Privacy policy

Under Regulation (EU) 2016/679 (GDPR) the data controller is Core Matrix s.r.l., Viale Monza 347, 20126 Milano (MI), Italia, VAT no. IT14316370965, certified email corematrix@pec.it. For any privacy request write to support@streamable.bz.

1. What data we process

• Account: name, email, password (stored only in hashed form by Firebase Authentication) or your Google profile if you sign in with Google.
• Content: uploaded videos, converted versions, thumbnails and metadata (title, description, length, resolution).
• Billing: name or company name, tax code or VAT number, address, certified email or SDI code, payment history. Card and IBAN details are handled directly by Stripe and never reach us.
• Team (Business plan): the list of account members and active invites.
• Viewing statistics: for viewers of videos we record aggregated data (plays per hour, seconds watched, points of the video reached, country, device type and browser, referring site, quality). To count unique viewers we compute a non-reversible fingerprint of IP address and user agent with a key that changes every day: we do not store the IP and the same person cannot be linked across days.
• Technical data: IP address and request logs, for security and abuse prevention.

2. Purposes and legal bases

• Providing the Service, managing your account and team, sending service emails (verification, password reset, subscription notices): performance of a contract (Art. 6(1)(b)).
• Invoicing, tax and accounting obligations, responding to authorities: legal obligation (Art. 6(1)(c)).
• Viewing statistics for the video owner, security, fraud and abuse prevention, handling notices: legitimate interest (Art. 6(1)(f)), with minimised data and no profiling.

We do not sell data, do no advertising profiling and do not use content to train artificial intelligence models.

3. Cookies

We only use strictly necessary cookies: __session (sign-in session, up to 14 days) and lang (preferred language, 12 months). The player and the statistics use no cookies and store no identifiers in the browser, so no consent banner is needed.

4. Where data is kept and who processes it for us

Data is stored in the European Union. We use these providers, appointed as processors or acting as independent controllers:

• Google Cloud / Firebase (Google Ireland Ltd.): application, database (Milan), authentication, video conversion.
• Cloudflare (Cloudflare Inc. and affiliates): video storage on EU-jurisdiction storage, video delivery, aggregated statistics.
• Stripe Payments Europe Ltd. (Ireland): payments, as independent controller for payment data.
• TeamSystem S.p.A. – Fatture in Cloud (Italy): electronic invoicing.
• Brevo (Sendinblue SAS, France): service emails.

Some of these providers belong to groups based outside the EU: any transfers rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. How long

• Account and videos: while the account is active; after closure content is deleted within 30 days.
• Invoices and accounting data: 10 years, as required by law.
• Daily viewer fingerprints: 400 days; aggregated statistics: up to 800 days.
• Technical logs: up to 90 days, unless needed to investigate abuse.

6. Your rights

You can request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interest by writing to support@streamable.bz. We reply within one month. You may lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority in your country.

7. Children

The Service is only for people aged 16 or over.

8. Changes

We update this policy when our processing changes; material changes are notified by email.