Privacy Policy

Last updated: June 3, 2026

1. Who We Are

DurianLive ("we", "us") provides a live streaming infrastructure service for independent merchants ("Merchants"). We are a B2B service provider — we do not have a direct business relationship with end viewers who visit Merchant websites. This Privacy Policy explains how we collect, use, and protect information when Merchants use our platform and website.

Important note: DurianLive is a tool for Merchants. Merchants are solely responsible for their own privacy policies, terms of service, and compliance obligations with respect to their own customers and viewers. We process viewer data solely on behalf of and under the instructions of the Merchant.

2. Information We Collect

2.1 Merchant Account Information

When you register for a DurianLive account, we collect:

Your name, email address, and store URL
Your shop name and domain
Account credentials (hashed password)
Payment information (processed securely by Paddle, our Merchant of Record — we never store full card numbers)

2.2 Viewer Analytics Data

When a Merchant embeds the DurianLive widget on their website, we automatically collect anonymized analytics about viewers for the Merchant's internal reporting:

Connection timestamps (join/leave times)
Geographic region (country-level, derived from IP address)
Device type and browser user agent
Connection performance metrics (anonymized)
Chat messages sent during live streams

2.3 Technical Data

IP address (used transiently for routing and rate-limiting, not stored long-term)
Server logs (request timestamps, endpoints)
Cookies — we use a minimal session cookie for Merchant dashboard authentication only. We do not use tracking cookies or third-party analytics cookies.

3. How We Use Your Information

To provide and maintain the Service (stream routing, widget delivery, analytics reporting to Merchants)
To process payments and manage subscriptions
To send service-related communications (payment receipts, renewal notices, service updates)
To improve the Service (aggregated, anonymized usage patterns)
To detect and prevent abuse, fraud, or violations of our Terms of Service

We do not sell personal data to third parties. We do not use viewer data for advertising or profiling.

4. Data Sharing & Third Parties

We share data only with essential service providers who enable our Service:

Paddle (Merchant of Record) — Payment processing, tax compliance, and invoicing. Payment data is handled under Paddle's privacy policy. We never receive or store full card numbers.
Cloud infrastructure providers — Hosting, content delivery, and streaming infrastructure. Data resides in US/EU data centers.
Streaming infrastructure provider — Video routing and delivery. Stream data is transient and not stored long-term unless recording is enabled by the Merchant.

We do not disclose the specific technologies or architecture used to deliver the Service, as these constitute proprietary business methods. We may disclose information if required by law or to protect our legal rights.

5. Data Processor Status

With respect to viewer data collected through the DurianLive widget on Merchant websites, DurianLive acts as a data processor. The Merchant is the data controller. This means:

The Merchant determines what data to collect and how to use it
DurianLive processes data only on the Merchant's behalf and according to their instructions
The Merchant is responsible for obtaining any necessary consents from their viewers
The Merchant is responsible for their own privacy policy and compliance

6. Data Retention

Merchant account data: Retained for as long as your account is active, plus 90 days after account deletion for recovery purposes.
Viewer analytics: Retained for 12 months, then anonymized or deleted.
Chat messages: Retained for 30 days, then aggregated into anonymized statistics.
Stream recordings: Retained for 90 days after recording, then deleted unless downloaded by the merchant.

7. Data Security

We implement industry-standard security measures:

All data transmitted via HTTPS/TLS encryption
API keys and passwords stored using strong hashing (PBKDF2)
All real-time connections are encrypted
Regular security reviews and updates

No method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access — Request a copy of the personal data we hold about you
Rectification — Request correction of inaccurate data
Deletion — Request deletion of your account and associated data
Data portability — Request export of your data in a machine-readable format
Object / restrict processing — Object to certain data uses

To exercise any of these rights, contact us at privacy@durianlive.com. We will respond within 30 days.

9. GDPR (EU/EEA Users)

If you are located in the European Economic Area, we process your personal data based on one or more of the following legal grounds:

Contract performance — Processing necessary to provide the Service to you
Legitimate interests — Analytics, fraud prevention, service improvement
Consent — Where consent is required, you may withdraw it at any time

You have the right to lodge a complaint with your local data protection authority.

10. Cookies

We use a minimal number of cookies solely for operational purposes:

Session cookie — Required for merchant dashboard authentication. Expires when you log out.

We do not use advertising, tracking, or analytics cookies on our website or widget. The DurianLive widget does not set cookies on your viewers' browsers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or dashboard notice. Continued use of the Service after changes take effect constitutes acceptance.

12. Contact

For privacy-related inquiries:
Email: privacy@durianlive.com
Or use our general contact: support@durianlive.com