Privacy Policy
Overview
Milaeshop provides multiplatform chat widgets for livestreamers, allowing chat from Twitch, YouTube and Kick to appear within a single overlay.
The data controller is "Milina's design studio" LLP, a limited liability partnership registered in Kazakhstan. Enquiries concerning this policy may be sent to or .
What is collected
Milaeshop collects only the data required for the service to operate. No advertising, profiling, sale or rental of personal data takes place.
Purchasing and using a widget does not require an account. Widgets bought through Etsy, VGen or Ko-fi are delivered as a file containing a one click installation link for StreamElements. That transaction is complete in itself, and Milaeshop receives no information about the purchaser's Twitch, YouTube or Kick account. A portal account is a separate and optional layer, intended for streamers who wish to manage their widgets in one place, use the visual style editor, or connect additional platforms for live chat features. The remainder of this section applies only to account holders.
Account creation
Accounts are created through Twitch sign in. The following data is stored:
- the email address associated with the Twitch account
- the Twitch username
- the Twitch account identifier
- the address of the Twitch profile image
This data identifies the account, maintains the signed in session, and allows Milaeshop to make contact regarding the service.
Connected platforms
Connecting YouTube or Kick is optional. For each connected platform, Milaeshop stores the username, the platform account identifier, and the address of the profile image.
An access credential issued by the platform is also stored, enabling Milaeshop to read live chat on the account holder's behalf. This credential remains on Milaeshop servers at all times. It is never displayed, never transmitted to a browser, and never placed within widget code.
The Milaeshop key
A random key is generated for each account and stored alongside the account record. It is entered into the widget so that the widget can identify itself to Milaeshop. The key contains no personal information and is not derived from any platform credential. It may be replaced on request.
Chat messages
While a stream is live, Milaeshop receives chat messages from connected platforms and relays them to the widget in real time. Messages are passed on as they arrive. They are not written to a database and are not retained once the stream has ended.
YouTube API Services
Milaeshop uses YouTube API Services. Account holders who connect YouTube are additionally bound by the YouTube Terms of Service, and Google's handling of data is described within the Google Privacy Policy.
Milaeshop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to deliver the chat features requested by the account holder. It is not transferred to others except as necessary to provide those features or as required by law, it is not used for advertising, and it is not read by any person except with explicit permission, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.
Access may be withdrawn at any time through Google's permissions page, independently of any action taken within Milaeshop.
What YouTube data is accessed
Milaeshop requests the youtube.readonly scope. Although this scope permits read access to a broader range of account data, Milaeshop accesses only the following, and only for an account holder who has chosen to connect YouTube:
- the channel identifier, channel name and channel profile image, used to identify the connected account and display it within the portal
- the account holder's currently active live broadcast, used to locate the live chat belonging to it
- the live chat messages of that broadcast, relayed to the account holder's overlay while the stream is live
No other YouTube data is accessed. Videos, playlists, subscriptions, comments and viewing activity are never requested, read or stored, and no data is written to the account holder's YouTube account.
Disclosure of Google user data
Google user data is never sold, rented or traded, and is not shared with advertisers, data brokers, analytics providers or any other third party for their own purposes.
Disclosure occurs only in the following circumstances:
- Railway, the hosting provider, stores the data on servers in Amsterdam, the Netherlands, solely so that the service can operate. Railway acts on Milaeshop's instructions and makes no independent use of it.
- The account holder's own overlay receives live chat messages, as displaying them is the purpose of the service. Those messages subsequently appear within a public broadcast. This occurs only for channels the account holder has connected, and only while the stream is live.
- Where required by law, such as a valid request from an authority holding jurisdiction.
No other party receives Google user data. It is not used to train machine learning or artificial intelligence models.
Protection of Google user data
Security procedures are in place to protect the confidentiality of Google user data. Encryption is used to protect it both in transit and at rest, access credentials are held on Milaeshop servers and never released to any other party, and access to the systems holding this data is restricted. The measures described under Security below apply to Google user data in full.
Hosting
The application and database are hosted by Railway on servers in Amsterdam, the Netherlands. All data remains within the European Economic Area. Railway processes data on Milaeshop's instructions and makes no independent use of it.
No analytics services, advertising networks or email marketing tools are used.
Purchases
Widgets are sold through Etsy, VGen and Ko-fi. Each platform provides Milaeshop with the order details collected at checkout, typically the purchaser's username and email address, which serve delivery and support purposes only. This information is not linked to a portal account.
Payment is handled entirely by the selling platform under its own privacy policy. Milaeshop does not receive card details, billing addresses or any payment information.
Legal basis
For users within the United Kingdom and European Economic Area, account and connection data is processed because it is necessary for performance of the service requested. Optional platform connections rely on consent, which may be withdrawn at any time by disconnecting the platform.
Retention
Account data is retained for as long as the account exists, and is not kept for longer than is necessary for the purposes described in this policy.
Disconnecting a platform immediately deletes the access credential and the profile details held for that platform. Chat messages are never retained at all, as described under Security.
An account may be deleted at any time by request to the addresses above. Deletion removes the account record, every connected platform detail and every access credential within 30 days, except where retention is required by law.
Rights
Account holders may request access to the data held about them, correction of inaccurate data, deletion of the account and its data, or a portable copy. They may also object to processing, or withdraw consent for an optional connection.
Requests sent to or receive a response within one month. Users within the EEA or United Kingdom may lodge a complaint with their national data protection authority.
Security
Security procedures are in place to protect the confidentiality of all personal data held by Milaeshop, including Google user data.
Encryption
Encryption is used to protect this information. All data is encrypted in transit: communication between the browser and Milaeshop, between the widget and Milaeshop, and between Milaeshop and the platform APIs it connects to all take place over HTTPS using TLS. Data stored by Milaeshop is held on managed infrastructure on which storage is encrypted at rest.
Handling of access credentials
Access credentials issued by Twitch, YouTube and Kick are held on Milaeshop servers only. They are never displayed to the account holder, never transmitted to a browser, and never placed within widget code or any other publicly accessible location. The key used by the widget to identify itself is a random value which grants no access to any connected platform account, and which may be revoked and replaced at any time without affecting those connections.
Chat message handling
Chat messages are held only in memory for the short period required to relay them to the account holder's overlay. They are never written to a database or to any other persistent storage, and no copy remains once the stream has ended.
Access control
Access to production systems and to the database is limited to personnel who require it in order to operate or support the service, is protected by individual credentials, and is granted on the principle of least privilege. Milaeshop personnel do not read Google user data except in the circumstances described under YouTube API Services above.
Breach notification
No system is entirely secure. Should a personal data breach affecting account holders occur, Milaeshop will notify those affected and the competent supervisory authority without undue delay, as required by applicable law.
Children
Milaeshop is not intended for persons under 13, or under the minimum age required by the connected streaming platforms. Data is not knowingly collected from children.
Changes
Amendments to this policy are reflected in the date shown above. Significant changes affecting the use of personal data are announced within the portal before taking effect.