Privacy notice.

Version 9 November 2026

This notice applies to DonoLink's website, accounts, public donation pages, payments, dashboards, overlays, support, waitlist and stream integrations. It explains which personal data we process, why, for how long, and what choices and rights you have.

1. Who is responsible?

Tovix, trading as DonoLink, sole proprietorship, Dutch Chamber of Commerce 98227475 and VAT NL005316890B06, is the controller for the DonoLink processing described in this notice. Contact: info@donolink.nl. DonoLink is not responsible for processing for which a creator, Stripe, a bank, payment method or connected streaming platform independently determines the purposes and means; that party is the controller under its own privacy terms. DonoLink remains responsible for its own selection, engagement and disclosure to the extent required by the GDPR.

2. What data and sources?

Account and profile data: name, email address, username, password hash, verification status, profile picture and banner, bio, language, country, currency, social channels, settings, two-factor status and an encrypted or shielded authentication secret. We receive these from you or from a social login provider you choose, such as Google or Twitch.

Donation and payment data: name or nickname, message, amount, currency, payment method, status, time, transaction IDs, terms version and time of acceptance, and your email address if you enter it. DonoLink stores that email address itself: for the confirmation of your tip, a possible thank-you from the creator (article 16e of the terms) and your saved details if you use them. Full payment, identity and bank details are processed by Stripe or PayPal; DonoLink does not store full card numbers, IBANs or identity documents. For an interactive tip we also store what you chose (action, video, sound, GIF or voice) and the text that is read aloud.

Saved details for faster tipping (optional): if you confirm your email address or sign in with a sign-in link, we store only that email address, the language of your emails, when you confirmed and when you last signed in. Your tips are then shown together in your overview; we link them only by the confirmed email address, never by name. Staying signed in uses a cookie (dl_donateur) with a random key, of which we store only a hash together with the device type and country; a session expires after 90 days without use. Creators never see whom else you tip. DonoLink staff can view your overview for support and to fight abuse. Legal basis: performance of the service you request. If you delete your details, your account, sessions and links disappear immediately; your tips themselves stay with the creator like any tip. Our security log then keeps, for up to one year, a record that you signed in, signed out, linked an account or deleted your details, with your email address (see retention periods). If you do not use your details for 24 months, we delete them. If you pay through Stripe Link, Stripe processes that data under its own privacy policy.

Viewer points (optional): if you link Twitch, YouTube or Kick, you confirm who you are with that platform (Twitch with no extra permissions, YouTube read-only, Kick only your user details). We only store your ID on that platform (for Twitch and Kick also your name) and when you linked it, never a password or token: we keep no access, and the temporary token expires on its own. With that ID we show only you your viewer points, your rank and any running giveaway with creators who use Linky points and have not turned this off. Creators cannot see that you linked, and points are never changed from here. You can unlink at any time; it also happens when you delete your data. Linking and unlinking are recorded in our security log.

Memberships: if you become a member of a creator, we store your email address, your name on stream, the tier, the price, the status and, for each payment, the amount, time and transaction IDs, plus the key behind your personal management link. We send you the emails that belong to your membership. The creator sees your name, tier and payments, and your email address so they can help you. Legal basis: performance of the contract and the tax retention obligation.

Shop (digital products): when someone buys a digital product from a creator, we store the buyer's name and email address and, for each order, the product, amount, currency, status, time, transaction IDs, the consent to immediate delivery with its time and terms version, the number of downloads and any code. For the creator as seller we store whether they sell as a private person or as a business and, for a business, the company name, the Chamber of Commerce or trade register number and the VAT number. Stripe processes payment details directly. With every order we also record the seller status as it was at that moment. To limit open reservations per visitor, we briefly store a hashed version of the buyer's IP address with an order (never the IP address itself). To check whether a shop has been switched to a business, we read the business type and country of their Stripe account from Stripe and store them.

Shop VAT and records: for a creator who sells as a business we also store the VAT status, VAT rate, VAT number and business address. We don't show the address to buyers; we only pass it on if the law requires it, for example to a regulator. For each order we store the VAT status and VAT as at the time of sale, and the buyer's country as it appears from the payment (billing address, card country or payment method).

Shop page and sponsor clicks: if you click a sponsor link on a shop page, we count that click per day, without a cookie. To recognise duplicate clicks, we keep an encrypted code of your IP address that cannot be reversed for 30 minutes. A YouTube video on a shop page first shows a preview image loaded from YouTube (Google); the player itself loads only after you click. Legal basis: legitimate interest in reliable figures for the creator.

Content and communications: public profile content, alert media, media requests, import data, support tickets, emails and information in reports, complaints, refunds or disputes.

Streaming integrations: account and channel IDs, display name, OAuth tokens and scopes, connection status and visible live events from Twitch, Kick, YouTube, TikTok or Streamlabs, such as name, chat message, follow, subscription, gift, bits, raid, Super Chat or membership. Import keys are used only to perform the selected import and are not stored as profile data.

Transferred data: if a creator transfers their history from Streamlabs, StreamElements, TipeeeStream, Ko-fi or another service, we store names, messages, amounts and dates of tips from that history. The creator is responsible for this; DonoLink processes the data on the creator's behalf as a processor (annex 1 of the terms). It may count towards the creator's statistics and leaderboard. If you want your data from such a transfer removed, ask the creator or email info@donolink.nl; we help the creator with this. We use a key for the other service only for the transfer.

Linky giveaways and viewer points: if someone enters a giveaway or collects viewer points in a creator's chat, we process their chat name and platform ID, entries, tickets, points and any prize. The creator sees entrants and winners; winners may be named in the chat and on stream. The history of the last 50 giveaways per channel stays with the creator. Legal basis: the creator's legitimate interest in running a game in their chat.

Clipper: if a creator switches on the Clipper, a DonoLink server in the Netherlands listens to the stream's audio and chat during the stream to find highlights, creates a Twitch clip on the creator's behalf and analyses it: speech is converted to text and we locate the facecam in the picture. We do not recognise individuals. The clips stay with Twitch; we keep the recipe and a preview image until the creator deletes the clip. We use chat names and messages only to find moments. Legal basis: performance of the service the creator switches on.

Referral data: the referral code you signed up with, the time, the referrer and an encrypted hash of your IP address at sign-up (never the IP itself); for referrers also their own code, the percentage, hashed IPs of recent visits, commission entries per donation (platform fee, percentage, amount, status and Stripe payment reference), the outcome of the abuse check and payouts with reference.

Supporter overview and emails on behalf of creators: if a creator switches on the supporter overview, we compile for that creator an overview of their own supporters from data we already process: tips (name, amount, message, time), memberships, purchases, live events from connected channels and Linky viewer points. We combine records with the same email address. We link tips without an email address and stream activity by name only if that name belongs to exactly one supporter; the creator then sees that it may be the same person. An anonymous tip belongs to nobody. The creator sees only their own supporters and never email addresses; YouTube data counts for at most 30 days. Anyone who left an email address may receive one personal thank-you per tip from the creator, without advertising (legal basis: the creator's legitimate interest in saying thank you; every email has an unsubscribe link). You only receive updates if you tick the box with a tip (unticked by default) and confirm through the link in the email we send right after (legal basis: consent); we store your consent with the time, the tip and the sentence shown. For the overview and these emails, DonoLink and the creator are jointly responsible: DonoLink handles the technology, the shielding, sign-up and unsubscribe and is your point of contact (info@donolink.nl); the creator decides who gets an email and what it says. We send these emails on the creator's behalf through our own mail server; unsubscribing applies to all emails from that creator through DonoLink.

Fee invoices and tax information (creators): for the monthly fee invoice we process your country, your (business) name and your VAT number, which we check in the EU VIES database. If the law requires DonoLink to report information about creators to a tax authority (such as under the DAC7 rules), we ask for the information the law specifies, such as address, date of birth, tax identification number and bank account, and pass it on to the competent tax authority. Legal basis: legal obligation.

Date of birth (creators): when you set up payouts, Stripe verifies your identity and we read your date of birth through Stripe (only for an individual account, not for a business). We keep only the day and month, for your birthday (see below). We never show your date of birth publicly, do not share it with anyone and delete it as soon as your account or your Stripe connection is removed. We do not process the date of birth of donors.

Technical and usage data: IP address, country code, known login locations and security events for security. For limited server statistics, we measure product milestones such as account creation, onboarding, connected features, donations and payouts under a non-reversible pseudonym; PostHog does not receive an email address, raw account ID or browser IP for this layer. Only after consent do we measure visited paths, clicks, referrer/UTM source, browser and device data and masked session recordings on product pages in the browser.

Security log, mail log and abuse prevention: when you sign in, sign out, use 2FA, change your password, request a payout, link an account and similar actions, we record what happened, with IP address, an encrypted code of the IP address, country, city, device and email address (masked if there is no account); never passwords, codes or tokens. Every email we send is kept in our mail log, with its content but without the secret parts of links. Requests to known attack addresses may block an IP address temporarily. Legal basis: legitimate interest in a secure service and in proving what happened.

Notifications and annual statement (creators): in your dashboard we show notifications about your account, such as your annual statement or a closed ticket, and we store when you saw them. We calculate the annual statement from your own transactions, without names or messages of tippers. Legal basis: performance of the contract.

Waitlist and contact: email address, reserved username, limited source/referral information, referral code and correspondence. We may also receive data from a creator, payment provider, bank, platform or competent authority where needed for support, security or a dispute.

3. Purposes and GDPR legal bases

• Contract: provide the account, profile, donation flow, dashboard, overlays, imports, integrations and support; without required data we cannot provide that feature.
• Legal obligation: comply with recordkeeping, tax, competent orders and applicable financial or sanctions obligations.
• Legitimate interests: secure the service, prevent misuse, fraud and chargebacks, preserve evidence, handle claims, investigate failures, send a limited number of service emails to finish setting up your payouts with Stripe (these also serve the performance of the contract; you can unsubscribe with one click in every email) and use limited pseudonymised server statistics to improve product operation, activation and reliability. The statistics layer does not create session recordings, use browser tracking or build a PostHog person profile. We balance this against your privacy interests, limit the data and respect a reasoned objection.
• Consent: for optional emails you switch on yourself, such as the stream overview, for detailed PostHog browser analytics, dead-click analysis and masked session recordings, and wherever else we expressly request it. Withdrawal immediately stops new browser analytics, applies prospectively and does not make earlier processing unlawful.
• We rely on vital or public interest only in exceptional situations permitted by the GDPR. We do not use personal data for credit scoring or sale to data brokers.
• Abuse check for the partner program (legitimate interest: fraud prevention): we compare whether a referrer and a referred creator use the same bank account (via a fingerprint calculated by Stripe, not the IBAN), the same person or company (name and date of birth from Stripe verification), the same email address, the same browser or the same network. We only keep the outcome and hashed IPs; if they match, the commission lapses. A staff member reviews doubtful cases.
• Birthday (legitimate interest): from Stripe verification we also keep the day and month of your date of birth (only for an individual account). We use them to congratulate you during your birthday week and to offer you a birthday theme for your dashboard and donation page; you can switch that theme off yourself in Settings. We never show your birthday publicly and do not share it with anyone. You can object via info@donolink.nl.
• Shop (contract and legal obligation): fulfilling and delivering orders, securing downloads, handling refunds and chargebacks, invoicing fees and meeting the tax retention obligation. We show buyers the seller's status because the law requires this of an online marketplace (Article 6a of Directive 2011/83/EU). Based on our legitimate interest, we count each seller's shop revenue and number of sales per period to monitor the limits for private sellers.
• Growth forecast (legitimate interest: guiding product and support): for creators, we use our own model on our own server to forecast how many tips an account may receive in the next 90 days. Only DonoLink administrators see this; it does not lead to decisions with legal effects and is not shared with anyone. You can object through info@donolink.nl.

DonoLink does not sell or rent personal data and does not use Google or YouTube data for advertising, profiling or sale.

4. Recipients and roles

Only necessary data may be shared with:

• Stripe and relevant banks/payment methods for onboarding, KYC, payments, fees, payouts, refunds, fraud and disputes; Stripe also processes under its own privacy terms.
• the selected creator: donation name, message, amount, time and status for receipt, alerts, statistics and handling questions; no full payment instrument or IBAN.
• suppliers who run the DonoLink infrastructure: our own servers in the European Union for the database (PostgreSQL) and file storage, with a backup server and compute servers for the Clipper, the growth model and text-to-speech in the Netherlands; Cloudflare for networking, security and failover during outages; Microsoft for email; Anthropic when you ask Linky, the AI assistant in the dashboard, a question: we then send your question, at most two of your earlier questions and a short summary of your account settings, never your email address, payment details or passwords; for reading alerts aloud, Microsoft for the natural voices and our own speech server for the studio voices, with only the text to be read; and GIPHY for GIFs, where the creator searches through our server and the GIFs themselves load from GIPHY.
• PostHog for limited pseudonymised server statistics without a person profile and, only after consent, browser analytics and masked session recordings. PostHog processes this data on servers in the United States (see 5). In session recordings, on-screen text such as buttons and messages is readable; names, messages, email addresses, amounts and keys are masked. Entered text, form values, payment fields and OBS/QR pages are not recorded. Without a cookie choice, only cookieless visit statistics (see 8).
• Google/YouTube, Twitch, Kick, TikTok and Streamlabs when you activate such an integration. To connect your YouTube account, DonoLink requests youtube.readonly to read channel information, live streams, live chat and live events. Only when you separately authorise stream title changes does DonoLink also request youtube.force-ssl. This lets DonoLink change your active stream's title when you issue a command to do so. The separately connected YouTube bot uses youtube.force-ssl to post chat messages according to your bot settings and, with the required channel permissions, delete messages or temporarily ban viewers from chat. DonoLink uses YouTube API Services. Google's Privacy Policy (https://policies.google.com/privacy) also applies. You can revoke DonoLink's access to your YouTube account at any time by disconnecting it or through Google's security settings (https://security.google.com/settings/security/permissions).
• advisers, insurers, public authorities, regulators, law enforcement or a successor business, but only on a valid basis, to the necessary extent and with confidentiality where appropriate.
• the referrer who invited you: your username, sign-up date, end of the commission period and the commission your donations generate. If your leaderboard is off, the referrer only sees you anonymously and without an amount. The referrer never sees donors, messages or your balance. Legal basis: performance of the partner program and our legitimate interest in a verifiable commission calculation.
• the creator you buy a digital product from: your name, email address and order details, so that the creator as seller can manage your order and refund it if needed. Buyers see the creator's seller status and, for a business, the company name. Legal basis: performance of the contract and legal obligation.
• Who is responsible for what: DonoLink is the controller for tips, saved details, viewer points, memberships, the shop and security; the creator is also independently responsible for what they do with the data themselves. For the supporter overview and the emails on the creator's behalf, DonoLink and the creator are joint controllers (Article 26 GDPR; the arrangement is in article 16e of the terms and DonoLink is the point of contact). For transferred data, the creator is the controller and DonoLink the processor (annex 1 of the terms). Stripe, PayPal and connected streaming platforms are independent controllers.

Use of YouTube API Services: DonoLink uses YouTube API Services; Google's Privacy Policy (https://policies.google.com/privacy) also applies. What we access: when a creator connects YouTube, their channel ID and channel name, whether they are live, the ID of their live chat and, while they stream, the messages and live events in that chat: the viewer's display name and channel ID, the message text, Super Chats, new members and subscribers. For song and video requests we read the title, channel and length of the requested video. What we use it for: only the features the creator switches on: alerts and overlays on stream, the Linky chatbot (replies, commands, timers, moderation, giveaways and viewer points), song and video requests, and statistics in the creator's own dashboard. We never use YouTube data for advertising, profiling, resale or training AI models. How we process it: on DonoLink's own servers in the European Union, in access-restricted storage; tokens are used only for the permissions the creator granted. Who we share it with: internally, only DonoLink staff who need it for support, security or fixing faults, under a duty of confidentiality. Externally, only with: the creator's viewers, through the alerts, overlays and chat messages the creator chooses to show; YouTube itself, when the bot posts or moderates in the chat on the creator's instructions; processors that run our infrastructure under a data processing agreement (our hosting and Cloudflare, and, if the creator turns on text-to-speech, the speech service, only for the text to be read); Stripe, which receives the video title with the payment details of a paid video request; and authorities when the law requires it. We never sell YouTube data and do not share it with anyone else. Retention: data about viewers and live events is deleted or refreshed within 30 days. At least every 7 days we check that the creator's authorization is still valid; if it is not, we delete the related YouTube data within 7 days. The same applies when the creator disconnects YouTube, revokes access through Google's security settings (https://security.google.com/settings/security/permissions) or deletes their account. You can also ask us to delete your YouTube data through info@donolink.nl; this does not change anything stored by YouTube itself.

Appropriate agreements are entered into with processors and they may process data only on instructions. A recipient that independently determines purposes and means, such as Stripe for regulated payment services, a bank, payment method, creator or streaming platform, is separately responsible for lawfulness, transparency, security, retention and rights in its own processing. A request to DonoLink does not automatically delete or correct data held by such an independent party.

5. Transfers outside the EEA

Some recipients process data in the United States or other countries outside the European Economic Area: Stripe (payments), PostHog (analytics), Microsoft (email and natural voices), Google (sign in with Google, YouTube), Twitch (sign-in and connections), Cloudflare (networking and security), Anthropic (questions to Linky) and GIPHY (GIFs). Where the GDPR requires it, we rely on an adequacy decision, the EU-US Data Privacy Framework for certified recipients, the European Commission's standard contractual clauses and supplementary measures where needed. Stripe, PayPal, Google, Twitch and other platforms you connect yourself process data as independent controllers under their own safeguards. You can request a copy of the safeguards through info@donolink.nl.

6. Retention periods

• Account, profile, settings and active OAuth integrations: while the account or integration is active; after deletion, generally within 30 days from active systems.
• Financial administration, fee invoices and necessary transaction data: up to 7 years after the relevant financial year, or longer where required by law or an ongoing dispute.
• Terms and payment evidence, fraud, refund, chargeback and claim files: as long as needed for the purpose and no later than expiry of applicable statutory limitation or dispute periods.
• YouTube OAuth data: until disconnection; we then revoke the token and delete the integration. Derived YouTube event details: no more than 30 days. Deletion at DonoLink does not alter data held by YouTube itself.
• Other stream events and import history: while needed for creator-requested statistics and service delivery, or until account deletion; real-time overlay messages are normally deleted within 5 minutes.
• Support tickets, reports and correspondence: while the request or account is active and afterwards only while needed for a contract, complaint, claim or legal duty. Questions to Linky and the answers: 12 months, after which we delete them automatically. Waitlist data: until withdrawal, conversion to an account or the waitlist purpose ends.
• Security data: failed-login and incident data while needed for security or investigation; known login locations remain as a limited rolling list with the active account and are deleted with the account. PostHog data follows the configured retention period of the PostHog project and is deleted earlier when no longer needed.
• Referral and commission data: for as long as the partnership or commission period runs and then 7 years because of the statutory tax retention obligation; hashed IPs for at most 90 days; the referral cookie for at most 30 days and the referrer cookie for at most 1 year.
• Shop orders (buyer, amount, consent to immediate delivery, seller status at the time of sale): 7 years after the end of the financial year of the purchase. That is how long the tax rules require us to keep our records, and the consent is our proof in case of a refund, chargeback or complaint. Download links work for 30 days. A seller's business details: as long as the shop or account exists; after that only as part of the retained orders. Hashed IP addresses with an order: until the order is paid or has expired, at most one hour.
• Viewers' saved details and linked accounts: until you delete them, and at the latest 24 months after your last sign-in without an active session. A session expires after 90 days without use.
• Security log: one year, also after you delete your details or account; the readable IP address after 30 days. Mail log: 90 days. Blocks by abuse prevention: at most 30 days per block.
• Dashboard notifications: one year, except the notification about your annual statement. Supporter overview: proof of consent until 2 years after unsubscribing, unconfirmed sign-ups 30 days, sent thank-you messages and updates 12 months; the overview itself disappears once the underlying data disappears.
• Memberships and their payments: 7 years after the end of the financial year, because of the tax retention obligation. Transferred data: until the creator deletes it or their account; the log of a transfer 12 months. Information for a report to a tax authority: as long as the law requires.

Backups may remain isolated for a short period and are overwritten according to the backup cycle. Deletion does not apply to data we must legally retain; such data is restricted and used only for that purpose.

7. Public data and the creator

A creator profile, avatar, banner, bio, social links and uploaded overlay media are intended for public display. For a donation, the name/nickname, message, amount and time may appear on the selected creator's donation page, leaderboard and stream alert. Do not provide information you do not want made public. Once a creator selects, downloads, combines, publishes or uses received data outside DonoLink for their own purposes, that creator independently determines the processing. The creator must then have their own valid legal basis and privacy information, handle rights, apply appropriate security, retain data no longer than needed and not disclose sensitive or unnecessary data. DonoLink is not responsible for such independent, unauthorised or terms-breaching use by a creator, except to the extent the law imposes a separate duty on DonoLink. Direct a request concerning such use to the creator as well.

8. Cookies, local storage and analytics

DonoLink uses necessary storage for the login session, language, theme, security and OBS settings you choose. In addition, server processes send limited product milestones to PostHog under a secretly derived pseudonym on the basis of legitimate interests; this layer uses no browser tracking, browser IP, email address, raw account ID, session recording or PostHog person profile. Detailed browser analytics, dead-click analysis and masked session recordings start only after active consent; refusing does not affect access to the service. The browser layer uses in-memory storage, masks text and inputs, records no iframes, headers or bodies and does not run on OBS or QR routes. You can withdraw consent just as easily through Cookie settings in the footer; the open page then immediately stops new browser analytics and session recordings. You may object to the limited server statistics on grounds relating to your particular situation via info@donolink.nl. If you have not made a choice yet, PostHog counts visits and product steps cookieless: without cookies or other storage on your device, without session recordings and without recognising you across days. For this, PostHog creates a hash of your IP address and browser details on its server, using a key that changes every day. We do this on the basis of legitimate interests, to understand how visitors use the service. If you choose Reject, this measurement stops as well.

If you follow a referral link (/r/...), we set a functional first-party cookie (donolink_ref, 30 days) containing only the code, so we can link the invitation when you sign up; we delete it after sign-up. Referrers get a functional cookie (donolink_ref_eigen, 1 year) that recognises their own browser, so they cannot invite themselves. Neither is used for tracking or advertising.

9. Security and data breaches

We use measures including TLS, restricted tokens and sensitive fields, access controls, two-factor authentication, rate limits, logging and payment status checks. No internet service can guarantee absolute security. Users remain responsible for secure devices, unique passwords, two-factor protection and keeping tokens and links confidential. If a personal data breach occurs for which DonoLink is responsible, we investigate and contain the impact and notify the Dutch Data Protection Authority and affected individuals where required. Report a suspected security issue without exploiting it via support@donolink.nl. The liability provisions in the terms apply to the extent they do not conflict with mandatory GDPR rights.

10. Your GDPR rights

Depending on the circumstances, you have the right to:

• access and a copy of your personal data;
• rectification of inaccurate or completion of incomplete data;
• erasure or restriction of processing, unless an exception or retention duty applies;
• data portability for data you provided where processing is automated and based on consent or contract;
• object on grounds relating to your situation to legitimate-interest processing, and always object to direct marketing;
• withdraw consent for the future;
• lodge a complaint with the Dutch Data Protection Authority or the competent authority in your country of residence or work.

Send a request to info@donolink.nl. We normally respond within one month. For complex requests, the GDPR allows us to extend this by two months and we will inform you within the first month. We may proportionately request identity verification and may refuse or charge for manifestly unfounded or excessive requests.

11. Automated decisions

DonoLink does not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Technical fraud, security and payment checks may temporarily block a login or new payment. You may request human review via support@donolink.nl. Stripe, banks and payment methods may perform their own automated checks under their terms and privacy notices.

12. Minors

A creator account is intended for people aged 18 or older; a minor uses DonoLink only through a parent or legal guardian who manages the account, to the extent Stripe allows. Saved details and viewer points are for people aged 16 or older, or younger with permission from a parent or guardian. We do not knowingly process data of children under 13. If you think we process a child's data anyway, let us know through info@donolink.nl and we will delete it.

13. Changes

We may update this notice when the service, providers or law changes. The current version and date appear on this page. We appropriately notify account holders of material changes before or when they take effect. New processing requiring consent will not start without that consent.

14. Contact and complaint

Privacy questions or requests: info@donolink.nl. You may also lodge a complaint with the CNIL (cnil.fr) or the competent supervisory authority in your country of residence or work.