our behalf and partly as a controller in its own right, in particular for fraud prevention and to comply with financial regulatory obligations. Stripe's privacy policy applies to this: https://stripe.com/privacy.
• Third country: Stripe belongs to a group based in the USA; data may be transferred there. Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Stripe uses the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• How long: Stripe stores data according to its own periods. We keep a copy of each invoice, credit note and refund in our invoice archive (section 11): ten years, because invoices are accounting records (eight years under Section 147 AO, Section 14b of the German VAT Act (UStG) and Section 257 HGB, longer as long as the tax assessment period runs). After the period has expired, the system reminds us of these invoices every month, and we delete them.

Stripe never receives data of participants or hosts.

8. Emails

We send you emails relating to the account and the contract, for example to confirm your email address, to reset your password, about the receipt, approval and payment of an order, about the booking or increase of an add-on by private customers, about the end of the contract and notices under the terms. We send hosts the invitation, password links and calendar entries (section 5a). We only send participants the invitation that a host triggers for them (section 5b). We do not send advertising emails or newsletters.

• Purpose and legal basis: performance of the contract and security of the account (Art. 6(1)(b) and (f) GDPR); for emails to hosts see section 5a.
• Service provider: we use an email service as a processor (Art. 28 GDPR) to send emails: SiteGround Spain S.L., Calle de Prim 19, 28004 Madrid, Spanien / Spain. It receives the recipient address, subject, content and the technical sending data.
• How long: until they are sent, emails are only kept in encrypted form with us. We do not keep a log of which email went to whom; we log sending errors without the address (7 days). We keep emails that qualify as commercial letters like contract data (section 6).

9. Connecting the booking system

When you connect your booking system to StreamMeet, we process the address (origin) of your booking website, a one-time connection code (only as a hash value, valid for 15 minutes) and the keys for the API (API keys only as a hash value, public signing keys). The purpose is a secure connection (Art. 6(1)(b) GDPR). We store this data for as long as the contract exists; we delete connection codes after they expire.

10. Contact and support

If you write to us by email, we process your details and the content of your message to handle your request (Art. 6(1)(b) GDPR for questions about the contract, otherwise Art. 6(1)(f) GDPR). We delete the messages once the request has been dealt with, unless they must be kept as commercial or business letters (section 6).

11. Licence management, hosting, backups and invoice archive

• Hosting: the website, the customer center, the host area and the video platform run on a dedicated server of Hetzner Online GmbH (Gunzenhausen, Germany) in the Helsinki data centre (Finland). Recordings (only for recorded meetings) are processed by a virtual server of Hetzner Online GmbH in Falkenstein (Germany), which is connected to the main server through an encrypted tunnel. Hetzner is our processor (Art. 28 GDPR) and processes the data in the EU.
• Backups: we back up the database daily. The backups are encrypted (the key is not stored on the server), are additionally stored in the object storage of Hetzner Online GmbH in Helsinki (Finland) and are deleted after 7 days.
• Invoice archive: we keep copies of our invoices, credit notes and refunds (with the customer's company name or name and address) on our server (the last 24 months) and in the object storage of Hetzner Online GmbH in Helsinki (Finland). We keep them for ten years and then delete them ourselves; the system reminds us every month of invoices whose period has expired (Art. 6(1)(c) GDPR, section 7).
• Licence management: for activation, plan and monitoring, the customer center transmits the tenant ID, the company name (for private customers: the name), the plan, the status and the date up to which payment has been made to our own licence and monitoring system. It is a separate system of the same controller, hosted by Hetzner Online GmbH in Germany (Art. 6(1)(b) GDPR). For business customers, the licence system additionally stores the company data (company name, address, country, VAT identification number and the result of its verification) so that we can assign contracts and invoices to a customer (Art. 6(1)(b) and (c) GDPR); the customer also receives a customer number there. For private customers it stores nothing beyond that. When a customer account is deleted (at your request, by us or when the retention period ends), the licence system deletes its copy as well; it only keeps what we have to retain there by law ourselves. The licence system does not receive any data of participants or hosts.
• Customer support: where this is necessary to support a customer, staff of the operator display the complete customer file in the licence system (contract details, accounts, orders, acceptances of the contract documents, invoices). For this purpose the data is read from the customer center each time and is not stored in the licence system; changes to the contract details are stored in the customer center (Art. 6(1)(b) and (f) GDPR; our legitimate interest is complete and correct customer support from a single source). Each such access is logged with the time, the operator's staff member, the type of access and the shortened IP address, and the log is deleted after 180 days. For support, our administrators can also view a customer's customer center as the customer sees it (“log in as customer”): only with two-factor login and re-entry of the password, without ordering, payment, acceptance of contracts, password or account changes; the accounts involved, the times and the shortened IP address are logged (180 days).
• The monitoring of the servers only records technical metrics without personal reference.

12. Participants in online meetings

If you take part in an online meeting, via a personal link, a shared guest link or with meeting ID and passcode, we process the display name, pseudonymous identifier, role, connection data, video and audio in real time and attendance times without names; if the meeting uses them, also the waiting room (your name only while you are waiting), the whiteboard (without saying who drew what), polls (your vote without your identifier), breakout rooms and a recording (only after an announcement and with a visible indicator).

• Meetings of business customers: we process this data only on behalf of and on the instructions of the business that offers the meeting. That business is the controller; it informs you in its privacy policy about the purposes, legal bases and storage periods. This also applies if the platform appears under the name and logo of the business. Please address enquiries about this data to the business; if they reach us, we forward them there without undue delay.
• Meetings of private customers: if a private individual invites people to a private meeting, we are the controller for the same data ourselves. We process it solely in order to run the meeting technically (Art. 6(1)(b) and (f) GDPR), delete it according to the periods of the plan and use it for no other purpose. Address enquiries to us (section 1).

StreamMeet does not store email addresses of participants (an address to which a host has an invitation sent is used only for that sending, section 5b), does not store chat, raised hands and reactions and does not use any analytics or tracking services in the lobby and meeting.

13. Recipients and transfers to third countries

Your data is only received by the bodies named in this policy: our service providers as processors (hosting and backups, email delivery), Stripe for payments, Microsoft if you use the Outlook add-in (section 5c) and, where required by law, authorities (e.g. tax authorities) and our tax advisers. A transfer to third countries can only take place at Stripe (section 7) and at Microsoft (section 5c). We do not sell personal data.

14. Storage periods at a glance

15. Obligation to provide data

The details for the account, order and payment are required to conclude the contract. Without them we cannot conclude a contract. You are not legally obliged to provide them.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can view and change many details yourself in the customer center or the host area. For all requests, a message to support@streammeet.de is sufficient. We may ask for proof of your identity if we have reasonable doubts. For data that we process on behalf of a business customer (sections 5b and 12), please contact that customer; we support it in this. For your host account we ourselves are your point of contact (section 5a).

Deleting your account and data yourself: as the owner of the customer account you can trigger the deletion yourself in the customer center under "Account and security" as soon as no contract, no trial and no licence is running any more. Data we have to keep because of statutory retention duties (in particular § 147 AO and § 257 HGB: contract documents and commercial and business letters six years, invoices and accounting records eight years, which we keep for ten years) is then not deleted right away but restricted until the end of that period (Art. 17(3)(b), Art. 18 GDPR). After that, we delete the contract documents automatically and the invoices after the monthly reminder (section 7). All other data is deleted right away.

Right to object (Art. 21 GDPR): where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

17. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The competent authority for us is the data protection supervisory authority of the German federal state in which we have our registered office.

18. Automatic approval, no advertising, no AI training

Our software approves orders and requests for a free trial automatically when the technical checks pass: the tenant ID is free, the account is not locked, and the license system accepts the license. With that we only grant your request. Nothing is ever rejected automatically: if a check does not pass, a human decides. We make no other decisions based solely on automated processing within the meaning of Art. 22 GDPR and do not create profiles. We do not use your data for advertising and use neither your data nor content from online meetings to train artificial intelligence models.

19. Security

All connections are encrypted (HTTPS). We store passwords for the customer center and the host accounts only as hash values, keys for the API only as hash values and backups only in encrypted form. We store room passwords as hash values; for meetings from the customer center and the host area also in encrypted form so that they can appear in the invitation and be shown again. The email with the calendar entry to the host may contain such a room password. A room password set by a booking system is only kept as a hash value. Only we ourselves have access to the systems. The measures are described in detail in Annex 2 of our data processing agreement.

20. Changes

We adapt this privacy policy when our processing or the legal situation changes. The version published on this website applies; we inform our customers about material changes by email. This policy is available in German and English; the German version is binding, the English version is provided for convenience.

Version 1.7.5 of 2026-11-06