Privacy Policy

1. Who We Are

HapiEats TV is a food video platform — on-demand videos, live streams with chat, a TV-style browser, virtual gifting with Hapi Tokens, creator subscriptions, cooking classes, and AI-assisted editing tools — operated by [HapiEats TV, LLC — update with your registered legal entity and address], the data controller for personal data described in this policy. Contact us at support@hapieatstv.com.

2. Data We Collect

Account data: Email address, username, display name, password (stored only as a secure hash by our authentication provider, Supabase), and account settings.

Profile data: Optional bio, avatar, cuisine specialties, chef verification details, and any other information you add to your public profile.

Content data: Videos and live streams you publish, live chat messages, comments, recipe cards, "Tried This" reactions, gifts sent and received, class enrollments, and Studio projects (including AI-assisted edits).

Payment data: Payments for tokens, subscriptions, Studio Pro, and classes are processed by Stripe. Your full card details never touch our servers — we receive only tokenized identifiers, transaction status, and billing metadata (e.g., last four digits, country). Creators receiving payouts provide identity and tax information directly to Stripe under Stripe Connect.

Usage and analytics data: Pages visited, videos watched, watch time and playback quality (collected via Mux Data), channel-surfing activity in the TV browser, device and browser type, IP address, and approximate location derived from IP. Vercel Analytics and Speed Insights collect aggregated, privacy-preserving page performance data.

Cookies: Session and preference cookies as described in our Cookie Policy. We do not use advertising cookies.

3. Why We Use Your Data

• Operating the Platform: hosting your account, streaming video, delivering live chat in real time, and maintaining token balances and gift ledgers
• Processing payments, subscriptions, and creator payouts, and preventing payment fraud
• Content moderation, including automated (AI-assisted) review of uploads, streams, and chat for policy violations, with human review of appeals
• Personalizing recommendations (e.g., cuisine and dietary tag filters, suggested channels)
• Measuring playback quality and site performance to improve the Platform
• Sending transactional messages (receipts, payout notices, security alerts) and, with opt-out available, product updates
• Complying with legal obligations, including tax and financial record-keeping for token purchases and creator earnings

4. Legal Bases (GDPR)

Where the EU/UK GDPR applies, we rely on: performance of a contract (providing the Platform, processing your purchases and payouts); legitimate interests (platform security, fraud prevention, content moderation, service analytics — balanced against your rights); consent (analytics cookies via the consent banner, marketing emails); and legal obligation (tax, accounting, and lawful requests). Where we rely on consent you may withdraw it at any time; where we rely on legitimate interests you may object (see Section 8).

5. Who We Share Data With

We do not sell your personal data. We share it only with:

• Supabase — authentication, database, and realtime chat infrastructure
• Mux — video encoding, storage, live streaming, and playback analytics (Mux Data)
• Stripe — payment processing, subscription billing, and creator payouts (Stripe Connect); Stripe acts as an independent controller for some payment data under its own privacy policy
• Vercel — website hosting, Vercel Analytics, and Speed Insights
• Other users: your public profile, published videos, live streams, chat messages, and gift animations shown in streams are visible to other users by design
• Authorities: where required by law, court order, or to protect users' safety or our legal rights
• Business transfers: in a merger, acquisition, or asset sale, subject to this policy's protections

Each processor accesses only the data needed to perform its service and is bound by a data processing agreement.

6. International Transfers

Our infrastructure is based in the United States, and the processors listed above may process data in the U.S. and other countries. Where we transfer data of EU/UK/Swiss residents, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where applicable, the EU–U.S. Data Privacy Framework certifications of our processors.

7. Retention

We keep personal data while your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except: financial records of token purchases, gift transactions, and creator payouts (retained up to 7 years for tax and audit obligations); data needed to resolve open disputes or enforce our Terms; moderation records needed to enforce repeat-violation bans; and short-lived encrypted backups. Chat messages in ended live streams are retained as part of stream records unless you delete your account.

8. Your Rights

• Access & portability: Request a copy or machine-readable export of your data by emailing support@hapieatstv.com.
• Correction: Update your profile and account data anytime in Settings.
• Deletion: Delete your account directly in the app at Settings → Account → Delete account, or email us to request deletion.
• Objection & restriction: Object to or ask us to restrict processing based on legitimate interests.
• Withdraw consent: Change cookie choices via the consent banner (see the Cookie Policy) and unsubscribe from marketing emails via the link in each email.
• Complain: EU/UK residents may lodge a complaint with their supervisory authority.

We respond to rights requests within 30 days (or the timeline required by your local law) and will verify your identity before acting on them.

9. California Privacy Rights (CCPA/CPRA)

We do not sell your personal information and do not share it for cross-context behavioral advertising, so no "Do Not Sell or Share My Personal Information" opt-out is needed — there is nothing to opt out of. California residents may exercise rights to know, delete, correct, and port their data as described in Section 8, without discrimination for doing so. Under California's "Shine the Light" law (Civil Code § 1798.83), residents may request information about disclosures of personal information to third parties for their direct marketing purposes; we make no such disclosures. Requests: support@hapieatstv.com.

10. Children (COPPA)

The Platform is for users aged 13 and over; children under 13 may not create accounts, and we do not knowingly collect personal information from children under 13. Purchases, gifting, and creator payouts are restricted to users 18+. If you believe a child under 13 has provided us personal data, contact support@hapieatstv.com and we will delete it promptly and terminate the account.

11. Security

We protect data with TLS encryption in transit, hashed credentials, row-level security on database tables, role-scoped service access, and least-privilege API design (e.g., stream keys and payment identifiers are never exposed to other users). No system is perfectly secure — report suspected vulnerabilities or breaches to support@hapieatstv.com.

12. Changes to This Policy

We may update this policy from time to time; material changes will be announced by email or a prominent notice on the Platform before taking effect. The "Last updated" date above reflects the latest revision.

13. Contact

Privacy questions or requests: