Privacy Policy

1. Who we are

KOLāZ Broadcast is a broadcast playout and live-relay service operated by Alexander Roumeliotis, Greece (“KOLāZ”, “we”). Contact for anything in this policy: hello@broadcast.kolaz.tv.

2. Who this policy covers

Our clients (TV channels, organisations and individuals who use KOLāZ Broadcast or KOLāZ Relay), their staff who sign in to our client pages, and anyone who contacts us.

3. What we collect and why

1. Client account and billing details — name or company name, VAT number, billing address, contact names, e-mail addresses and phone numbers, the services you have, their prices, and the payments we record. Used to provide the service, invoice it, and tell you about it (e.g. a service starting or ending, a payment due). Legal basis: performance of our contract with you, and our legal obligations (accounting and tax).
2. Service data — the programmes and streams you send us, your stream keys, the destinations you stream to, and technical logs of our servers. Used only to run the service and fix faults. Legal basis: performance of the contract.
3. Sign-in data — a password you are given (we keep only a scrambled form of it) and a session cookie that keeps you signed in. Legal basis: performance of the contract.
4. YouTube data — see section 4.

We do not sell personal data, use it for advertising, or use it to train artificial-intelligence or machine-learning models.

4. YouTube and Google user data

If you choose to connect your YouTube channel, you authorise KOLāZ Broadcast through Google's sign-in, with the YouTube permission “Manage your YouTube account” (https://www.googleapis.com/auth/youtube).

What we access: your channel's live broadcasts (their identifiers, titles, status and schedule) and your live streams (their identifiers, status and ingestion settings). We do not access your videos, comments, playlists, subscriptions, analytics or any other part of your Google Account.

How we use it: only to keep your channel live. Our server checks whether your channel is live on YouTube; if YouTube has ended your broadcast after an interruption, it creates a new broadcast, binds it to the stream key you already use, and starts it. It does nothing else with your account.

What we keep: the authorisation (an OAuth refresh token) and the identifiers and status of broadcasts our server created, stored on our own servers in Greece, accessible only to KOLāZ technical staff.

With whom we share it: we do not sell, rent or give Google user data to anyone. It is disclosed only to:

• KOLāZ staff, through our internal alerts, which are delivered with Telegram (Telegram Messenger): whether your channel is live on YouTube, and the link to a broadcast our server created.
• Cloudflare, Inc., which carries the connection to your client page, where your channel's YouTube status is shown to you.
• Authorities, if the law requires it.

How long: until you disconnect YouTube or your service ends. When either happens, the authorisation is deleted from our servers and revoked at Google, and the broadcast records are deleted within 30 days.

How to stop it: press Disconnect on your client page (Stream → YouTube), or remove KOLāZ Broadcast's access yourself at any time at https://myaccount.google.com/permissions.

KOLāZ Broadcast's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. YouTube data is also subject to YouTube's Terms of Service and Google's Privacy Policy.

5. Service providers we use

Each only for the purpose shown, under its own data-protection terms:

• Telegram (Telegram Messenger) — our staff's internal alerts about the service.
• Cloudflare, Inc. — the secure connection to our client pages.
• Mailjet (Sinch Mailjet SAS, France) — e-mails we send you about your services.
• Vercel Inc. — hosting of our public websites.
• Google LLC — the YouTube connection described in section 4, only if you choose it.
• Better Stack — monitoring of whether our service is up (no personal data of clients).

Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep data

Account and service data: for as long as you are a client, and then as long as the law requires for accounting (normally up to 10 years for invoices and payment records under Greek law). Server logs: up to 90 days. YouTube data: as in section 4.

7. Your rights

Under the GDPR you may ask for access to, correction of, deletion of, or a copy of your personal data; object to or restrict its processing; and withdraw a consent at any time. Write to hello@broadcast.kolaz.tv; we answer within one month. You may also complain to the Hellenic Data Protection Authority.

8. Security

Our servers are on KOLāZ premises in Greece, reached from outside only through encrypted connections. Passwords are stored only in scrambled (hashed) form; access to our systems is limited to KOLāZ technical staff.

9. Changes

If this policy changes, the new version is published on this page with its date; clients are told of important changes by e-mail.