Privacy Policy

Controller and contact

The controller is NET-LINE Online-Dienste GmbH, Wannenäckerstr. 25, 74078 Heilbronn, Germany. Privacy requests can be sent to datenschutz@netline-services.de; product support is available at support@vorocast.app and +49 170 7917661.

Our data protection officer is Peter Herrmann and can be reached at datenschutz@netline-services.de.

Data processed by VoroCast

The app can be used without an account. Local preferences and destinations are stored on the device; stream keys are protected in the iOS Keychain or with Android Keystore encryption.

On Android, you may explicitly save a Web plugin login. The username and password are encrypted on this device, bound to the plugin HTTPS origin and excluded from backups or account sync. Filling requires biometric or device-credential unlock and does not automatically submit a login. You can remove it with Delete saved login in the plugin sign-in form. Your selected system password manager has its own storage and consent rules.

If you create an optional VoroCast account, we process the username, display name, optional email address, password hash, language, account identifier, creation and last-login timestamps, IP address, hostname, user agent, and client type. Passwords are not stored in plain text.

Cloud backup is optional and is currently being enabled. Availability is shown in your account; until then, settings remain on your device. Once available, after email confirmation, you can save plugin sources, navigation and studio preferences; your server address and stream key are included only when you select this explicitly. Backups use account-bound encryption in our AWS infrastructure. Plugin passwords are excluded. In Android, a saved account session is encrypted on the device; the account website holds it only for the open page. Restore requires your confirmation and does not start a stream or sign into a plugin.

If you use Sign in with Apple or Google, we receive the provider user identifier, verified email address where available, and the name you choose to share. We never receive your Apple or Google password.

When you scan a managed-workspace invitation, the QR code is read on the device. We process its short-lived challenge identifier and the relevant account and streaming-profile identifiers to complete the requested connection; VoroCast does not upload or retain a camera image of the QR code.

When you start a stream, camera video, microphone audio, destination information, session identifiers, and technical connection data are processed to establish, relay, monitor, and stop the selected stream. VoroCast does not create a recording by default.

For security, support, and fault diagnosis, our services may process request time, IP address, user agent, API route, response status, session or call identifiers, and technical error details. We do not use advertising SDKs and do not track users across third-party apps or websites.

When you visit vorocast.app, the hosting and delivery systems process the requested URL, time, IP address, user agent, referrer where supplied, and response status to deliver and secure the static website. The public information pages do not use analytics, advertising, tracking cookies, or browser storage. Optional Web plugins may store the notes or preferences you enter locally for their requested function; their own sign-in and service connections are managed by the plugin provider.

Purposes and legal bases

We process data to provide requested account, streaming, restream, support, and security functions under Article 6(1)(b) GDPR. You control camera and microphone permissions and can revoke them in your device settings.

We process limited technical records to secure the service, prevent misuse, diagnose failures, and defend legal claims based on Article 6(1)(f) GDPR. Where a legal retention obligation applies, processing is based on Article 6(1)(c) GDPR.

Our legitimate interests are reliable service delivery, attack and fraud prevention, troubleshooting, and the establishment, exercise, or defence of legal claims. Account and destination details required for a requested feature must be provided for that feature to work; creating an account and entering an email address remain optional. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Streaming destinations and service providers

VoroCast uses infrastructure and network providers, including Amazon Web Services, to operate account, website, logging, and API services. Authorized processors receive only the data needed for their contracted task.

Apple and Google process authentication data under their own privacy policies when you choose the respective sign-in option. VoroCast uses the returned identity only for account access and security, not for advertising or cross-service tracking.

For VoroCast Live, audio, video, and session data are relayed through media.guppy.cloud. If you select Twitch, YouTube, or a custom RTMP destination, VoroCast sends the live signal and required connection credentials to that destination only after you start the stream. The destination provider processes data under its own terms and privacy policy.

A restream request sends the selected destination and stream credential to media.guppy.cloud so the outgoing connection can be established. Do not enter credentials for a destination you are not authorized to use.

We require processors acting on our behalf to protect personal data to at least the level described in this policy and required by applicable law. A destination you select, such as Apple, Google, Twitch, YouTube, or a custom RTMP provider, may process data outside the European Economic Area as an independent provider. Where we arrange a transfer to a third country, we rely on an applicable adequacy decision, including the EU-US Data Privacy Framework where available, or appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Retention and deletion

Under Account, you can mark your VoroCast account as deleted. This blocks account access but does not erase stored account data or cloud backups. Request erasure of the account and associated data at datenschutz@netline-services.de.

Deleting your cloud backup removes the active workspace; marking the account as deleted retains it. Encrypted infrastructure recovery copies expire within seven days. Short-lived registration and security admission records expire automatically.

If in-app account deletion is unavailable, contact support or the privacy address for account assistance or deletion. Local stream keys remain on the device until you remove them in Setup or erase the app's Keychain data.

Live media is processed for the active transmission and is not recorded by VoroCast by default. Operational logs are retained only for the period required for service security, fault diagnosis, legal obligations, or legal claims, then deleted or anonymized according to the applicable service policy.

Retention is determined by data type and purpose: live media exists only for the active transmission unless you use a destination that records it; short-lived invitation challenges expire automatically; account data remains until deletion; support correspondence and security records remain only while needed to resolve the request, prevent abuse, meet documented legal duties, or defend claims. We then delete or anonymize the data.

Your choices and rights

You can deny or later revoke camera and microphone access in your device settings, remove external stream keys in the app, use VoroCast without an account, sign out, or delete a VoroCast-created account in the app.

Subject to applicable law, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent with future effect and lodge a complaint with a competent data protection authority. Contact datenschutz@netline-services.de to exercise these rights.

The supervisory authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), www.baden-wuerttemberg.datenschutz.de. You may also contact the authority at your habitual residence, place of work, or the place of an alleged infringement.

Minimum age

VoroCast is intended for users aged 13 or older. Where applicable law requires permission from a parent or legal guardian, the service may be used only with that permission.

Changes

We update this policy when the app, providers, or legal requirements change. Material changes will be identified by a new effective date and, where required, communicated in the app or through the account contact channel.