Privacy Policy

This Privacy Policy explains how APIQ processes personal data when you visit apiq.live, contact us, use the APIQ platform as an advertiser or streamer, or watch a stream in which APIQ advertising is shown. It is our information notice under the EU and UK General Data Protection Regulation ("GDPR"), the Turkish Law No. 6698 on the Protection of Personal Data ("KVKK", this Policy serves as the aydınlatma metni) and applicable US state privacy laws.

1. Controller and contact

1.1. The controller of your personal data is the APIQ company that is your contracting party, or, if you have no contract with us, the company with which you interact:

• APIQ Turkey Medya Teknolojileri Limited Şirketi, Esentepe Mah. Keskin Kalem Sk. Arya Plaza No: 17 İç Kapı No: 2, 34394 Şişli / İstanbul, Türkiye, tax ID 0711004415 — for advertisers, streamers, contacts and visitors in Türkiye (data controller under the KVKK);
• APIQ Inc., 30 N Gould St, Ste R, Sheridan, Wyoming 82801, United States — for everyone else.

1.2. For any privacy question or request, write to [email protected].

1.3. For data of stream viewers and link clicks, the controller is APIQ Inc., except for campaigns contracted by APIQ Turkey Medya Teknolojileri Limited Şirketi. Where APIQ companies jointly determine the purposes of processing (for example shared anti-fraud records), they are joint controllers; the essence of the arrangement is available at [email protected], and you may exercise your rights against any of them.

2. What data we process, why, and on what legal basis

2.1. Website visitors

• Data: IP address, browser and device type, operating system, language, referring page, pages visited, date and time, and, if you consent, cookie and similar identifiers and usage statistics.
• Purposes: to display the website securely, prevent abuse, remember your language choice, and — only with your consent — measure visits and the effectiveness of our marketing.
• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)); your consent for analytics and marketing cookies (Art. 6(1)(a) GDPR; KVKK Art. 5(1)). See section 13.

2.2. Enquiries and business contacts

• Data: name, company, job title, business email and phone number, country, the content of your message, and the history of our communication.
• Purposes: to answer your enquiry, prepare a media plan or proposal, manage our business relationship, and send you relevant information about APIQ services.
• Legal basis: steps prior to entering into a contract and performance of a contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)); our legitimate interest in business development and B2B communication (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)); consent where required by law for electronic marketing. You can object to marketing at any time.

2.3. Advertisers and agencies (account users)

• Data: account details (name, business email, role, login data), company and billing data, contracts and orders, campaign settings, communications, payment records.
• Purposes: to provide the platform, deliver and report campaigns, invoice and collect payments, provide support, secure the platform, and comply with accounting and tax obligations.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)); legal obligations (Art. 6(1)(c) GDPR; KVKK Art. 5(2)(ç)); legitimate interests in security and fraud prevention (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)).

2.4. Streamers and streamer agencies

• Data:
• identity and contact data: name, nickname, email, messenger handle, country, language, date of birth or age confirmation;
• channel data: channel names and links on Twitch, Kick, YouTube, TikTok and other platforms, and public channel statistics such as followers, viewer numbers, stream time and frequency, categories and audience geography;
• verification data: screenshots of the public page of your channel, which our server service opens and captures (in a 1280×720 window) around the middle of each advertising display, timestamps, viewer counts, technical logs of the APIQ OBS plugin and overlays;
• data of the APIQ OBS plugin: a random installation identifier created when the plugin is connected to your APIQ account, operating system, OBS and plugin versions, canvas size, status signals (whether the stream is live, whether an advertisement is showing) and display data (which Creative was shown, for how long, whether it ended normally). The plugin does not send us the image or sound of your stream, the content of your scenes and sources, chat, camera, microphone or files on your computer, and sends nothing until it is connected to an APIQ account. The APIQ overlay in OBS (a browser source) reports only technical information about itself: whether it works, the browser version, the window size and that an advertisement was displayed;
• data received through the permissions you grant when you connect a platform account: on Twitch, your email address, the status of the APIQ extension on your channel, the lists of moderators and VIPs, the number of followers and the list of chat participants; on Kick, your account and channel data; on YouTube, your email address, profile and channel data; on TikTok, your basic profile and profile information, account statistics and the list of your videos. If you enable Live Gifts, we also request access to the list of your Twitch subscribers, and if you use channel rewards, access to your channel's reward redemptions and whispers. We use these permissions only to register you, manage the APIQ extension, post one technical line in your chat when setting up a chat bot, run the features you enable, and check the audience for Invalid Traffic. The authorisation screen of each platform shows the full list of permissions;
• data of the APIQ Twitch extension: your channel identifier and name, the polls you create and when you launch them;
• payment and tax data: legal name, address, tax identification number, bank or payment account details, invoices, payout history;
• communications and support history.
• Purposes: to onboard and verify you, match your channel to campaigns and present it to advertisers, deliver and verify advertising, calculate and pay earnings, detect Invalid Traffic and fraud, provide support, run referral programmes, and comply with tax and anti-money-laundering laws.
• Legal basis: performance of a contract (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)); legal obligations (Art. 6(1)(c) GDPR; KVKK Art. 5(2)(ç)); our legitimate interests in fraud prevention, proper billing to advertisers and improving our matching (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)); public channel data made public by you (KVKK Art. 5(2)(d)).

2.5. Viewers of streams with APIQ advertising

• APIQ does not ask viewers for their name, email or payment data and does not identify viewers by name. To measure audiences we use viewer counts published by the streaming platforms. To detect Invalid Traffic we also process the list of chat participants of the channel and public data about their accounts provided by the platform (whether the account has an avatar and a profile description, how many messages it wrote during the stream), and use this data only in aggregated metrics per stream. Legal basis: our legitimate interest in protecting advertisers from Invalid Traffic (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)).
• If you watch a Twitch channel where the APIQ Twitch extension is active, we receive from Twitch a pseudonymised identifier of your Twitch account and the channel identifier, the viewing settings Twitch passes to extensions (language, theme, game, video quality, volume), your answers in polls and your interactions (whether a poll or advertisement was shown to you, whether you answered, opened or clicked it). For statistics the extension uses Google Analytics with a technical identifier stored in a cookie for 2 hours; IP addresses are anonymised. Google Analytics may produce aggregated estimates of age and gender; we see only aggregated statistics. We do not receive your name, email, payment data, chat messages or your viewing history outside the channel. Purposes: to show polls and advertising, count and confirm displays, provide aggregated statistics to advertisers, diagnose errors and prevent fraud. Legal basis: our legitimate interest in providing and measuring the extension (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)).
• If you click an APIQ advertising link (in the stream, in the chat or in the APIQ Twitch extension), we process your IP address, browser and device data, time of the click, the link clicked and the referring page, and then redirect you to the advertiser's page. Purposes: to count clicks, detect invalid clicks and fraud, and provide aggregated statistics to advertisers. Legal basis: our legitimate interest in measuring and protecting advertising (Art. 6(1)(f) GDPR; KVKK Art. 5(2)(f)). Advertisers receive aggregated statistics only.
• Screenshots of the broadcast output used for verification may incidentally contain publicly displayed usernames or chat messages of viewers. We use screenshots only to verify advertising displays, restrict access to them and delete them within the retention period stated in section 5.
• APIQ does not load advertisers' tracking tags on its redirect pages or overlays. Advertising blocks in the APIQ Twitch extension may load an invisible pixel of the advertiser or of an ad measurement service; its server receives your IP address and device type and processes them under that company's own policy. After the redirect, the advertiser's website is responsible for its own processing, including its cookies and pixels.

2.6. Recruitment

If you apply for a job with us, we process your application documents to assess your application (steps prior to a contract), and keep them for 6 months after the process ends unless you agree to a longer period.

2.7. Sources and method of collection

We collect data directly from you (forms, the account, email, messengers, the OBS plugin, overlays and the Twitch extension), automatically (logs, click redirects, cookies), from the official APIs of streaming platforms and publicly available channel information, and, for business contacts, from public professional sources (company websites, professional networks such as LinkedIn, events), B2B data providers and CRM enrichment services. Collection is electronic, by phone or in person, on the legal bases stated above.

3. Data from third-party platforms

3.1. To analyse channels and verify advertising, APIQ uses public data and the official APIs of streaming platforms, including the YouTube API Services and the Twitch API, as well as other official APIs and publicly available information. By connecting your channel to APIQ through these services, you also agree to be bound by the YouTube Terms of Service. Google's processing of data is described in the Google Privacy Policy.

3.2. When you authorise APIQ through Google or another platform, we receive only the data covered by the permissions you approve (for example channel identifier, channel name and channel statistics). APIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google APIs to develop, improve or train generalised artificial intelligence or machine learning models.

3.3. You can revoke APIQ's access to your Google account at any time via the Google security settings page, and to other platforms in the security or connected-apps settings of that platform. Revoking access may stop APIQ from delivering or verifying advertising on that channel. If you revoke access through APIQ, we delete the data obtained through that authorisation within 7 days; if you revoke it through Google's security settings, within 30 days. Data obtained from the YouTube API Services is refreshed or deleted at least every 30 days. Records we create ourselves (verification screenshots, billing records) are kept as stated in section 5.

4. Automated processing and profiling

4.1. APIQ uses automated systems, including statistical and machine-learning models, to forecast viewer numbers, match channels to campaigns, recognise Creatives on screenshots, and detect Invalid Traffic.

4.2. Our anti-fraud system evaluates every advertising display. For each completed stream it calculates signals such as the share of chat participants among viewers, how sharply the audience changed between snapshots, how many chat participants wrote more than one, three or five messages, the share of chat accounts with an avatar or a profile description, the average number of viewers, the clicks recorded for the display, and whether a screenshot check confirmed that the Creative was on screen. Chat signals are calculated only for streams with more than 100 viewers on average. Displays the system flags as suspicious are reviewed by a member of our team, who decides whether they are paid; the system does not exclude displays from payment on its own. You can ask for an explanation, express your point of view and contest the decision by writing to [email protected] within 30 days after the decision is shown in your account. Computer vision is used only to recognise Creatives, never to identify or analyse people.

4.3. We do not use data of stream viewers for profiling.

5. How long we keep data

We keep personal data only as long as necessary for the purposes described above:

After these periods, data is deleted or anonymised.

6. Who receives your data

6.1. We share personal data only where necessary:

• service providers acting on our behalf (processors): servers and hosting (Hetzner, Amazon Web Services), content delivery, protection and cookie-free visit statistics (Cloudflare, including Cloudflare Web Analytics), file storage (Amazon Web Services), email delivery (Resend, Mailgun, Mailtrap), error reports and logs (Sentry, Papertrail), team notifications (Slack), customer relationship management (Attio), analytics (Google Analytics and Google Tag Manager; on the website only with consent), customer support and payment providers. They may use the data only on our instructions and under data processing agreements. Matomo and the real-time messaging server (Soketi) run on APIQ's own servers;
• streaming platforms (Twitch, Kick, YouTube, TikTok), to the extent necessary to operate the integrations you connect;
• advertisers and agencies: channel information and aggregated campaign statistics, as well as verification evidence for specific displays (for example screenshots) when needed to resolve a question about delivery;
• streamers: information about the campaign and the advertiser necessary to show the advertising;
• payment service providers and banks, to make payouts and receive payments;
• APIQ affiliated companies, for the purposes in this Policy;
• professional advisers (lawyers, auditors, tax advisers) under confidentiality obligations;
• authorities and courts, where required by law or to establish, exercise or defend legal claims;
• a buyer or successor in the event of a merger, acquisition or sale of assets, subject to this Policy.

6.2. We do not sell personal data for money. Apart from marketing cookies used only with your consent (see section 13), which some US state laws treat as "sharing" for cross-context behavioural advertising, we do not share personal data for that purpose. You can opt out by withdrawing your cookie consent or by sending a Global Privacy Control signal.

7. International transfers

APIQ operates internationally, and personal data may be transferred to and processed in countries outside your own, including the United States, Türkiye and member states of the European Economic Area (in particular Germany and Finland). Where data protection law requires it, we protect such transfers by an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses (and the UK Addendum), or, for transfers from Türkiye, the standard contracts and other safeguards provided for in Article 9 of the KVKK. You can request a copy of the relevant safeguards at [email protected].

8. Security

We protect personal data with appropriate technical and organisational measures, including encryption in transit, access controls based on roles, logging, and regular backups. No system is completely secure; if a personal data breach occurs that is likely to result in a risk to you, we will notify you and the competent authorities as required by law.

9. Your rights

9.1. Right to object. Where we rely on legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

9.2. Depending on the law that applies to you, you also have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have data deleted;
• restrict processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• not be subject to a decision based solely on automated processing with legal or similarly significant effects (see section 4);
• under the KVKK (Art. 11), also to learn whether your data is processed, the purpose and whether it is used accordingly, the third parties to whom it is transferred in Türkiye or abroad, to request notification of corrections and deletions to such third parties, to object to a result against you arising from analysis exclusively by automated systems, and to claim compensation for damage caused by unlawful processing;
• under US state laws, to know, access, correct and delete your data and to opt out of sale, sharing or targeted advertising (see section 6.2). We will not discriminate against you for exercising your rights.

9.3. To exercise your rights, write to [email protected]. We may ask you to confirm your identity. We answer within one month (GDPR) or 30 days (KVKK), which may be extended where the law allows. Requests are free of charge unless they are manifestly unfounded or excessive.

9.4. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place, in the UK with the Information Commissioner's Office, and in Türkiye with the Personal Data Protection Board (KVKK Kurulu). We would appreciate the chance to address your concern first.

10. Children

The APIQ website and platform are intended for persons aged 18 and over. We do not knowingly collect personal data of children for our own purposes. Stream viewers are not identified by APIQ (see section 2.5). If you believe that we hold data of a child, please contact [email protected] and we will delete it.

11. Obligation to provide data

Providing data on the website is voluntary. Data marked as mandatory in forms, in the account and for payouts is necessary to conclude and perform the contract or to comply with the law; without it we cannot provide the service or make payouts.

12. Changes

We may update this Policy. The current version is always published on this page with its effective date. We will inform account holders of material changes by email or in the account.

13. Cookies

13.1. What cookies are

Cookies are small text files that a website stores on your device. Similar technologies store or read information on your device in other ways. Some are necessary for a website to work; others help us understand how the website is used or measure marketing. Cookies set by APIQ are "first-party cookies"; cookies set by other companies through our website are "third-party cookies".

13.2. Our approach

• Strictly necessary technologies are always active because the website and account cannot work securely without them. The law does not require consent for them.
• Analytics and marketing technologies are used only if you consent in the cookie banner. Until you consent, they are not loaded. You can change your choice at any time.

13.3. What we use

We also count visits to the website with Cloudflare Web Analytics, which does not use cookies and does not identify visitors. The account at my.apiq.live does not use analytics or advertising cookies; it keeps a draft of a campaign you are creating in your browser's local storage and sends error reports to Sentry without cookies. Inside the APIQ Twitch extension, Google Analytics uses a technical identifier stored for 2 hours (see section 2.5).

The exact list may change as the website develops; the cookie banner always shows the current list.

13.4. Managing your choice

• Use the cookie settings link in the footer of the website to change or withdraw your consent at any time. Withdrawal does not affect processing before it.
• You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the website or account may not work.
• Where your browser sends a Global Privacy Control signal, we treat it as an objection to marketing technologies.

13.5. Advertising links in streams

When you click an APIQ advertising link in a stream or chat, APIQ records the click without setting cookies on your device (other than strictly necessary security cookies of our content delivery network) and does not load advertisers' tags on the redirect page (see section 2.5). The advertiser's website you are redirected to uses its own cookies under its own policy.