Data protection

Privacy Policy for elPortalO

Courtesy translation. This English version is provided for convenience. The German version (Datenschutzerklärung) is the legally binding version.

This privacy policy informs you transparently about which personal data is processed when using the elPortalO mobile app (iOS & Android), the website, the coin shop, the live streaming services, community functions and support offers.

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) and the German Digital Services Act (DDG) is:

Soyer GbR
Full address and contact details are in the legal notice: www.elportalo.com/en/legal-notice

Contact for data protection, deletion and support requests:
info@elportalo.com

2. Scope & app store compliance

This privacy policy applies to the use of all services of the elPortalO platform (app for iOS/Android, website, coin shop, live streams, video chat, interactive wallet functions and customer support).

It meets the legal requirements of the GDPR as well as the guidelines for app developers of Google Play (Data Safety section) and the Apple App Store (App Privacy Guidelines / Guideline 5.1.1).

3. Categories of data collected

Depending on which functions you use in the elPortalO app or on the website, we process the following data:

  • Account & registration data: username, UniqueID, email address, phone number, chosen login method (Google, Apple Sign-In, email/password) and technical authentication tokens.
  • Profile information: profile pictures, date of birth, gender, bio, status information, hobbies and information provided voluntarily.
  • Communication & interaction data: chat messages (text, audio), live stream comments, support tickets, moderation reports and group interactions.
  • Live stream & media data: audio and video data during active live streams, technical connection parameters and activity logs for stream hosts and viewers.
  • Wallet, coin & transaction data: balances (coins, diamonds), gifts sent and received, purchase history via in-app purchases or the elPortalO coin shop, transaction IDs, payout requests and billing status.
  • Verification data: proof of identity (ID documents, selfies) for verified roles (e.g. streamers, agencies, coin dealers) or payout reviews.
  • Device & technical log data: IP address, device ID, app version, operating system, language settings, crash reports (crash logs) and FCM push notification tokens.

4. Registration, login & authentication

To use elPortalO, creating a user account is required. Authentication takes place over secure connections:

  • Google Sign-In / Apple Sign-In: only the data required for authentication (e.g. user ID, email address, token) of the respective provider is processed. With Apple Sign-In we support anonymised email forwarding ("Hide My Email").
  • SMS / phone number login: the phone number is processed solely to verify and secure your access.
  • Email & password: the email address and securely hashed passwords are processed for account management.

5. Purposes of data processing

We process your data exclusively for the following purposes:

  • Providing and operating the app functions, live streams and video chats.
  • Secure account management and protection against fake profiles.
  • Handling coin purchases, gifts, rewards (diamonds) and payouts.
  • Ensuring network security, fraud prevention and enforcement of our community guidelines.
  • Verification of users, moderators, agencies and coin dealers.
  • Sending important system and security push notifications.
  • Fulfilling legal, tax and accounting retention obligations.

6. Legal bases of processing (GDPR)

Personal data is processed on the basis of the following provisions of the GDPR:

  • Art. 6(1)(b) GDPR (performance of a contract): to provide the app, carry out use and handle digital transactions.
  • Art. 6(1)(c) GDPR (legal obligation): to meet tax and commercial law requirements.
  • Art. 6(1)(f) GDPR (legitimate interest): to ensure IT security, platform moderation, fraud prevention and technical system stability.
  • Art. 6(1)(a) GDPR (consent): where explicit consent has been obtained (e.g. for certain camera/microphone permissions or optional profile information).

7. Infrastructure, SDKs & third-party providers used

To provide the real-time services and the app function, we use specialised service providers and SDKs:

  • LiveKit Cloud / LiveKit Infrastructure: for transmitting real-time video and audio streams in live streams and video chats. LiveKit processes the IP address and technical stream connection parameters to provide the video connection.
  • Google Firebase Services: uses Firebase Authentication (sign-in), Firebase Cloud Messaging (FCM for push notifications) and Crashlytics (to detect and fix app crashes).
  • Payment service providers & WooCommerce: for purchases through the web coin shop, WooCommerce and the integrated payment providers (e.g. Stripe, PayPal) process transaction and billing data. For in-app purchases, Apple or Google process the payment information directly through their system.

Note for Google Play & Apple App Store: all SDKs named above are limited to the functional minimum and serve to provide the app's basic functions, security and performance.

8. Identity verification (ID & selfie)

For extended functions — in particular for active streamers, agencies, coin dealers or before payouts of balances are carried out — proof of identity is required.

  • The processing serves to protect against money laundering, identity theft and abuse.
  • ID documents and verification selfies submitted are treated strictly confidentially and processed solely for review processes and statutory retention reasons.

9. Moderation, security & AI systems

To ensure a safe space in live streams and chats, we use automated review mechanisms and moderation systems:

  • Content, chats and media can be checked for violations of applicable law, hate speech, harassment or explicit content.
  • In the case of serious violations of the community guidelines, we reserve the right to ban accounts temporarily or permanently in order to protect users.

10. International data transfers

Our core servers are located in data centres protected under the GDPR within the European Union (EU). Where external infrastructure services (such as Google Firebase or LiveKit) process data in third countries (such as the USA), this takes place on the basis of the EU Commission's standard contractual clauses or existing adequacy decisions.

11. Storage period & deletion periods

We process data only as long as the respective purpose requires or statutory requirements (e.g. 10-year tax retention obligations for payment records) prescribe.

  • Profile data is stored while the account is actively used.
  • After account deletion, personal data is irrevocably deleted or anonymised within the statutory periods.

12. Your data subject rights (GDPR)

You have the following statutory rights under the GDPR:

  • Access (Art. 15 GDPR): right to information about your data processed by us.
  • Rectification (Art. 16 GDPR): right to correction of inaccurate data.
  • Erasure (Art. 17 GDPR): right to deletion of your account and personal data ("right to be forgotten").
  • Restriction (Art. 18 GDPR) & data portability (Art. 20 GDPR).
  • Objection (Art. 21 GDPR): right to object to processing based on legitimate interests.
  • Right to complain: you have the right to lodge a complaint with a competent data protection supervisory authority.

13. Account deletion & data deletion (App Store Policy 5.1.1)

In line with the guidelines of Apple and Google, you have the right to delete your user account and all linked personal data completely at any time. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

You can delete your account directly in the elPortalO app under [Profile → Settings → Delete account] or request a manual deletion through our support team: request account & data deletion.

Important note: after deletion, your profile data, coin balance and chat histories are permanently removed. Excluded from this is data we are legally obliged to retain.

14. Youth protection & age restriction

The elPortalO app strictly follows the age ratings of the app stores. Use of active functions such as starting live streams is expressly permitted only from age 18. Accounts of minors who give false age information are banned immediately.

15. Consent and consent management

When you visit our website, information is stored on and read from your device. Technically necessary storage processes that are strictly required for operating the website, the coin shop, logins and user security take place on the basis of Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

All storage processes beyond this — in particular for audience measurement and image delivery — require your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. We obtain this consent through our consent banner. You can change or withdraw your selection at any time through the link to the privacy settings in the footer. Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out until then.

Your consent decision is logged for evidence purposes (Art. 7(1) GDPR).

16. Audience measurement with Google Analytics 4

We use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service helps us understand how our website is used, which pages are visited and where visitors come from. Among other things, shortened IP addresses, device and browser information, pages visited and interactions are processed.

The legal basis is solely your consent under Art. 6(1)(a) GDPR. Without consent, no measurement takes place. IP anonymisation is enabled. A transfer to the USA to Google LLC cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework, and the EU Commission's standard contractual clauses additionally apply. Despite these safeguards, access by US authorities cannot be fully excluded.

The storage period of usage data is a maximum of 14 months. Further information is in Google's privacy policy at policies.google.com/privacy.

17. Payment service providers

For payment processing in the coin shop we use external payment service providers. If you place an order, the data required for payment — name, email address, billing data, amount and order identifier — is transmitted to the provider you chose. The legal basis is Art. 6(1)(b) GDPR, as the transfer is necessary to perform the purchase contract.

  • Stripe: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland
  • PayPal (including Apple Pay and Google Pay via PayPal): PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg

The providers process the data as independent controllers under their respective privacy policies. We never receive full payment data such as card numbers.

18. Other services used

Besides the services named, we use the following tools:

  • Optimole (Themeisle / ThemeIsle SRL, Romania): images are compressed and delivered through a content delivery network. Your IP address is transmitted to the service. Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR based on our interest in fast loading times.
  • Jetpack (Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA): security and statistics functions for WordPress. A transfer to the USA takes place on the basis of standard contractual clauses.
  • MailPoet: sending our newsletter, if you have subscribed. Legal basis: Art. 6(1)(a) GDPR. Sign-up uses the double opt-in procedure, and you can unsubscribe at any time through the link in every email.
  • WPForms: processing of our contact and application forms. The entries are transmitted to us by email. Legal basis: Art. 6(1)(b) or (f) GDPR.
  • WooCommerce: operating the coin shop including order processing and invoicing. Legal basis: Art. 6(1)(b) GDPR; statutory retention periods under Art. 6(1)(c) GDPR.

Our web hosting is with ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The server location is Germany.

19. Updates to this privacy policy

We adapt this privacy policy as soon as app functions, legal requirements or the guidelines of Google Play and Apple change. The latest version is always available at this URL.

Status of the privacy policy: August 2026