Privacy
Privacy Policy
Short version: we collect almost nothing, we never see the files you resize, your card data lives with Waffo Pancake, and you can ask us to forget you at any time.
Effective date:
1. Who is the data controller
The Service is operated by Emote Studio, an individual / sole-trader business (the "Operator"). If you prefer a single point of contact, that is also us:
- Operator / Data controller: Emote Studio (maketwitchemotes.com)
- Privacy contact email: [email protected]
- Data Protection Officer: not appointed (Emote Studio is a one-person business).
- Mailing address: not published; provided on request to [email protected].
If you live in the EU/UK, the GDPR rules below apply. If you live in California, the CCPA rules below apply. Emote Studio is not formally appointed as your local representative; you can still reach us at the privacy email for any rights request.
2. What we collect
2.1 Things you give us
- Order information — when you buy the Full Pack, our payment processor (Waffo Pancake) tells us your email address, country, and order ID so we can deliver your download link. We never see your card number, CVV, or bank details — those go directly to Waffo.
- Messages you send us — if you email support, refunds, legal, privacy, or security, we keep the email and our reply so we can help you and so we have a record of the conversation.
- Newsletter opt-in — only if you tick the box. We use a single opt-in, and the confirmation email contains an unsubscribe link.
2.2 Things collected automatically
- Analytics — basic, privacy-respecting page views (page URL, country, device class). We use this to understand which tools people find useful and to fix broken pages. No advertising identifiers, no cross-site tracking.
- Server logs — IP address, request path, user agent, and timestamp, retained for security and abuse prevention. We never use log data to build a profile of you.
- Cookies — strictly necessary cookies (session) plus optional analytics cookies (only with your consent, where required).
2.3 Things we definitely do NOT collect
- The emote images you upload to the resizer (they are processed in your browser and never uploaded).
- Your full card number or CVV (handled exclusively by Waffo Pancake under PCI-DSS).
- Precise geolocation, biometric data, or anything from a third-party login (we don't offer social logins today).
3. What we use it for
| Purpose | Legal basis |
|---|---|
| Deliver the Full Pack and email your download link | Contract performance |
| Process refunds and reply to your support emails | Contract performance / legitimate interest |
| Send service emails (order confirmation, security alerts, policy updates) | Legitimate interest |
| Detect fraud, abuse, and security incidents | Legitimate interest / legal obligation |
| Anonymised analytics to improve the tools | Legitimate interest (you can opt out) |
| Newsletter (only with explicit consent) | Consent (revocable at any time) |
| Comply with tax, accounting, and legal obligations | Legal obligation |
4. Cookies and tracking
| Type | What it does | Can you turn it off? |
|---|---|---|
| Strictly necessary | Keeps the site running (language preference, security) | No — required for the site to work |
| Analytics | Counts page views in aggregate | Yes — through your browser or our cookie banner |
| Marketing | We do not use advertising cookies on this site | Not applicable |
Detailed cookie list: Cookie List. We update that page whenever the set changes.
5. Who we share data with
We do not sell your personal information. "Sale" here includes the CCPA sense of selling or sharing for cross-context behavioural advertising. We only share data with the following categories of recipients, each under a confidentiality and data-processing agreement:
- Waffo Pancake — our PCI-DSS compliant payment processor. Waffo handles card data on our behalf; we receive only what is needed to deliver the product.
- Email delivery provider — sends transactional emails (order receipts, download links, refund updates). A small provider in the EU/US.
- Hosting and analytics providers — host the website and serve aggregated analytics.
- Authorities — only when we are legally required to (tax, court order, or to defend a legal claim).
6. International data transfers
Our servers and many of our providers are based in the United States and the European Union. When data moves between regions we rely on the EU Commission's Standard Contractual Clauses (SCCs) and equivalent UK international data-transfer terms.
7. Data retention
| Data | How long we keep it | What happens after |
|---|---|---|
| Order records (email, items, amount) | 7 years from order date (tax / accounting rules) | Archived or deleted at the end of the period |
| Support emails | Up to 3 years after the last message | Securely deleted |
| Newsletter subscriptions | Until you unsubscribe | Removed from the list |
| Server logs | 90 days | Automatically deleted |
| Analytics (aggregated, no personal identifiers) | 24 months | Aggregated further or deleted |
8. Security
We protect the data we hold with TLS/HTTPS in transit, encryption at rest where the provider supports it, strict access control (only Emote Studio can read personal data), and password-protected accounts for any internal system. No system is perfectly secure; if a security incident affects your personal data we will notify you and the relevant supervisory authority within 72 hours of becoming aware.
9. Your rights
Depending on where you live, you have some or all of these rights. We honour them all for every user:
- Know what we hold about you (access)
- Correct anything wrong (rectification)
- Ask us to delete your data (erasure)
- Pause processing in specific situations (restriction)
- Receive your data in a portable format (portability)
- Object to processing based on legitimate interest, including analytics (objection)
- Withdraw consent at any time (e.g. for the newsletter)
- Complain to your local data protection authority
To exercise any of these rights, email [email protected]. We respond within 30 days. To protect your data, we may ask you to confirm the request from the email address we have on file.
10. Children
The Service is designed for Twitch streamers and is not aimed at children under 13 (or under 16 in some EU/UK regions). We do not knowingly collect personal information from children. If you believe a child has given us data, write to [email protected] and we will delete it.
11. Third-party links and embeds
Some pages link to or embed third-party content (Twitch, YouTube, Discord). Their data practices are governed by their own privacy policies, which we do not control.
12. Changes to this policy
If we make a material change, we will email active customers and update the banner on the Site at least 15 days before the change takes effect, and we will bump the "Last updated" date at the top of this page.
13. Contact
- Privacy: [email protected]
- Support: [email protected]
- Legal: [email protected]
- Security reports: [email protected]
Emote Studio is the data controller. We aim to reply to every privacy request within 30 calendar days.