Stažení
CS

Privacy Policy

Note: The legally binding version of this Privacy Policy is the German text. This English translation is provided for convenience only. In the event of any discrepancy, the German version prevails. German law (GDPR / DSGVO, TDDDG) applies.

Controller

The controller responsible for data processing on this website is:
stillstudio
Weilburger Straße 27
60326Frankfurt am Main
E-mail: info@fast-iptv.stream

General information

We process personal data only to the extent necessary to provide a functional website and service. Legal bases are Art. 6(1) GDPR and, where terminal equipment is accessed, § 25 TDDDG. This website uses no marketing cookies and no profiling. Analytics are only activated if you have given your prior explicit consent (see below).

The service: data minimisation as a core principle

Our media/playlist player deliberately requires no user account and no name or e-mail address to use the app itself. Instead, a licence is bound to an internally derived device identifier:

Website session (technically necessary cookie)

After you enter your device code we set a single, technically necessary session cookie (website_device_session) used solely for authentication during playlist management (max. 15 minutes, HttpOnly, not readable via JavaScript). This cookie does not require consent under § 25(2)(2) TDDDG as it is necessary to provide the function you explicitly requested (playlist management). The legal basis for the related processing is Art. 6(1)(b) GDPR.

Analytics (PostHog, only with your consent)

If you consent via the consent banner, we measure use of this website with PostHog. For EU users the provider is PostHog BV, Netherlands; data are processed on the EU instance (eu.i.posthog.com). A data processing agreement under Art. 28 GDPR is in place with the provider. PostHog is only loaded after you give consent — if you decline or make no choice, no third-party script is executed and no cookie is set.

Data collected: pages visited, timestamp, approximate origin (derived from IP address), browser and device information, and a random identifier in a cookie grouping your visits into a session. Deliberately NOT collected:

The legal basis for accessing your terminal equipment is your consent under § 25(1) TDDDG; for subsequent processing it is Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future: “Change consent” in the footer brings the prompt back, and one click on “Decline” stops measurement immediately and discards the identifier assigned to you. Withdrawing is therefore just as easy as consenting.

Hosting

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Pages). When you access the website, Cloudflare processes technically necessary connection data (IP address, date and time of access, page requested, User-Agent) to deliver the website and protect it from attacks. Legal basis: our legitimate interest in secure and performant operation (Art. 6(1)(f) GDPR). A data-processing agreement (Art. 28 GDPR) is in place. Cloudflare is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses additionally apply as a transfer safeguard. Further information: cloudflare.com/privacypolicy.

Database and back-end service

For device registration, licence checking and encrypted playlist storage we use Supabase, operated in an EU data centre (region: Frankfurt am Main, Deutschland (AWS eu-central-1)). Provider: Supabase, Inc. A data-processing agreement (Art. 28 GDPR) is in place; Standard Contractual Clauses additionally cover any transfers to third countries. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Payment processing (Stripe)

For licence purchases we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The payment process takes place on a Stripe-hosted page (Stripe Checkout); you leave our website during this step.

What we send to Stripe: solely an internal purchase reference, the amount and the currency. We do not transmit your device code, name, address or e-mail address — we do not hold these.

Invoice and contract confirmation: on the payment page you provide an email address to Stripe. Stripe then creates an invoice and sends it to that address; it also carries the statutory confirmation of the contract including your consent to immediate provision (§ 312f(3) German Civil Code). That email address is not passed on to us and is not stored by us.

What we receive back from Stripe: the payment identifier, amount paid with currency, payment timestamp, and — where determined by Stripe — the country code. We need the country code for tax allocation. No tax amount arises as no VAT is charged under § 19 German VAT Act. Payment data such as card numbers never reach us.

Stripe processes the payment data (card or account details) under its own responsibility. Stripe's privacy policy applies: stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (performance of the purchase contract) and for the retention of transaction data Art. 6(1)(c) GDPR in conjunction with statutory retention obligations under commercial and tax law.

Contact form

If you write to us via the contact form, we store your e-mail address, your message and - if you provide it - your device code in order to answer the enquiry. The device code is optional; without it, however, we can assign device-related questions less easily. We do not store your IP address; it is only used as a checksum for an abuse-prevention limit.

The legal basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), and additionally Art. 6(1)(b) GDPR for enquiries concerning an existing contract. Contact enquiries are deleted automatically after 90 days unless a statutory retention obligation applies.

So that an enquiry does not go unnoticed, we send ourselves a notification via Resend (provider details below). It contains only a reference number and the time of receipt - neither your address nor your message text. No personal data relating to your enquiry is therefore transmitted to the mail provider; whoever handles the enquiry opens it in our database.

Withdrawal and e-mail dispatch (Resend)

If you declare a withdrawal at the withdrawal page, we store the timestamp, a reference number and the link to your device. Name, e-mail address and any note are voluntary — your withdrawal is valid without them.

If you provide an e-mail address, we send you the legally required confirmation of receipt (§ 356a(3) German Civil Code). For dispatch we use Resend (Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA). We transmit only your e-mail address plus the reference number and timestamp — not your name and not your note. The internal notification to us also contains only the reference number; anyone processing the case looks up the details in our database, not in an e-mail.

Legal basis for dispatch: Art. 6(1)(c) GDPR (compliance with § 356a(3) German Civil Code). If you provide no address, no dispatch takes place and no data are transmitted to Resend. Storage of the withdrawal declaration itself is based on Art. 6(1)(c) GDPR in conjunction with statutory retention obligations.

Note: Resend is based in the USA, making this a third-country transfer. A data processing agreement under Art. 28 GDPR is in place with the provider, including the European Commission's Standard Contractual Clauses as the transfer safeguard (Art. 46(2)(c) GDPR).

Encryption

This website uses TLS encryption for security reasons (indicated by "https://" and the padlock symbol in your browser's address bar).

Retention periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations. Deleted playlists are permanently deleted after a 48-hour recovery window.

Your rights

You have the following rights regarding your personal data:

Consent given may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, https://datenschutz.hessen.de.

As of: September 2026