Privacy policy

This policy explains how LiveForge handles the personal data of people who use the platform, whether as a creator, with an account in the dashboard, or as a supporter, through the donation page. It follows the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD).

LiveForge is the controller of the data handled on the platform. When a creator views the donation data of their own channel, they also become responsible for how they use it.

• From the platform used to sign in, such as Twitch: name, email, profile picture and account identifier.
• From using the dashboard: channel settings, overlays, donation page, alerts, editor invites and preferences such as language and theme.
• To receive and withdraw money: the recipient's name, CPF or CNPJ and Pix key, along with the history of donations, fees and withdrawals.
• Credentials for services you connect, such as IRL and map tool keys, kept only on the server.
• Public chat messages from your streams, processed to appear in the tools.

The donation page does not ask for an account or a document. When someone donates, we handle:

• the name typed, the written message, the recorded audio, the music link and the chosen voice;
• the amount, the date and the payment status;
• the IP address of whoever opened the page, used against abuse and fraud;
• the payer's name and document, when the payment provider reports them in the Pix confirmation.

To keep sessions and the platform secure, we record data such as IP address, browser, access date and time, and error events. We also keep records of sensitive actions, such as changes to payout data, withdrawals and staff access to protected data.

• To make the tools work: sign-in, dashboard, overlays, chat, alerts and donation page.
• To create Pix charges, confirm payments, calculate fees, keep balances and process withdrawals.
• To generate the voice that reads messages and store the audio played on stream.
• To prevent fraud, scams, money laundering and abuse, and to enforce blocks by the platform and by creators.
• To comply with legal, tax and regulatory obligations, and to respond to authorities.
• To handle support requests and improve the platform.

We do not sell personal data and do not use it for third-party advertising.

We handle data under the legal bases set out in the LGPD:

• performance of a contract, to deliver the tools and process donations and withdrawals;
• compliance with legal or regulatory obligations, such as financial records and responses to authorities;
• legitimate interest, for security, fraud prevention and enforcement of the Terms of use, always respecting your rights;
• regular exercise of rights, in legal proceedings and disputes;
• consent, when a feature depends on it, which can be withdrawn at any time.

A message exists to appear on the stream. The name, text, audio, generated voice and donation amount may be shown live to the creator's entire audience and remain in recordings, clips and replays published by the creator or by others.

We have no control over what is recorded or shared from the stream. Do not put your own or other people's personal data in a message.

The creator sees the name, message, amount and date of donations to their channel in the dashboard. Supporters' documents and IP addresses are not shown to the creator.

We only share data with those who need it for the platform to work:

• Payment provider and financial institutions, currently Woovi: creating and confirming Pix charges and sending withdrawals.
• Voice services, currently Amazon Polly, from Amazon Web Services, and ElevenLabs: they receive the name, amount and text of the message to generate the audio.
• Hosting and storage, such as Vercel, Hostinger and Cloudflare: they run the website, the realtime server, the database and the audio files.
• Streaming platforms, such as Twitch: sign-in and chat reading, according to what you authorize there.
• Public authorities, when there is a legal obligation or court order, or to protect rights in cases of fraud.

These partners may only use the data to provide the contracted service and have their own privacy policies.

Some of these services store or process data outside Brazil. In those cases, the transfer takes place under the conditions allowed by the LGPD, with providers that adopt security measures compatible with this policy.

• The connection to the platform is always encrypted (HTTPS).
• CPF, CNPJ, Pix keys, payer documents and IP addresses are stored encrypted in the database.
• Integration keys and passwords stay on the server and never reach the browser.
• The session uses a protected cookie that page scripts cannot read.
• Staff only access protected data when their role allows it, and every access is logged with who accessed it and when.
• Payout data and withdrawals go through checks and limits.

No system is fully immune to failures, but we treat security as part of the product and review these protections continuously.

• Account data and settings: while the account exists.
• Messages, audio and donation history: while needed for the channel and for security, respecting the legal periods for financial records.
• Financial, withdrawal, fee and protected data access records: for the period required by tax, anti-money laundering and rights protection laws, even after the account is deleted.
• Application access logs: at least for the period required by the Brazilian Internet Civil Framework (Marco Civil da Internet).

When the period ends, the data is deleted or anonymized.

Under the LGPD, you can request:

• confirmation that we handle your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data handled in breach of the law;
• data portability, under the applicable regulation;
• information about who we share your data with;
• review of decisions made solely by automated means;
• withdrawal of consent, when consent is the legal basis.

Creators can delete their account directly in the settings. Other requests, from creators and supporters, can be made through the contact below. To protect you, we may ask for information confirming the request is yours, such as details of the payment made.

Some data must be kept even after a deletion request when the law requires it. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

We only use what the platform needs to work:

• a session cookie, to keep you signed in to the dashboard;
• a language cookie, to remember the language you chose;
• the browser's local storage, for display preferences such as theme and sidebar.

We do not use advertising cookies or third-party tracking tools. Donation pages and overlays work without signing in.

The platform does not allow people under 18 to receive donations. Minors should only donate with permission from their legal guardian. If we learn that we handled a child's data without the required authorization, we delete that data.

If a security incident occurs that may cause relevant risk or harm, we notify the ANPD and the affected people within the deadlines and in the manner required by law and regulation, and we take the necessary steps to contain the problem.

We may update this policy when the platform or the law changes. The date of the last update is shown at the top of the page, and important changes are announced in the dashboard.

Requests about your data, questions about this policy and communications to the data protection officer can be sent through the LiveForge support channels. A dedicated contact address will be published on this page.