Privacy Policy
Effective date: March 29, 2026
Data Controller: Sibelius EOOD
Registered Address: General Kartsov 86, Karlovo, 4300, Plovdiv, Bulgaria
Contact Email: [email protected]
1. Introduction
At OAcast, we respect your privacy. This policy explains how we collect and use your data when you use our platform, whether as a Content Creator or as a Subscriber.
Under the General Data Protection Regulation (GDPR), we act as the Data Controller for our Creators' account information, and as a Data Processor for the data of the Subscribers who use our Creators' customized websites.
2. The Data We Collect
We believe in data minimization. We only collect the following:
- Identity Data: Full Name.
- Contact Data: Email Address.
- Authentication Data: Encrypted passwords and session tokens.
- Payment Metadata: We do not store credit card numbers. All payment data is handled securely by our partner, Stripe. We only receive confirmation of payment and the last 4 digits of the card for support purposes.
Our marketing website stores no cookies and collects no personal data unless you submit a form (demo request, contact, or newsletter) — those submissions are delivered to us as email and are not stored in a website database. Our Platform (the app) collects the following directly from you to fulfill our contract:
- Account Information: Name and Email Address used for authentication and service notifications.
- Service Data: Information regarding your subscription status and transaction history to ensure you can access the content you've paid for.
- Log Data: IP addresses and device identifiers, which we process for security purposes and to comply with EU anti-fraud regulations.
3. How We Use Your Data
We process your data based on the following legal grounds:
- Contractual Necessity (Art. 6.1.b GDPR): To create your account, manage your custom domain, and provide access to videos/live streams.
- Consent (Art. 6.1.a GDPR): For optional communications you sign up for, such as our newsletter.
- Legal Obligation: For tax reporting and compliance with the EU Digital Services Act (DSA).
4. Cookies & Tracking Technologies
Our marketing website (oacast.com) sets no cookies and loads no third-party analytics or tracking scripts. There is no cookie banner because there is nothing to consent to.
The OAcast Platform (the application you sign in to) uses only strictly necessary cookies:
| Cookie Type | Purpose | Legal Basis |
|---|---|---|
| Authentication (httpOnly) | Keeps you signed in securely; expires and rotates automatically | Strictly necessary (Art. 6.1.b GDPR) |
We use no advertising cookies, no cross-site tracking, and no third-party analytics on either property.
5. Third-Party Data Sharing
We do not sell your data. We only share data with service providers necessary to run the platform:
- Stripe: For payment processing and KYC (Know Your Customer) verification.
- Cloud Infrastructure Providers: For secure data storage within the EU.
6. Data Transfers
All personal data is stored on servers located within the European Economic Area (EEA). If we transfer data outside the EEA (e.g., to a US-based sub-processor), we ensure "Standard Contractual Clauses" (SCCs) are in place to protect your rights.
7. Your Rights
Under the GDPR, you have the following rights:
- Access: Request a copy of your data.
- Correction: Ask us to fix inaccurate info.
- Erasure ("Right to be Forgotten"): Request we delete your account and data.
- Data Portability: Request your data in a structured, machine-readable format.
- Withdraw Consent: Email [email protected] at any time to withdraw consent to any communication you've signed up for.
- Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority. For Bulgaria, this is the Commission for Personal Data Protection (CPDP) at www.cpdp.bg.
8. Data Retention
We keep your data only as long as your account is active. If you delete your account, we scrub your personal data within 30 days, except where we are legally required to keep it for tax/accounting purposes (usually 5–10 years depending on local law).
9. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised effective date. Where required by law, we will seek your consent to any changes that affect how your personal data is processed.