Política de privacidad

1. Controller

The controller for the data processing on badgebase.de under the GDPR is:

Marco Verch
Scanbox #02223
Ehrenbergstr. 16a
10245 Berlin, Germany
Email: marco.verch@gmail.com

See the imprint for further legal details.

2. Data we collect

a) Server logs

Every page request generates a log entry in our hosting provider's server logs containing:

• IP address
• Date and time
• Requested URL, HTTP status, referrer, user-agent

Purpose: Serving the site, troubleshooting, abuse detection.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
Retention: managed and deleted at short notice by our hosting provider.

We do not store IP addresses in our own database. For rate limiting, abuse detection and counting unique visits we only need to know whether several requests come from the same connection. The IP address is therefore converted into a non-reversible checksum using a secret value known only to us (a “salt”) before anything is stored. The original address cannot be derived from that checksum, and it remains unreadable even if a third party gained access to our database.

Our request_log table therefore stores: this checksum, target URL, status, timestamp, user-agent and traffic source (WEBSITE/EXTENSION).
Legal basis: Art. 6(1)(f) GDPR.
Retention: 30 days, then deleted automatically.

b) Twitch user data

We pull publicly available Twitch data via the official Twitch Helix API and store:

• Twitch ID, login, display name, profile picture
• Broadcaster type (Partner, Affiliate), account creation date
• Cached live-stream status and game category
• Publicly available Twitch badge collections (via GraphQL API)

Purpose: Building collector profiles, leaderboards, comparisons, recaps.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining a public Twitch fan archive).
Opt-out: Email marco.verch@gmail.com to have your profile removed and set to noindex.

c) Twitch Extension

If you install our Twitch Extension, it sends your Twitch ID to our server so we can return matching badge stats. We do NOT receive subscriptions or private data.
Legal basis: Art. 6(1)(b) GDPR (contract performance).

d) Donations via PayPal

If you donate via our /donate/ button, PayPal handles the transaction. After a successful payment, PayPal sends us an Instant Payment Notification (IPN) with:

• Donor's first and last name (as provided by PayPal)
• PayPal email address
• Transaction ID, amount, currency, payment date
• Optional memo field the donor filled in

This data is forwarded to Billomat GmbH where a monthly collective invoice is created for accounting.

Legal basis: Art. 6(1)(c) GDPR (legal obligation: tax record-keeping).
Retention: 10 years (German tax retention requirement).

e) Cookies

We set the following cookies:

• site_lang (first-party, 90 days) — remembers your language.
• blog_lang (first-party, 90 days) — remembers your blog language.
• Google Analytics: _ga, _ga_G-3F1ZRM0H5L (third-party).

3. Third-party services

Google Analytics 4

Provided by Google Ireland Ltd., Dublin, Ireland. IP addresses are truncated. EU Standard Contractual Clauses apply for US transfers.

Opt-out: tools.google.com/dlpage/gaoptout.

Fonts

The typeface we use (“Inter”) is served exclusively from our own server. No connection to Google is made and no data is transferred to Google.

Twitch Interactive, Inc.

Badge images, profile pictures and the footer live player are loaded from Twitch's CDN (San Francisco, USA). See Twitch Privacy Notice.

7TV

7TV emotes and profile pictures load from cdn.7tv.app and 7tv.io. Privacy: 7tv.app/legal/privacy.

Cloudinary

Fallback profile pictures are hosted by Cloudinary Ltd. (Israel). Privacy: cloudinary.com/privacy.

Mailchimp (email delivery)

We send our Badge Alert emails through Mailchimp (Intuit Inc. / The Rocket Science Group LLC, Atlanta, USA). It stores your email address, your Twitch name if provided, and the time of consent. Signup is strictly double opt-in: you are only on the list after clicking the confirmation link.
Legal basis: Art. 6(1)(a) GDPR (consent), revocable at any time via the unsubscribe link in every email.
Third-country transfer: Mailchimp is certified under the EU-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as fallback; a Data Processing Addendum is part of Mailchimp's terms.
Retention: until you withdraw; unsubscribed addresses stay on the suppression list solely so we never email them again.

PayPal

Payment processing by PayPal (Europe) S.à r.l. et Cie, S.C.A. See §2d.

Billomat

Invoicing software by Billomat GmbH & Co. KG, Fürther Straße 244a, 90429 Nürnberg, Germany. Receives donation payment data. Privacy: billomat.com/datenschutz.

All-Inkl (hosting)

Server hosting by ALL-INKL.COM (Germany). Data processing agreement in place. Privacy: all-inkl.com/datenschutz.

Discord Webhooks

Internal operational notifications (e.g. "new badge discovered") are pushed via webhook to Discord Inc. (San Francisco, USA). No personal user data is transferred beyond public Twitch handles in the context of the alert. Privacy: discord.com/privacy.

4. Your rights

Under the GDPR you have the right to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))
• Lodge a complaint with your national data protection authority (Art. 77) — ours: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

5. Contact and erasure requests

For anything privacy-related, email marco.verch@gmail.com with subject line "Privacy".

6. Changes to this policy

We may update this policy when laws or services change. The current version is always at badgebase.de/datenschutz/.

Last updated: 2026-07-22