Privacy Policy

The controller of your personal data is:

• Dathent s.r.o., a company registered in the Czech Republic
• Registered office: Zenklova 24/54, 180 00 Prague, Czech Republic
• Company ID (IČO): 19824041
• Contact for privacy matters: [email protected]

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. You can reach our privacy contact at the email above for any question about this Policy or your data.

We collect only what we need to run the Service:

a) Account data — when you register or sign in: your email address, display name, and either a securely hashed password or, if you use "Sign in with Google" or "Sign in with Discord", the stable account identifier and verified email address that the provider returns to us. We never receive or store your Google or Discord password.

b) Broadcast configuration data — content you create in the Service to run a production. This may include:

• teams — name, short name, logo, and accent colour;
• players — name, in-broadcast nickname, Steam ID or in-game name, country, and photo;
• matches and events — participating teams, map veto, scores, dates, and status;
• tournaments and brackets — name, logo, format, participating rosters, and results;
• sponsors — names and logos; and overlay layouts, positions, theme, and camera/HUD settings.

Some of this may include personal data about the players and casters you configure — you are responsible for having a lawful basis to enter such data (see Section 9).

c) Game-state data (Collector / GSI) — when you run the Overhub Collector, it receives live game-state information that Counter-Strike 2 sends through Valve's official Game State Integration (GSI) interface (scores, round state, public per-player match stats). This is input-only: the Collector never reads the game's memory or process. It is used in real time to drive your live overlay and is not retained by us as a lasting personal profile.

While you are signed in, the Collector also tells us every 30 seconds that it is running, so your plan's concurrent collector seats can be counted: a random install identifier, its version, the selected event, whether CS2 is running and sending data, and your computer's name, cut to 32 characters. We hold the computer name in memory only, show it only to you, and never write it to our logs; turn off "Show this PC's name on the site" in the Collector's Profile and it is not sent.

d) Payment data — if you purchase a paid plan, payment is processed by Stripe. We receive limited billing metadata (plan, status, the last four digits of the card, billing country) but we never receive or store your full card number or security code — Stripe does.

e) Technical and usage data — automatically: IP address, browser/user-agent, session cookies, timestamps, approximate location (from IP), collector version, and basic diagnostic logs. This is used to operate and secure the Service.

f) ChatGPT plugin / MCP integration data — if an Overhub connection is made available and you choose to link it to ChatGPT through OAuth, we process the data needed to authenticate the connection and carry out the tool requests you initiate. This may include:

• your Overhub account identifier, OAuth authorisation grant, authorised scopes, and connection status — we do not receive your ChatGPT password and do not persist the access token sent with a tool request;
• tool inputs that ChatGPT sends to Overhub, such as event identifiers, selected records, pasted text or text extracted by ChatGPT from a file, requested filters, and action parameters;
• tool outputs returned to ChatGPT, such as event and broadcast configuration data, validation results, summaries, and any widget data needed to display the requested result;
• temporary staged preview records, including an opaque preview identifier, proposed changes or diff, validation messages, status, and expiry information; and
• tool activity and security data, including the tool name, timestamp, outcome, error details, and request metadata needed to prevent abuse and investigate failures.

We expose only the Overhub data needed for the requested tool workflow. OpenAI may separately process your ChatGPT conversation, the tool inputs it sends, and the tool outputs it receives as described in Section 4.

g) Support requests — when you contact support, we store your messages and our replies, your name and email address where supplied or associated with your account, and screenshots you choose to upload while signed in. We use these records to handle your request.

We also store support context: the page path, browser information, and, where available for your account, an event identifier and Collector version.

Uploaded screenshots are re-encoded to remove image metadata and stored separately from public broadcast assets. In-app screenshot reads require a signed-in session for the conversation's account owner or an administrator. Screenshot responses instruct browsers not to store the image.

We do not intentionally collect special-category data (e.g. health, biometrics, political opinions). Please do not enter such data into the Service.

Where we rely on legitimate interests, we have balanced them against your rights; you may object at any time (Section 7). Where we rely on consent, you may withdraw it at any time without affecting prior processing.

We do not sell your personal data. We share it only with service providers who help us run the Service and, when you request a connected workflow, with the third-party platform involved. Providers acting as our processors are subject to contracts that require them to protect your data:

• Stripe — payment processing.
• Cloudflare — content delivery, DDoS protection, and bot verification (Turnstile).
• Google / Discord — only if you choose to sign in with them (identity verification).
• OpenAI — if you use the optional AI-import feature, or if you choose to link an available Overhub integration to ChatGPT. For a ChatGPT connection, OpenAI processes your conversation, tool inputs, and the tool outputs or widget data returned by Overhub under OpenAI's own Privacy Policy, terms, and account settings. Data retained in ChatGPT is controlled separately from data retained by Overhub.
• Other AI or search providers (e.g. Anthropic, Tavily) — only if you use the optional AI-import feature, to process the text or URL you submit.
• Telegram — support message notifications and replies in the configured support chat. Notifications may include your message text, name and email address, a thread reference and, for screenshots, an admin-inbox link. This bridge does not upload screenshot files to Telegram.
• Resend — email delivery, including support replies where enabled. This includes the recipient's email address and reply content.
• Our hosting / infrastructure provider — to store data and serve the Service.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, or property of Overhub, our users, or others.

Some service providers and third-party platforms (e.g. Stripe, Cloudflare, OpenAI, Anthropic) may process data outside the European Economic Area, including in the United States. Where we are responsible for that transfer, it is protected by an appropriate safeguard under Chapter V GDPR — the European Commission's Standard Contractual Clauses and/or, for providers certified under it, the EU–US Data Privacy Framework. You can request a copy of the relevant safeguard by emailing [email protected].

• Account and configuration data: kept while your account is active and deleted or anonymised within 90 days after you close it, except where a longer period is required for a specific legal obligation (e.g. tax) or to establish, exercise, or defend legal claims — in which case we keep only what is necessary for that purpose. Support records are described separately below.
• Support records: deleting your account removes its link to stored support conversations; it does not automatically erase their messages, contact details, or captured support context. Screenshots have no automatic age-based expiry in the current system. Successful account deletion removes screenshot records from the active database and queues stored screenshot files for removal after the transaction commits. File-removal failures remain queued for retry. These steps do not automatically remove support messages delivered to Telegram or reply emails sent to recipients.
• Billing records: for the period required by Czech accounting and tax law (generally up to 10 years).
• Security and diagnostic logs: a short rolling window (target: up to 90 days).
• OAuth connection data: the identity link is kept while the connection is authorised. We do not persist the access token sent with a tool request. After you revoke the grant with the OAuth provider, future requests using that grant are rejected under the provider's token and revocation rules. Limited security or audit records may remain for the diagnostic-log period above or where required by law.
• Staged preview records: temporary and automatically expire after 15 minutes. While a preview is active, we retain the parsed proposal needed for review and one-time apply. After apply, that proposal is redacted immediately to a minimal receipt; the applied changes become configuration data and follow the account/configuration period above. Expired previews become inaccessible immediately and are removed by routine cleanup within seven days. Routine backups may age out on their normal cycle.
• ChatGPT-side copies: OpenAI may retain conversations, tool inputs, and tool outputs under its own policy and account controls. Overhub cannot delete those copies for you.
• Game-state data: processed in real time; not retained by us as a lasting profile.

Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any of these, email [email protected]; we will respond within one month.

You can also disconnect an authorised ChatGPT / MCP connection to stop future tool access to Overhub. Disconnecting does not remove copies already retained in ChatGPT; use your OpenAI account controls or contact OpenAI for those copies.

You also have the right to lodge a complaint with your local supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), www.uoou.cz.

Source of data. Most data comes from you directly. If you sign in with Google or Discord, we receive your basic identity data (identifier, verified email, display name) from that provider. If you request an Overhub tool from ChatGPT, we receive the tool input from OpenAI on your behalf; the resulting output may include configuration data that you or your workspace previously added to Overhub. Personal data about third parties in your broadcast content comes from you.

Automated decisions. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing (Article 22 GDPR).

If you enter personal data about third parties (e.g. player or caster names, photos, or logos), you act as the controller of that data and confirm you have a lawful basis to do so. You are responsible for informing those individuals as required and for having the rights to any images or logos you upload. We process such data on your behalf to provide the Service.

Overhub sets only strictly necessary cookies — the ones the Service cannot function without, used to keep you signed in and to protect the app. Under the ePrivacy rules these do not require consent. We do not currently use any analytics, advertising, or cross-site tracking cookies.

Your theme preference and your cookie choice are stored in your browser’s local storage (not cookies) and never leave your device. If we introduce optional analytics or marketing cookies in the future, they will load only after you opt in. You can review or change your choice at any time via Cookie Settings in the footer; “Reject all” carries the same weight as “Accept all”.

We take reasonable technical and organisational measures appropriate to the risk to protect your data — including strong password hashing, encryption of data in transit (HTTPS), secure session handling, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is intended for users aged 16 or over (or the minimum digital-consent age in your country, if higher). We do not knowingly collect personal data directly from children below that age as account holders. Note that broadcast content you configure may itself contain personal data about players who are minors; where it does, you are responsible under Section 9 for having a lawful basis and any required parental consent. If you believe we hold a child's data without a proper basis, contact us and we will investigate and delete it where appropriate.

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, take reasonable steps to notify you.

Questions about this Policy or your personal data: [email protected].