PRIVACY

Controller

404 Goods UG (haftungsbeschränkt), Gärtnerstraße 20, 10245 Berlin, Germany. Contact: 404goods@gmail.com, phone +49 30 35517092.

The short version

There are no accounts and no user profiles. We do not track you across the web, we run no advertising pixels, and we do not sell anything to anyone. What we store is what a purchase needs and what the law requires us to keep.

Visiting the site

Our hosting provider processes the technical data your browser sends with every request — IP address, time, requested page, user agent — to deliver the site and to defend against attacks. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in operating a functioning and secure website.

When you buy

We store, for each purchase:

the display name you entered, both as you typed it and as it was shown after moderation; the result of that moderation; the amount and currency; the seconds credited; the identifier of the payment; the referral name from the address you arrived through, if any; and the time.

Legal basis: Art. 6(1)(b) GDPR, performance of the contract. For the record of what was originally typed, Art. 6(1)(f) GDPR — our legitimate interest in being able to demonstrate what someone attempted to display to a public audience.

We never receive your card details. Payment data is entered on the payment provider’s own page and processed by them.

Display of your name

The moderated name is shown publicly in the livestream and on the website for a few seconds. Anyone watching can see it, record it and republish it. Do not enter anything you would not want to be public and permanent. The original text you typed is never shown publicly.

Automated name checking

Before display, the name is checked automatically — first against a fixed blocklist, then by an AI service. This is not a decision with legal effect on you within the meaning of Art. 22 GDPR: your payment is valid either way and the time is credited either way. Only the displayed text changes. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in not broadcasting illegal or hateful content to a public audience.

Processors

Stripe — payment processing. Stripe Payments Europe Ltd., Ireland, with transfers to Stripe Inc., USA.
Supabase — database, hosted in Frankfurt, Germany.
Vercel — website hosting and delivery, Vercel Inc., USA.
Anthropic — automated name checking, Anthropic PBC, USA. Only the entered name is transmitted, without your payment data.

Where a processor is based outside the EU or processes data there, the transfer is covered by the European Commission’s standard contractual clauses or an adequacy decision.

Nothing is stored on your device

We set no cookies and store nothing in your browser — no analytics, no advertising, no convenience values. If you arrive through an address that carries a streamer’s name, that name travels with the purchase you make on that page and is not remembered afterwards.

How long we keep it

The publicly displayed name stays with the record of that Bob’s lifetime. The originally entered text is deleted after 90 days unless we need it longer to pursue or defend a specific case of abuse. Records that document a payment are kept for the statutory retention periods under German commercial and tax law, currently up to ten years.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Write to 404goods@gmail.com.

Because purchases carry no account, please include the payment identifier from your receipt — otherwise we cannot reliably connect a request to a record.

You may also complain to a supervisory authority. The one responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.