Privacy Policy

1. Controller

The controller within the meaning of Art. 4(7) GDPR is the provider named in the Imprint, Anikeen UG (haftungsbeschränkt) & Co. KG, Buntspechtweg 21, 53123 Bonn, Germany, phone: +49 228 92970166, email: privacy@anikeen.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

Because we do not, as a rule, employ at least 20 people constantly engaged in the automated processing of personal data, we are not required to appoint a data protection officer under § 38(1) BDSG and have not appointed one. For questions about data protection, you can reach us at any time at the contact address given above.

2. General Information on Data Processing

We process our users' personal data only to the extent necessary to provide a functioning platform and our content and services. The legal bases we rely on are, in particular, the performance of a contract or pre-contractual measures with the user (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), our legitimate interest in operating the platform securely and stably (Art. 6(1)(f) GDPR), and, where given, the user's consent (Art. 6(1)(a) GDPR). The sections below state the legal basis that applies in each case.

Recipients. We pass personal data to external parties only where this is necessary to perform a contract, where we are legally obliged to do so (e.g. disclosure to tax authorities), where we have a legitimate interest in the disclosure under Art. 6(1)(f) GDPR, or where another legal basis permits it. Where we use processors, we pass personal data to them only on the basis of a valid data processing agreement. Where processing is carried out jointly, a joint controllership agreement is concluded.

Contacting us. If you contact us by email or phone, your enquiry and any personal data arising from it (name, enquiry) are stored and processed in order to deal with your request. We do not pass this data on without your consent. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures, and otherwise our legitimate interest in dealing effectively with the enquiries we receive (Art. 6(1)(f) GDPR). The data remains with us until you ask us to delete it or the purpose of storing it no longer applies (e.g. once your request has been dealt with); statutory retention periods remain unaffected.

Encryption. For security reasons and to protect the transmission of confidential content, Gleem uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar. Please note that data transmitted over the internet (e.g. when communicating by email) may be subject to security vulnerabilities; complete protection of data against access by third parties is not possible.

3. Provision of the Platform, Hosting and Server Log Files

When you access Gleem, we automatically process information transmitted by your device or browser, in particular your IP address, the date and time of the request, the content accessed, and the browser/user-agent string used. This processing is technically necessary to display the platform to you and to ensure its stability and security (Art. 6(1)(f) GDPR). Server log files are stored for a limited period and then deleted or anonymized, unless they are needed for longer to investigate a specific security incident or instance of abuse.

Hosting. Gleem is hosted externally. The personal data collected on Gleem is stored on the hosts' servers. This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact details, names, access data and other data generated through the platform. Hosting is carried out to perform our contracts with prospective and existing users (Art. 6(1)(b) GDPR) and in the interest of secure, fast and efficient provision of our service by professional providers (Art. 6(1)(f) GDPR). Our hosts process your data only to the extent necessary to fulfil their service obligations and follow our instructions regarding this data. We use the following hosts:

• OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (platform servers);
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (ingest servers for Gleem IRL, audience measurement under Section 14, our own mail server for the newsletter under Section 12);
• BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia (storage and delivery of media and downloads);
• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany (DNS and domain management);
• froxlor GmbH, Wilhelm-Busch-Straße 54, 60431 Frankfurt am Main, Germany (business email correspondence with partners and companies).

We have concluded data processing agreements (Art. 28 GDPR) with these hosts. They ensure that the hosts process our users' personal data only on our instructions and in compliance with the GDPR.

4. Registration and User Account

When you create a user account, we process the data received from Anikeen ID as part of sign-in (see Section 5) as well as any additional information you add yourself to your profile (e.g. a profile bio). We process this data to provide you with a user account and Gleem's features (Art. 6(1)(b) GDPR).

5. Sign-in via Anikeen ID and Connecting Twitch

You sign in to Gleem via Anikeen ID (OAuth), the central account service of the controller named in Section 1. You can also sign in to Anikeen ID with your Twitch account. Data processing at Anikeen ID is governed by Anikeen's privacy notice.

At every sign-in, we take your account identifier, your name, your email address with its verification status, and your profile picture from Anikeen ID into your Gleem account. You can change these details at Anikeen ID. We do not store any other account data transmitted in the process. At your first sign-in, we also check whether a Twitch account is connected to your Anikeen ID account, and use its user ID to find an existing Gleem account. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR).

If you already had a Gleem account before November 2026, we connected it to Anikeen ID. To do so, we matched your email address, your name and, where available, your Twitch user ID, and used them to create an Anikeen ID account if you did not have one yet. The legal basis is our legitimate interest in managing accounts in one place (Art. 6(1)(f) GDPR).

For Gleem's features on Twitch, such as channel point rewards, you can also connect your Twitch account to Gleem in the settings (OAuth). In doing so, we receive from Twitch the user ID provided by Twitch, your display name, and, if you grant the corresponding permission, the email address on file with your Twitch account and your profile picture, as well as the permissions you granted and the associated access tokens. The legal basis is performance of the user agreement (Art. 6(1)(b) GDPR). Twitch Interactive, Inc. processes your data on the Twitch platform as an independent controller; for details, please refer to Twitch's own privacy notice.

6. Payment Processing

Purchasing Gems via Twitch Bits takes place entirely through Twitch's infrastructure; we only receive a cryptographically signed confirmation of the completed Bits transaction, not any payment or card data.

For the direct purchase of Gems with fiat currency on gleem.gg, payments are processed by Stripe Payments Europe, Ltd. (Stripe Managed Payments). The merchant of record and legal seller of the Gems is Sold through Link, LLC, Stripe's consumer brand: Sold through Link, LLC powers the entire purchase experience, from checkout to customer support, and is responsible for complying with applicable sales tax and other sales-related regulations. Data transmitted to Stripe includes, in particular, your name, email address, and payment or billing details; the legal basis is performance of the purchase contract (Art. 6(1)(b) GDPR). Purchases appear as "Sold through Link" and as LINK.COM* GLEEM on your card statement, and receipts, invoices, and refund notifications are sent to you directly by Sold through Link, LLC. Stripe's own privacy notice applies in addition.

The same applies to purchases in the Gleem Store (e.g. "Fishing Pro"): Sold through Link, LLC is the merchant of record here as well. For each order we store the channel it was bought for, the buying account, the amount, the language, Stripe's references (checkout session, payment, receipt address) and when you agreed to immediate performance and to which wording (Art. 6(1)(b) and (c) GDPR, commercial and tax retention duties). To evaluate the store we count page views, started trials and purchases only as daily totals per product and language, with no link to any person.

For the identity verification (KYC) required to join the Gleem Partner Program, we use Stripe Payments Europe, Ltd. (Stripe Identity). Stripe processes the data necessary for verification, in particular the creator's name, identity document, and, where applicable, a selfie. The legal basis is performance of the contractual relationship with the creator (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR). Stripe's own privacy notice applies in addition.

We execute payouts to participating creators ourselves via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) or Wero. For this purpose, we transmit only the payout destination the creator has provided (their PayPal email address, or their Wero phone number or email address) and the payout amount to the respective payment service; the legal basis is performance of the contractual relationship with the creator (Art. 6(1)(b) GDPR). We store the payout destination in encrypted form.

As the operator of a digital platform, we are obliged under the German Platform Tax Transparency Act (PStTG, implementing the EU DAC7 directive) to report participating creators' income to the Federal Central Tax Office once a year. For this purpose we collect and store the creator's given and family name or company name, address, date of birth, tax identification number together with its issuing state, and where applicable their VAT identification number and commercial register number; what is reported additionally covers the remuneration paid per quarter, the number of transactions, the fees withheld, and the identifier of the payout account. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR). We store this data encrypted and for the statutory retention period; it is not used for any other purpose. We inform the creators concerned about the data reported about them.

7. Posting Signed Cards

When you claim a signed card we process the delivery address you give us: first and last name, street and house number, any additional line, postcode, town and country.

Purpose and legal basis. The processing serves only to post the card. The legal basis is Art. 6(1)(b) GDPR, which also applies where nothing is paid for the card, because it is the performance of a gratuitous contract.

Recipients. The address is passed to the postal company we use (Deutsche Post/DHL or a comparable carrier). For the delivery itself that company is a separate controller and not our processor.

Not passed to the creator. The creator whose card you claim does not receive your address. All they are told is that a card was ordered, which design, and whether it arrived.

Retention. Addresses in your address book are deleted as soon as you remove them or delete your account. The copy of the address attached to a card that was actually sent is kept for three years from the end of the year it was sent (the limitation period under §§ 195, 199 BGB) and deleted afterwards.

8. Developer API and Integrations

Creators can connect their own tools, for example for alerts, text-to-speech or chat bots, to Gleem through our Developer API. When you interact with a creator, we transmit to the tools that creator has chosen: your display name, your Gleem user ID and Twitch ID, the kind and extent of the interaction (e.g. Gems sent, Treats redeemed, memberships, follows, Trigger Tickets received), and any message, chosen GIF or Treat input you wrote.

Purpose and legal basis. The transmission lets the creator react to your interaction on their stream, for example with an on-screen alert or by reading your message aloud. You send these interactions to the creator and their stream on purpose. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest, and the creator's, is being able to show interactions on the stream.

Recipients. The recipients are the creator you interact with and the services they use for this. The creator chooses those services; they may be operated outside the European Union. The creator is responsible for the processing in those services. Creators can have messages filtered before they are transmitted; the creator's dashboard still shows the original text.

These services can include apps from other providers that the creator has connected to their account through our consent screen. The screen names the provider and links to its privacy policy. Where the provider processes the data on its own systems, it is also responsible for that processing. Once the creator disconnects the app, we no longer transmit any data to it.

Storage period. We keep the transmitted events and the records of their delivery for 30 days, so tools can catch up after an interruption and creators can redeliver them, and delete them afterwards. If you delete your account, we delete the events about you straight away.

9. Gleem Twitch Extension

Gleem offers a panel extension for Twitch ("Extension"), which creators can add to their channel. The Extension runs inside the Twitch website and apps; Twitch Interactive, Inc. is responsible for the processing that takes place on Twitch itself.

Identity link. The Extension only works once you allow it, in Twitch's own prompt, to see your Twitch identity. Before that, it does not send any requests to us. Once you allow it, Twitch passes us your Twitch user ID and the channel you are watching; we then retrieve your display name and Twitch login name from Twitch. We use these data to give you a Gleem account for the Extension and to provide its features (Art. 6(1)(b) GDPR). You can withdraw the identity link in your Twitch settings at any time. The Extension's files are delivered by Twitch; its requests for data go directly to our servers, so Section 3 (server log files) applies to them as well.

What we process. When you use the Extension, we process:

• your Gem balance and Gem transactions, including the confirmation Twitch sends us for each Bits transaction (transaction ID, product, amount, time); we never receive any payment data;
• the Treats you request, your queue entries, Trigger Tickets, tips and unlocked posts;
• any text you enter, such as a tip message or a Treat input.

The legal basis is Art. 6(1)(b) GDPR. The creator of the channel sees your display name and your interactions with them, including your messages. Section 8 applies to transmission to the creator's tools. The Extension's leaderboard shows your display name and Gem total to other viewers of the same channel.

No tracking. The Extension contains no analytics or advertising tools, sets no cookies and stores nothing on your device. For GIFs, see Section 10.

Storage period. Section 17 applies. Records of Bits and Gem transactions are kept for as long as commercial and tax law requires.

10. GIFs from KLIPY

On gleem.gg and in the Extension you can add a GIF to your Gems. The GIFs come from KLIPY, a service of Kikliko, Inc. When you search for a GIF, the search runs through our servers; KLIPY receives only the search term, not who searched. The GIF previews and the GIF you send are then loaded directly from KLIPY's servers, which therefore see your IP address, as with any embedded image. Kikliko, Inc. is based in the United States, so your IP address may be processed there.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is offering GIFs in messages. KLIPY's own privacy notice applies in addition.

11. Discord

You can connect your Discord account to your Gleem account. Discord is provided by Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. When you connect, you sign in to Discord and allow us to read your Discord profile and add you to a Discord server (the "identify" and "guilds.join" permissions).

What we store. Your Discord ID, your Discord username, display name and avatar, and the access tokens Discord issues to us for your account. We store the tokens encrypted and use them only to add you to the Discord server.

Betas. Taking part in our betas (such as Gleem IRL Sidekick, Signed Cards or OBS Server Hosting) requires a connected Discord account, because beta support and feedback happen on our Discord server. Our bot adds you to the Gleem Discord server, gives you the roles of the betas you take part in, removes them when your participation ends, and may send you direct messages about your application. For this we send Discord your Discord ID, the roles and the content of those messages. We also use the bot to check whether you are still a member of the server. The legal basis is the performance of the contract for taking part in the beta (Art. 6(1)(b) GDPR).

Transfer to the USA. Discord processes the data in the USA. Discord Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Discord is independently responsible for processing on the Discord platform itself; Discord's own privacy policy applies in addition.

Disconnecting and storage period. You can disconnect Discord at any time under "Connections" in your settings. We then delete the stored Discord data and tokens, revoke the tokens at Discord, and remove the beta roles on our server unless another Gleem account connected to the same Discord account still needs them. Your access to betas that require Discord is paused until you connect Discord again. You leave the Discord server itself in Discord. Unless you disconnect, we keep the data for as long as your Gleem account exists.

12. Newsletter

At gleem.gg/newsletter you can voluntarily subscribe to our newsletter. It brings occasional product news, new features, tips for creators and related offers from Gleem. The controller is the provider named in Section 1. Subscribing is not a condition for using Gleem or the Gleem Twitch Extension.

Double opt-in. After you sign up, we send you an email with a confirmation link. Your subscription only becomes active once you open that link and confirm. This makes sure nobody can sign up someone else's email address. The link works only once and only for a limited time; without confirmation you will not receive any newsletters.

What data we process. Your email address, the language used when signing up, the wording and version of the consent statement you agreed to, and the times of your signup, of sending the confirmation email, of your confirmation and, where applicable, of your unsubscribing. We do not store an IP address or a browser/user-agent string for the newsletter. Only the general, short-lived server log files described in Section 3 apply; to prevent abuse, we also count signup attempts briefly in a cache that expires automatically.

Purposes and legal bases. We send the newsletter on the basis of your consent (Art. 6(1)(a) GDPR in conjunction with Section 7(2) No. 2 of the German Act Against Unfair Competition, UWG). We keep the signup and confirmation records to be able to demonstrate that you consented (Art. 7(1) GDPR); the legal basis for this is Art. 6(1)(c) GDPR and our legitimate interest in being able to prove consent (Art. 6(1)(f) GDPR).

Delivery and recipients. We send the newsletter through our own mail server, hosted by Hetzner Online GmbH (see Section 3), and do not use an external newsletter service provider. No data is transferred to third countries. We do not measure whether you open an email or click the links in it.

Unsubscribing and objection. You can withdraw your consent at any time with effect for the future, without signing in or giving a reason: via the unsubscribe link in every newsletter email or, where your email program supports it, with one click on its unsubscribe function. Unsubscribing takes effect immediately. Withdrawal does not affect the lawfulness of processing carried out before it. You may also object at any time to the processing of your data for direct marketing purposes (Art. 21(2) and (3) GDPR).

Storage period. If a signup is not confirmed, we delete it completely 30 days after the signup. For an active subscription, we keep the data for as long as you are subscribed. After you unsubscribe, we keep your email address with the time of unsubscribing on a suppression list so that you are not accidentally added to the list again; subscribing again requires a new signup and confirmation. We keep the evidence of your earlier consent (wording, version and the times of signup and confirmation) until three years after the end of the year in which you unsubscribed, and delete it afterwards.

13. Cookies and Local Storage

We use only strictly necessary cookies and local storage:

• a session cookie to keep you signed in (Art. 6(1)(b), (f) GDPR);
• a cookie and a local storage entry in your browser to remember your appearance setting (light/dark), Art. 6(1)(f) GDPR;
• a cookie to remember your language selection within the legal area, Art. 6(1)(f) GDPR;
• a cookie (30-day lifetime) to remember your age confirmation on pages carrying content for ages 18 and over. It records only that a confirmation was given; no date of birth or other age data is collected or stored. The legal bases are Art. 6(1)(c) GDPR in conjunction with § 5 JMStV, and Art. 6(1)(f) GDPR.

We do not use any advertising cookies. The audience measurement described in Section 14 works entirely without cookies and without storing any other information on your device. Because only strictly necessary cookies are therefore used, no consent is required for them. Should we use analytics, tracking, or advertising cookies in the future, we will update this Privacy Policy accordingly and, where required, obtain your consent in advance.

14. Audience Measurement with Matomo

We use Matomo, an open-source audience measurement software, to analyse the use of our platform statistically. We host Matomo ourselves on our own infrastructure at stats.anikeen.com; the data collected is neither passed on to third parties nor processed outside the European Union.

We run Matomo cookie-free: no cookies are set and no other information is stored on or read from your device. Your IP address is truncated (anonymised) before it is stored, so that it cannot be attributed to you. The data processed comprises in particular the page requested, the previously visited page (referrer), the date and time of the request, the browser and operating system used, the screen resolution, and the approximate region derived from the truncated IP address.

The legal basis is our legitimate interest in designing our platform to meet demand and in evaluating its use statistically (Art. 6(1)(f) GDPR). As the processing takes place without accessing your device and without personal identifiers, no consent is required.

Matomo respects your browser's "Do Not Track" setting: if it is enabled, no audience measurement takes place. Irrespective of this, you may object to the processing at any time under Art. 21 GDPR; an informal message to the contact address given in section 1 is sufficient.

15. Your Rights as a Data Subject

As a data subject, you have the following rights:

• the right of access (Art. 15 GDPR);
• the right to rectification (Art. 16 GDPR);
• the right to erasure (Art. 17 GDPR);
• the right to restriction of processing (Art. 18 GDPR);
• the right to data portability (Art. 20 GDPR);
• the right to object to processing (Art. 21 GDPR);
• the right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR), without affecting the lawfulness of processing carried out before the withdrawal.

Access is provided free of charge. To exercise these rights, an informal message to the contact address given in Section 1 is sufficient.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

WHERE PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE LEGAL BASIS FOR EACH PROCESSING OPERATION IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21(2) GDPR).

16. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data-protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). The competent authority at the provider's seat is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW, the data protection authority of the German state of North Rhine-Westphalia), or the supervisory authority at your place of residence or habitual abode.

17. Storage Period

We store personal data only for as long as necessary for the purposes described in this Privacy Policy, or for as long as we are required to by statutory retention obligations (e.g. commercial and tax-law retention periods of up to ten years for payment-related records). We store account-related data for the duration the user account exists; after an account is deleted, its data is deleted or anonymized unless a statutory retention obligation requires otherwise. If you make a justified request for erasure or withdraw your consent to processing, your data will be deleted unless we have other legally permissible grounds for storing it (e.g. retention periods under tax or commercial law); in that case it is deleted once those grounds cease to apply.

18. Stream Assistant Lumi (Anthropic)

Creators whose channel we have enabled for the Stream Assistant Lumi can ask questions about their channel in the dashboard, get a summary of their chat during a stream and receive a recap afterwards. To generate the answers we use AI models from Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA (“Anthropic”) as a processor.

Data processed. The following is sent to Anthropic:

• in a chat with Lumi: the questions and the conversation so far, the asking member's name and role, the channel's name, and the channel data Lumi looks up to answer (e.g. stream status, statistics, queue, posts, widgets, media, IRL and hosting status);
• when the channel owner asks, and automatically for the live view and the recap: viewers' chat messages from the stream (display name, role such as moderator, VIP or subscriber, time and message text), as well as tips (name, number of Gems and message) and Treat inputs in the queue.

The live summary only runs while an authorised member has the live view open. The recap is created automatically after a stream of at least five minutes ends, unless the channel owner has turned it off in Lumi. Under its commercial terms, Anthropic does not use the data sent to it to train its models.

Legal basis. For data of the creator and their team, the legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). For viewers' data, the legal basis is our and the creator's legitimate interest in being able to follow and evaluate public chat messages and tips in their own channel (Art. 6(1)(f) GDPR). You may object to this processing under Art. 21 GDPR.

Transfer to third countries. Anthropic processes the data in the USA. The transfer is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement with Anthropic.

Storage period. We delete conversations with Lumi, including the data looked up in them, 90 days after the last message; members can delete a conversation themselves at any time. We delete live-view cards one day after they expire. We delete recaps 90 days after they are created, and usage records (time, model, volume and cost, without content) after 13 months. Storage at Anthropic is governed by its terms.

19. Changes to This Privacy Policy

We may update this Privacy Policy to the extent necessary due to changed legal requirements or changes to the services and data processing we offer. The version available at the time of your visit applies.