StreamLayer Privacy Policy

Last Updated: August 11, 2025

StreamLayer, Inc. (“StreamLayer,” “we,” “us,” or “our”) provides interactive video engagement technology. We offer software development kits (SDKs), webviews, APIs, administrative tools, and related services (collectively, the “Services”) that enable our partners—rights holders and streaming platform operators such as media companies, sports leagues, teams, tournaments, and OTT services (our “Clients”)—to offer interactive experiences including non-linear and pause advertising, real-time statistics and betting odds, fantasy league integrations, optional public chat features, in-stream commerce, and loyalty programs via interactive overlays layered on top of video content.

This Privacy Policy explains how personal information is collected, used, shared, and protected when individuals interact with StreamLayer-powered features or access StreamLayer administrative tools. To ensure clarity, we distinguish between the following categories of individuals:

  • End Users – Individuals who interact with StreamLayer-powered features (such as polls, stats, ads, overlays, or chat) within an application, website, or service operated by StreamLayer or a Client (for example, a fan using a sports or entertainment app).

  • Client Admins – Employees, contractors, or representatives of StreamLayer or its Clients who access StreamLayer’s administrative, configuration, moderation, analytics, or reporting platforms (such as StreamLayer Studio).

1. IMPORTANT: OUR ROLE IN PROCESSING PERSONAL INFORMATION

StreamLayer provides technology services and processes personal information in connection with those services. Depending on the specific feature, service configuration, and commercial arrangement, StreamLayer may act either as a data processor or, in limited circumstances, as an independent data controller.

A. StreamLayer as a Data Processor (Most Integrations)

For the majority of personal information processed through the Services, including most End User data, StreamLayer acts as a data processor (under the GDPR) or service provider (under the CCPA/CPRA) on behalf of the applicable Client.

In these cases:

  • The Client is the Controller – The application, website, or platform you are using determines what personal information is collected and how it is used.

  • We Act on Instructions – StreamLayer processes personal information solely to provide the Services requested by the Client and in accordance with applicable contractual agreements, including data processing agreements.

  • No Independent Use – StreamLayer does not use End User personal information for its own independent purposes and does not build consumer profiles across different Clients or properties.

If you are an End User and wish to exercise privacy rights (such as access, deletion, or correction), you should submit your request directly to the operator of the application or service you are using. StreamLayer assists Clients with verified requests as required by law.

B. StreamLayer as an Independent Data Controller (Limited Circumstances)

In limited circumstances, StreamLayer may act as an independent data controller for specific processing activities where StreamLayer:

  • determines the purposes and means of processing for those activities; and

  • performs processing that is not carried out solely on behalf of, or under the documented instructions of, a Client.

Such circumstances may include, by way of example and without limitation, processing activities related to:

  • delivery, operation, measurement, optimization, or security of advertising or interactive services;

  • fraud prevention, abuse detection, or platform integrity;

  • development, testing, or improvement of StreamLayer features; or

  • other processing activities where StreamLayer exercises independent decision-making authority.

In these cases:

  • StreamLayer’s role as a controller applies only to the specific processing activities for which it determines the purposes and means;

  • processing is limited to what is necessary to perform and secure those activities; and

  • StreamLayer complies with applicable data protection laws in its capacity as a controller.

Where StreamLayer acts as a controller, this Privacy Policy applies directly to that processing.

C. Multiple Roles

In some deployments, StreamLayer may act as a data processor for certain processing activities and as a data controller for others. The applicable role depends on the specific feature, service configuration, and commercial arrangement.

Questions regarding StreamLayer’s role in connection with a particular application, feature, or service may be directed to legal@streamlayer.io.

2. INFORMATION WE COLLECT

We collect personal information in the following ways:

  • (A) Automatically through the Services

  • (B) Directly from Client Admins or other direct interactions

  • (C) From third parties

A. Information Collected Automatically (End Users)

When End Users interact with StreamLayer-powered features, StreamLayer may collect limited technical and interaction information necessary to deliver, operate, secure, and measure those features.

This information may include:

Technical & Device Information
  • Device or platform identifiers (such as advertising identifiers, where permitted by device or operating system settings)

  • Session identifiers

  • IP address

  • Browser or device type, operating system, carrier, and connection information

  • Approximate location inferred from IP address, where relevant for advertising delivery, regulatory compliance, or content availability

Usage & Interaction Information
  • Interactions with interactive features (such as polls, trivia, predictions, or overlays)

  • Advertising impressions, viewability signals, and interactions

  • Messages or reactions submitted through optional public or shared interactive features (where enabled)

  • Diagnostic information such as error logs, latency metrics, and crash reports

B. Information You Provide (Client Admins & Direct Interactions)

If you are a Client Admin or otherwise interact directly with StreamLayer, we may collect:

  • Account information (such as name, business email address, organization, and credentials)

  • Configuration data, creative assets, moderation records, and analytics reports

  • Communications with us, including support requests and business inquiries

Payment Information: StreamLayer does not collect or store payment card information. In-stream commerce transactions are processed by third-party payment processors or by the Client’s designated merchant of record.

C. Information from Third Parties
  • Clients: Pseudonymized or hashed identifiers used to support continuity of experiences within a Client’s own platform

  • Measurement and Fraud Vendors: Information used to verify delivery, detect invalid traffic, and prevent fraud

3. HOW WE USE YOUR INFORMATION

We use personal information for the following purposes:

A. Service Delivery
  • Render interactive advertising and engagement features

  • Enable real-time interactions such as polls, trivia, or optional chat

  • Support in-stream commerce and loyalty experiences

B. Advertising & Monetization
  • Deliver non-linear, pause, display, and interactive advertising

  • Perform frequency capping and advertising measurement

  • Trigger advertising formats based on service configuration

StreamLayer does not independently build cross-client advertising profiles unless expressly configured and controlled by a Client.

C. Analytics & Improvement
  • Generate aggregated or de-identified reporting

  • Improve the performance, reliability, and functionality of the Services

C. Compliance & Security
  • Enforce geographic, regulatory, and contractual requirements

  • Detect fraud, abuse, and security incidents

4. SHARING OF INFORMATION

We do not sell personal information. We do not share personal information for cross-context behavioral advertising (as defined under California law), except where expressly directed by a Client to support its own advertising campaigns.

Information may be shared:

  • With the Client whose application or service you are using

  • With service providers (sub-processors) bound by confidentiality and security obligations

  • With advertising partners for delivery and measurement initiated by Client configurations

  • To comply with legal obligations or protect rights and safety

  • In connection with corporate transactions such as mergers or acquisitions

5. COOKIES AND TRACKING TECHNOLOGIES

StreamLayer and its partners may use cookies, device identifiers, and similar technologies to operate interactive features, store preferences, and measure performance and reliability. Certain environments, such as Connected TV platforms, may rely on device identifiers instead of cookies. Limiting these technologies may affect functionality.

6. GAMING AND WAGERING DATA

StreamLayer does not accept bets or process payments. Betting-related content is provided for informational or entertainment purposes only. Age gating and jurisdictional compliance are enforced by Clients. Third-party sportsbook privacy policies apply when you leave StreamLayer-powered experiences.

7. YOUR PRIVACY RIGHTS

Depending on your location, you may have rights under laws such as the GDPR or CCPA/CPRA.

  • End Users: Requests should be submitted to the operator of the application or service you are using.

  • Client Admins: Requests may be submitted to privacy@streamlayer.io.

8. INTERNATIONAL DATA TRANSFERS

StreamLayer is headquartered in the United States. Where required, international data transfers are conducted using lawful mechanisms such as Standard Contractual Clauses.

9. CHILDREN’S PRIVACY

The Services are not directed to children under 13 (or under 16 where applicable). StreamLayer does not knowingly collect personal information from children.

10. SECURITY AND RETENTION

StreamLayer employs industry-standard administrative, technical, and organizational safeguards to protect personal information. Personal information is retained only as long as necessary to provide the Services or comply with legal obligations, after which it is deleted or anonymized.

11. CONTACT US

StreamLayer, Inc.

Attn: Privacy Department

515 North State Street, 14th Floor

Chicago, Illinois 60654, USA

Email: legal@streamlayer.io

‍