Privacy Policy

1. Data Controller Information

The data controller responsible for personal data processed on PromoHub is:

• Controller: Nikolay Rusev
• Address: Walther-Bauersfeld-Straße 43, 73447 Oberkochen, Germany
• Contact Email: support@promohub.me
• Website: https://www.wernelo.com

PromoHub is operated by Nikolay Rusev as an individual. There is no registered legal entity under the name “PromoHub”.

2. Information We Collect

We collect information directly from you when you provide it, automatically when you use the Platform, and from third-party authentication providers when you choose to connect an external account.

2.1 Account & Profile Information

• Hub Email/Password Accounts: When registering directly, we collect your email address, a salted cryptographic hash of your password (generated using bcrypt; we never store or see your plaintext password), chosen username, display name, and optional profile details including bio, avatar image, banner image, date of birth, and social media links.
• Google Single Sign-On (OAuth): If you sign up or log in using Google, we receive your Google Account ID, primary email address, display name, and avatar image URL via Google OAuth2.
• Discord Directory Authentication (OAuth): If you connect your Discord account to manage Discord servers, we receive your Discord User ID, username, discriminator/handle, avatar hash, and public guild metadata (including server IDs, names, icons, and administrator permissions) via the Discord API.

2.2 Content, Community & Interaction Data

• Posts & Uploads: Post text, categorization tags, external links, and up to 15 uploaded images per post (stored on Cloudflare R2).
• Social Engagement: Likes, saved posts (“bookmarks”), comments, replies, user follows, and personal user blocking lists.
• Server Listings & Activity: Discord server listings, bump timestamps, automated bump configurations, server tags, and written community reviews (star ratings and review text).
• Reports & Appeals: Information submitted when reporting posts, comments, or servers, as well as explanation statements submitted via our in-platform post or account appeal forms.
• Contact Inquiries: Information submitted through our /contact form, including your name, email address, subject, Discord handle, and message body.

2.3 Technical, Device & Session Data

• Active Login Sessions (WebSession): For logged-in Hub users, our database records active login sessions, including your IP address, browser type and version, operating system, device type, lastActive timestamp, and session expiration timestamp.
• Live Discovery Metrics (/api/live/track): When interacting with our /live stream discovery feature, our system records operational metrics to display aggregate viewership, including watch duration, stream channel, platform (Twitch or Kick), player click events, and playback error logs. These metrics are processed temporarily via in-memory caching (Redis) and tabulated in aggregate.
• Infrastructure & Security Logs: Standard network requests processed by our hosting and CDN providers (Vercel and Cloudflare) process IP addresses, request URLs, and User-Agent headers for DDoS protection, rate-limiting, and network security.

3. Purposes of Processing

We process personal information for the following operational and technical purposes:

4. Public Visibility vs. Private Data

4.1 What Is Publicly Visible

PromoHub is a public community and discovery platform. The following information is publicly accessible to any visitor:

• Your public profile (username/handle, display name, avatar, banner, bio, join date, connected social links, follower and following counts);
• Posts you publish, including uploaded images, tags, external links, and publication timestamps;
• Comments and replies you leave on public posts;
• Discord server listings, bump counts, leaderboard rankings, and server reviews you submit;
• Administrative badges (e.g., “Official Partner”, “PRO”, “Staff”).

Profile Privacy Controls: Users can toggle their profile privacy in account settings to make their profile private or restrict visibility.

4.2 What Remains Private

The following data is treated as private and is not exposed publicly:

• Your email address (unless you explicitly enable “Show Email Publicly” in your privacy settings);
• Your password hash;
• Your exact date of birth;
• Your saved posts (“bookmarks”) and personal user block list;
• Your in-platform live follows;
• Your IP address, browser/device information, and active session details;
• Reports you file against other users or content;
• Private support or contact form correspondence.

5. Third-Party Service Providers

We utilize third-party infrastructure and service providers to operate PromoHub:

• Cloudflare, Inc. (USA / Global): Provides Content Delivery Network (CDN) services, DNS routing, DDoS protection, web application firewall, and Cloudflare R2 cloud object storage for user-uploaded images.
• Vercel, Inc. (USA / Global): Hosts our Next.js web application and serverless API endpoints, and provides performance telemetry via Vercel Analytics and Speed Insights.
• Google LLC (USA / Global):
  • Google OAuth2: Provides authentication if you choose to sign in using Google.
  • Google Workspace / Gmail SMTP: Relays transactional emails (such as email verification codes and password reset links) via encrypted SMTP (smtp.gmail.com).
  • Google Search Console: Used solely as an external webmaster tool for search engine index management and search performance analytics. Google Search Console does not install visitor tracking scripts, pixels, or client-side tracking cookies on PromoHub.
• Discord Inc. (USA): Provides authentication for Discord server administrators via Discord OAuth, powers the PromoHub Discord bot, and receives internal alerts for /contact form submissions via private Discord webhooks.
• Redis / Upstash (Global / EU): Provides high-performance in-memory caching, rate-limiting, and temporary aggregation of /live stream viewing telemetry.
• Twitch Interactive, Inc. (Amazon) & Kick Gaming: Provide embedded third-party video players and live chat iframes on our /live pages. When you load these embeds, your browser establishes a direct connection to Twitch or Kick servers.

6. International Data Transfers

PromoHub is operated from Germany. However, some of our technical infrastructure providers (including Cloudflare, Vercel, Google, and Discord) are based in or operate server networks in the United States and other countries outside the European Economic Area (EEA).

As a result, your personal data may be transferred to or processed on servers outside the EEA in connection with the technical operation of the Platform. We use established infrastructure providers and implement transport security measures (such as TLS encryption in transit) to safeguard data during transmission.

7. Data Retention & Account Deletion

7.1 Retention Standards

• Account & Profile Data: Retained as long as your account remains active or until you initiate deletion.
• Active Sessions: Web session records in the database automatically expire after 30 days of inactivity.
• Live Stream Tracking: Viewing metrics in temporary cache (Redis) are aggregated and cleared periodically.
• Server Logs: Retained for operational security, debugging, and abuse prevention for as long as necessary for those purposes.

7.2 Post Deletion vs. Account Deletion (Cloudflare R2 Storage)

• Individual Post Deletion: When you delete an individual post, the associated database records are removed, and our system initiates the deletion of associated image files stored in Cloudflare R2.
• Account Deletion: You may delete your account at any time via Settings > Danger Zone. When confirmed, all database records (credentials, profile, sessions, posts, comments, likes, saves, follows) are permanently removed.

8. Children's Privacy & Age Limitations (12+)

8.1 12+ Minimum Platform Rule

Under our platform rules, users must be at least 12 years old to use PromoHub. We do not intentionally solicit or collect personal data from anyone under the age of 12. If you are under 12, you must not create an account or provide any personal information to PromoHub.

8.3 Applicable Laws & Parental Consent

Setting our platform eligibility rule to 12 years of age does not claim or imply that 12 years automatically satisfies the legal age of digital consent in every country.

Depending on your jurisdiction, applicable data protection laws may establish higher statutory age requirements or require verified parental consent before personal data can be collected or processed online.

Users who require parental authorization under their local laws must obtain permission from a parent or legal guardian before using PromoHub.

8.4 Inquiries & Account Removal

PromoHub does not automatically detect underage accounts. If you are a parent or guardian and learn that a child under 12—or a minor who lacks legally required parental consent—has registered an account or provided personal data, please notify us at support@promohub.me.

Upon receiving notification, we will take prompt steps to investigate, suspend the account, and delete the associated personal data from our database.

9. Your Data Rights

Depending on your jurisdiction (including if you reside in the European Economic Area or United Kingdom), you may have statutory rights regarding your personal data, which may include:

• Right of Access: You may request confirmation of whether your data is processed and obtain a copy.
• Right to Rectification: You can edit your profile information directly through your account settings.
• Right to Erasure: You can delete your account and associated database records via account settings.
• Right to Restriction & Objection: You may object to or request restrictions on processing based on legitimate interests under statutory conditions.
• Right to Data Portability: You may request a machine-readable copy of the personal data you provided to us.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw consent at any time.

To exercise any of these rights, you may use your account settings or contact us at support@promohub.me.

9.1 Supervisory Authority Complaints

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State of your habitual residence or place of an alleged infringement. In Germany, this is typically the State Commissioner for Data Protection (Landesdatenschutzbeauftragter) of Baden-Württemberg (the federal state in which the Operator resides).

10. Security Measures

We implement industry-standard technical safeguards to protect personal information:

• All network traffic across PromoHub is encrypted using Transport Layer Security (HTTPS/TLS 1.3).
• Account passwords are encrypted using salted hashing algorithms (bcrypt).
• User login sessions (hub_session) are encrypted using HMAC-SHA256 signed tokens stored in HttpOnly, Secure, SameSite=Lax cookies.
• Access to databases and cloud storage infrastructure is restricted to the Operator through multi-factor authentication.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our platform practices or applicable legal requirements. Revisions will be published on this page with an updated “Last Updated” date.

12. Contact & Inquiries

For questions or inquiries regarding this Privacy Policy or your personal data, please contact:

• Email: support@promohub.me
• Subject: Privacy Inquiry
• Postal Address: Nikolay Rusev, Walther-Bauersfeld-Straße 43, 73447 Oberkochen, Germany