Legal
Privacy Policy
What we collect, why we are allowed to, and how you take it back.
Version 6 · Effective 2026-09-03
This policy explains what personal data Stremlix collects, what we do with it, and the rights you have over it. It is written to the standard of the EU General Data Protection Regulation (GDPR) and the UK GDPR, so that visitors from those regions get that level of protection regardless of where we are based.
On this page
MAFFEITECH INFORMATION TECHNOLOGY L.L.C, a limited liability company registered in Dubai, United Arab Emirates, is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are the party you exercise your rights against.
| Detail | Value |
|---|---|
| Controller | MAFFEITECH INFORMATION TECHNOLOGY L.L.C |
| Address | Downtown, Dubai, United Arab Emirates |
| Privacy contact | legal@stremlix.com |
| Data protection officer | Not appointed. Our processing does not meet the Art. 37 thresholds that require one. |
| EU / UK representative | Not appointed. We have not appointed a representative in the European Union under Article 27 GDPR, or in the United Kingdom under the UK GDPR. If you are in the EU or the UK and wish to exercise a right, write to legal@stremlix.com and we will deal with it directly. |
We collect only what the Service needs in order to work, to be paid for, and to stay secure. We do not buy personal data from anyone, and we do not build advertising profiles.
| Category | What it is |
|---|---|
| Account data | Your email address, your name if you give one, a password hash (never the password itself), and whether you signed in with Google or Apple. |
| Provider credentials | The server address, username, and password of the IPTV or Xtream Codes account you choose to connect. |
| Subscription data | Your plan, trial and renewal dates, payment status, and the customer and subscription identifiers Stripe gives us. We do not receive or store your card number. |
| Session data | For each active sign-in: a session token, the IP address the session was created from, and the browser or device user-agent string. |
| Usage data inside the app | Your favourites, playlists, and watch history — the data the features themselves exist to store, held so the app works the same on your other devices. |
| Consent records | Which cookie purposes you accepted or refused, the policy version in force at the time, the timestamp, and a pseudonymous identifier stored in a first-party cookie. |
| Error and diagnostic data | When something breaks, our error monitoring provider (Sentry) receives the error, a stack trace, the page or screen, and technical context about the device and session. |
| Email delivery data | Our email provider (Resend) processes your address and delivery events in order to send verification, sign-in, and billing emails. |
Your provider credentials are encrypted at rest with AES-256-GCM before they are written to our database. They are decrypted only in order to make the request your device asked us to help with.
We store your provider credentials so the app can talk to your provider. We do not inspect them, sell them, or share them, and we do not supply the service they unlock.
We do not deliberately collect special categories of data (health, beliefs, biometrics, and the like), and you should not put such data into free-text fields such as playlist names.
Under the GDPR every use of personal data needs a lawful basis. This table is ours: what we do, why, and which basis it rests on. Where the basis is consent, the processing does not happen until you give it and stops when you withdraw it.
| What we do | Why | Lawful basis |
|---|---|---|
| Create and run your account; authenticate you | You cannot use the Service without an account | Contract (Art. 6(1)(b)) |
| Store and use your provider credentials to fetch your streams | This is the function of the product you subscribed to | Contract (Art. 6(1)(b)) |
| Sync your favourites, playlists, and watch history | Features you asked for, working across your devices | Contract (Art. 6(1)(b)) |
| Take payment, manage trials, renewals, and cancellations | To provide a paid subscription and get paid for it | Contract (Art. 6(1)(b)) |
| Send service emails — verification, sign-in codes, password resets, receipts, and material changes to these documents | Required to operate the account you asked for | Contract (Art. 6(1)(b)) |
| Keep session records including IP address and user-agent | So you can see and end your active sessions, and so we can detect account takeover | Legitimate interests (Art. 6(1)(f)) — securing accounts |
| Rate-limit, detect abuse, and block attacks | Keeping the Service available and accounts safe | Legitimate interests (Art. 6(1)(f)) — security |
| Receive crash and error reports | So faults are found and fixed rather than silently endured | Legitimate interests (Art. 6(1)(f)) — service reliability |
| Remember non-essential preferences such as your theme | Convenience only; the app works without it | Consent (Art. 6(1)(a)) |
| Analytics about which features are used | To decide what to improve | Consent (Art. 6(1)(a)) |
| Advertising, and any profiling for advertising | Not done today. If it is ever introduced it will be asked for separately | Consent (Art. 6(1)(a)) |
| Keep records of consent, acceptance of terms, billing, and tax | We have to be able to show what was agreed and what was charged | Legal obligation (Art. 6(1)(c)) and our legitimate interest in defending claims |
Where we rely on legitimate interests we have weighed them against your rights and concluded the processing is what you would reasonably expect. You can object at any time — see section 9 — and we will stop unless we have compelling grounds that override your objection.
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.
Stremlix shows no advertising today, and sets no advertising or profiling cookies today.
We may introduce advertising in future. If we do, it will be on the basis of consent: you will be asked, the request will name the purposes it covers, and the choices are recorded per purpose rather than as one blanket switch.
Refusing advertising and advertising-related purposes keeps the application fully usable. Nothing you pay for is withheld, degraded, or gated behind agreeing to ads.
Your provider credentials, and what you watch, will never be used to target advertising and will never be shared with an advertising partner.
We are based in the United Arab Emirates and our providers operate in the United States, the European Union, and elsewhere. Using the Service therefore involves transferring personal data outside the country where you live, including outside the EEA and the UK.
Where data leaves the EEA or the UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement where the UK GDPR applies), incorporated into our agreements with each provider, together with the technical measures in section 8. You can ask us for a copy of the safeguards in place.
We keep data only as long as it has a purpose, then delete or anonymise it.
| Data | Kept for |
|---|---|
| Account data | The life of your account, then deleted within 30 days of deletion or account closure |
| Provider credentials | Until you remove the provider or delete your account, then deleted immediately |
| Session records | Until the session expires or you sign it out, and no more than 7 days after expiry |
| Favourites, playlists, watch history | The life of your account, or until you delete the item |
| Consent records tied to an account | The life of the account plus 12 months, as evidence of what was agreed |
| Anonymous consent records (no account) | 13 months, then deleted |
| Error and diagnostic data | 90 days at our monitoring provider, then deleted automatically |
| Billing, invoice, and tax records | As long as tax and accounting law requires, typically 5 years |
Backups roll off on their own schedule, so data can persist in a backup for a short period after it is deleted from the live system. It is not restored into use.
We take technical and organisational measures appropriate to the risk, including:
- Encryption in transit (HTTPS/TLS) for every connection to our systems
- AES-256-GCM encryption at rest for your provider credentials, with the key held outside the database
- Passwords stored only as salted hashes, never in a form we can read
- Session cookies that are HTTP-only, Secure, and SameSite-restricted, with sessions you can view and revoke
- Rate limiting and abuse detection on authentication endpoints
- Server-side validation of every outbound request to a user-supplied address, to stop our servers being used to reach systems that are not yours
- Masking of text and media in error-monitoring session replays, so a stream URL cannot leak a provider password into a bug report
- Access to production data limited to those who need it
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and tell you directly where the risk is high.
Subject to the conditions in the law, you have the right to:
- Access — get a copy of the personal data we hold about you
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have your data deleted where we no longer have grounds to keep it
- Restriction — have us pause processing while a dispute about it is resolved
- Portability — receive the data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible
- Object — object to processing based on legitimate interests, including profiling
- Withdraw consent — withdraw any consent you gave, at any time, without affecting what was lawful before you withdrew it
- Complain — lodge a complaint with your local supervisory authority
You can exercise most of these from your account settings. For anything else, write to us at the privacy contact in section 1. We will respond within one month, and will tell you if we need longer because the request is complex. We may need to verify who you are first. Exercising a right costs nothing unless a request is manifestly unfounded or excessive.
Withdrawing cookie consent must be as easy as giving it, so the same control that took your choices reopens them here and in the footer of every page:
The Service is for adults. It is not directed at children, we do not knowingly collect personal data from anyone under 18, and accounts are restricted to people aged 18 or over.
If you believe a child has given us personal data, contact us and we will delete the account and the data.
We will update this policy when what we do changes. Each published version carries a version number and an effective date, shown at the top of this page.
For a material change we increase the version number and ask you to review it the next time you use the Service, and we record which version you saw. Where the change is significant we also give notice by email in advance.
| Version | Effective | What changed |
|---|---|---|
| 1 | 2026-08-18 | First published version. |
| 2 | 2026-08-20 | Subscription prices restated; the EU Article 27 / UK representative row now says plainly that none is appointed. |
| 3 | 2026-09-02 | Cloudflare added to the processor table and Turnstile, the bot check on our auth pages, described in section 5. |
| 6 | 2026-09-03 | The registered business address of the operating entity was filled in. No change to how we handle personal data. |
| 5 | 2026-09-03 | Published alongside the Terms yearly-price update; no change to how we handle personal data. |
| 4 | 2026-09-03 | Published alongside the Terms price update; no change to how we handle personal data. |
For any privacy question or to exercise a right, write to legal@stremlix.com.
MAFFEITECH INFORMATION TECHNOLOGY L.L.C, Downtown, Dubai, United Arab Emirates.
If you are in the EEA or the UK you also have the right to complain to your national data protection authority.