Legal documents
Account, purchase and publishing rules, with separate privacy information and forms for exercising your rights.
HiLobby Terms of Service
Archived text from before the correction of 27 October 2026. It may describe outdated features. Making it available does not determine which agreement a particular person entered into.
Terms chapter index
- §1. General provisions and definitions
- §2. Technical requirements
- §3. Account
- §4. Services and plans
- §5. Plan purchases, payments and documents
- §6. Withdrawal, renewal cancellation and refunds
- §7. Creator payments and related features
- §8. Content and acceptable use
- §9. Content reports and moderation
- §10. API and webhooks
- §11. Intellectual property
- §12. Liability and availability
- §13. Complaints
- §14. Out-of-court dispute resolution
- §15. Business Users
- §16. Changes to the Terms and final provisions
§1. General provisions and definitions
- The HiLobby Service is provided by HILOBBY PROSTA SPÓŁKA AKCYJNA (the “Service Provider”). Its registered office is in Legnica. The Service Provider’s full identification and registry details are available in the Service footer.
- These Terms set out the rules for using the Service and constitute terms of electronic services under Polish law.
- A User is a person who has created an account. A Profile is a User's public page at hilobby.com/name. A Visitor is a person viewing a Profile or the Service without an account. A Consumer is a User who is a natural person acting outside a business.
- Provisions concerning Consumers also apply to a natural person concluding a contract directly related to their business activity where the contract shows that it is not of a professional nature for that person (Art. 7aa and 38a of the Polish Consumer Rights Act and Art. 3855 of the Civil Code).
- FREE accounts are available globally. Paid plans are available in countries supported by the seller, subject to applicable legal restrictions. The Service and these Terms are available in Polish and English. The contract is made in the selected language; neither version limits mandatory user rights.
§2. Technical requirements
- To use the Service you need a device with internet access, an up-to-date browser with JavaScript enabled and an e-mail address.
- Some features (e.g. OBS alerts, the API) require additional software or technical knowledge.
- Providing unlawful content and any actions that disrupt the Service are prohibited.
§3. Account
- An account may be created by an adult or by a person aged 16 or over with the consent of a legal guardian. The Service is not intended for persons under 16; the User confirms their age when registering.
- Registration is free. You provide your email, password, Profile name and the required account information and accept these Terms. The account agreement is concluded when you confirm your email. When purchasing a paid plan, the seller separately collects the information needed to fulfil and account for the order.
- Keep your login details secure, do not share them, and promptly report suspected account compromise. You can enable two-factor authentication. These duties do not exclude HiLobby's responsibility for Service security or your statutory rights.
- The User may delete the account at any time in the dashboard. Deletion takes place after a grace period during which it can be cancelled.
- The account agreement is concluded for an indefinite period and may be terminated by the User at any time.
- A User may change the Profile address (name) no more than once every 30 days, regardless of plan. The previous address redirects to the new one for 7 days and stays reserved during that time; afterwards another User may take it. The Provider may change a Profile address that infringes the law, third-party rights (e.g. a trademark, impersonation) or these Terms, and informs the User by e-mail with a justification.
- HiLobby may terminate the account agreement with 30 days' notice, explaining the reason and appeal process by email. Suspension or termination without that notice is permitted for serious or repeated breaches of law or these Terms, such as phishing, fraud or malware distribution, or when required by law or a competent authority. The measure must be proportionate. We provide reasons unless the law prohibits this. Section 9 explains appeals. Account termination does not exclude claims relating to unused paid access.
§4. Services and plans
- FREE is a free, indefinite plan available globally. PRO and PRO+ are paid plans that may be offered globally through PayPro Global in countries it supports. The access period and purchase type — one-time or subscription — are stated in the specific offer and before the order is confirmed.
- Plan features and prices are shown on the pricing page and in the account panel. Before purchase, PayPro Global displays the final price, currency, applicable taxes and any future charging schedule. Automatic renewal requires a separate, informed choice and agreement during purchase; having an account or an earlier plan does not activate it.
- Paid access starts after we receive verified payment confirmation. The access end date follows the order or paid subscription cycle. Renewal covers the stated next period; overlapping periods of the same subscription are not counted twice. Earlier purchases retain the terms confirmed when they were made.
- The Provider may offer a one-time free PRO+ trial. When it ends, the account returns to the FREE plan at no charge.
- When paid access ends, the account operates on FREE and features requiring PRO or PRO+ become unavailable. Expiry alone does not delete the account. Further data retention follows the Privacy Policy and account-deletion rules.
- The Service Provider may offer a limited number of places to buy the PRO or PRO+ plan at a reduced launch price shown in the price list. The pool of places is shared by both plans and one account takes one place. Placing an order at the launch price reserves a place for 30 minutes, and the place is assigned to the account when the order is paid. The price list states which periods the launch price covers and whether an account with a place may renew the plan at that price also after the offer ends, for as long as the account exists. The launch price cannot be combined with discount codes and a place cannot be transferred to another account. The launch price assigned to an account does not change with later changes to the price list or the offer terms. If the list price drops below the launch price, the list price applies.
- New sales through PayPro Global are available in countries it supports, subject to legal, product and payment restrictions and required verification. Available currencies and final purchase terms are displayed before payment. Customers must provide their actual country. The Service language can be selected independently of country.
§5. Plan purchases, payments and documents
- The seller of a new plan purchased through PayPro Global checkout is the PayPro Global entity identified there, acting as Merchant of Record. HiLobby remains the Service provider. Available payment methods depend on country, currency and the seller's offer. HiLobby does not store payment-card details.
- PayPro Global determines and accounts for taxes relating to its sales under applicable rules. The final charge is displayed before purchase confirmation. HiLobby remains responsible for its own obligations and settlements; using a separate seller does not remove them. Conditions of earlier paid purchases do not change automatically.
- The purchase document or invoice for a PayPro Global order is supplied by that seller under the purchase terms, including through its customer account. Billing-data corrections and adjustments for that sale are handled by the seller. Historical direct-purchase documents remain subject to the rules applicable to those purchases.
- Before placing an order through PayPro Global, the customer receives that seller's terms, including electronic-document arrangements. Documents are delivered as agreed during purchase. These Service terms do not authorize future charges or automatically accept new sale terms.
- Users may recommend the Service with a personal referral link. When the referred person pays for a plan and the refund window shown in the panel has passed, both parties receive PRO plan days under the rules and limits described in the panel. No reward is due for accounts of the same person or for referrals identified as abuse (e.g. from the same network or the same company domain). A refund cancels the reward. Rewards cannot be exchanged for money.
- The Provider may change or end the referral program with prior notice in the panel. Rewards due before the change will be granted.
- The country and other billing information supplied to the seller must be accurate. PayPro Global may require verification for taxes, offer availability and payment security. Data and documents from earlier direct purchases retain their historical accounting context.
§6. Withdrawal, renewal cancellation and refunds
Buying a plan and receiving the Service are separate matters. HiLobby provides your account and Service features. For a PayPro Global purchase, the seller is the entity identified in checkout; its sales terms and contact details are provided before payment. Transaction support is available from PayPro Global, with documents in its legal section. These roles do not restrict mandatory consumer rights or HiLobby's responsibility for its own obligations.
- Consumers generally have 14 days from concluding an online service contract to withdraw without giving a reason. Applicable law may provide greater rights. For a PayPro Global purchase, send the transaction withdrawal notice to the seller identified in your order. If you need help identifying the transaction, you can also contact HiLobby at contact@hilobby.com.
- Starting access to a digital service does not by itself remove the right to withdraw. If performance started at the Consumer's express request before the withdrawal period ended, charging for the part performed is permitted only where the statutory conditions are met. We do not treat every activated plan as automatically non-refundable.
- For purchases directly from HiLobby, including historical purchases, send your notice to contact@hilobby.com, use the contact form or the withdrawal function available for that order in the panel. We confirm receipt by email. Any refund due is made without undue delay and within 14 days of receiving the notice, generally using the original payment method. Any deduction for service already provided requires the conditions in paragraph 2 to be met.
- An unambiguous notice identifying you, the order and your decision to withdraw is sufficient. The statutory model form is optional. Sending the notice before the deadline preserves the time limit. For PayPro Global orders, the relevant seller handles the refund; HiLobby does not issue a second invoice or pay the same refund twice.
- We preserve the Consumer rights described here regardless of country of residence, without limiting greater protection under applicable law. Statutory consumer protection for qualifying sole traders also remains available. Withdrawal without giving a reason is separate from a complaint or refund claim for a service that does not conform to the contract.
- A one-time purchase does not authorise future charges. A renewable subscription requires an informed choice of its terms before payment. Stop future renewals through the seller's portal, cancellation link or support. Cancellation normally keeps access until the paid period ends; it is not by itself withdrawal or an automatic refund request. Deleting a HiLobby account does not replace cancellation with the seller: stop renewals before deleting the account. Statutory rights and more favourable earlier purchase terms remain protected.
§7. Creator payments and related features
- The User may enable Visitors to send them financial support (donations) on their Profile.
- Creators connect their own account with an available payment provider, currently SimPay or PayPal. The provider processes payments to the creator under their agreement. PayPro Global selling HiLobby plans does not process these creator payments. HiLobby does not receive or hold creator funds, maintain a creator balance, or charge a commission on these payments. The provider may charge its own fees.
- HiLobby processes confirmations from the connected provider to mark a payment as paid and enable features selected by the creator, such as history, a funding goal or an alert. Returning from checkout alone does not confirm payment.
- Creators are responsible for describing the purpose of payments, any promised benefit and their own tax obligations. Calling a payment 'support' or a 'donation' does not establish that it is legally a gift or tax-exempt. Its classification depends on the facts and applicable law.
- On the PRO plan Users may allow Visitors to attach short voice recordings to tips. A recording requires the Visitor's consent, the User decides whether it is played, and the Provider deletes recordings within the periods set out in the privacy policy. The User is responsible for the content played.
- Users may connect a Twitch or Kick channel to show its events (e.g. follows, subscriptions) in alerts. Use of those services is subject to their terms. The User may disconnect the channel in the panel at any time.
- Creators displaying a funding goal must describe it accurately and avoid misleading supporters. A goal counter does not mean that HiLobby verifies the collection, guarantees its outcome or conducts it for the creator. Creators are responsible for any applicable permissions, disclosures and accounting.
- Questions about a creator's promised benefit or a payment refund should be directed to the creator and relevant payment provider. Creators provide contact and privacy information before accepting payments. Provider procedures, including payment disputes, and the payer's statutory claims remain available. Technical problems with HiLobby forms can be reported to Service support.
- The User may collect Visitor sign-ups for their newsletter and send messages through the Service. Sign-up requires consent and e-mail confirmation, and every message includes an unsubscribe link. The User is the controller of subscriber data, is responsible for the content and sends only to people who consented. Plan-based sending limits apply.
- When supporting, a Visitor may agree to show their nickname and, depending on the User's settings, the amount and message on the Profile's supporter wall. Anonymous support is never shown there. Consent can be withdrawn by writing to the Service Provider or the User.
§8. Content and acceptable use
- The User is responsible for content published on the Profile, including links, descriptions, images and code.
- In particular, the following are prohibited: unlawful content, phishing, fraud, malware, spam, impersonation and copyright infringement.
- Custom code (HTML, CSS, JavaScript) runs in an isolated environment. Using it to collect Visitor data, bypass security or hide the Service branding where the plan does not allow it is prohibited.
- The User grants the Provider a free, non-exclusive licence to display Profile content to the extent necessary to provide the service.
- The User may store files (images, GIFs, sounds, short videos) in the Service within the per-account storage limit shown in the panel (currently 1 GB), which also includes shop product files and voice messages attached to support. Files are available at a random, hard-to-guess address so they can be shown on the Profile, and in alerts, so confidential content should not be uploaded. The Service Provider may remove a file that breaches the Terms. Files are deleted together with the account.
- We use automated word and pattern filters, limits and abuse-detection mechanisms. These do not fully verify every item's legality and may make mistakes. Depending on the result, they may prevent submission, hide content or refer it for review. Creators may configure additional filters for messages and payments. Notices and appeals are handled under section 9.
- On the PRO plan the User may add Meta, TikTok and Google Analytics 4 pixels to the Profile. The Service loads them only after the Visitor's consent in the banner on the User's page and allows withdrawing it. The User is the controller of data collected by the pixels, is responsible for the legal basis, informing Visitors (e.g. in their own privacy policy) and for contracts with pixel providers.
§9. Content reports and moderation
- Anyone may report content that is unlawful or violates these Terms using the "Report content" form or at contact@hilobby.com.
- We handle reports with due care. We may hide or remove content or suspend a Profile.
- We inform the User of the decision together with a statement of reasons, and the reporter of how the report was handled.
- The User may appeal the decision in the dashboard. The appeal is reviewed by a different person than the one who made the decision.
- The point of contact for authorities and users under the Digital Services Act (DSA) is contact@hilobby.com. Contact is possible in Polish and English.
- For moderation we use an automated content filter (§8(6)), filters set by Users, rate limits and bot detection. Decisions to remove content, hide content or suspend a Profile following a report are taken by a person. The statement of reasons says whether automated means were used and names the legal provision or clause of these Terms it relies on.
- The User affected by a decision and the person who made the report may appeal within 6 months of being informed of the decision: the User in the dashboard, and the reporter by replying to the decision e-mail or writing to contact@hilobby.com. Independently, they may use a certified out-of-court dispute settlement body (Art. 21 of the Digital Services Act) or go to court.
- After a prior warning, we may suspend for a reasonable period an account that frequently posts manifestly illegal content, or stop handling reports from a person who frequently submits manifestly unfounded reports. We inform the competent authorities of any suspected criminal offence threatening the life or safety of persons.
§10. API and webhooks
- In the PRO+ plan the User may use the API in accordance with the documentation. API keys are confidential and the User is responsible for protecting them.
- Rate limits apply. Circumventing limits or using the API in a way that overloads the Service is prohibited.
- Data retrieved via the API (e.g. supporter email addresses) is processed by the User as its controller, in line with the GDPR.
§11. Intellectual property
- The Service, its software, templates and trademarks are protected by law. The User may use them only within the Service.
- Users must hold the required rights for music, recordings, images and content embedded from external services and comply with those services' terms. A player provided by HiLobby does not grant a music licence or public-performance rights. Where we supply particular material under an open licence, we state its conditions and required attribution.
§12. Liability and availability
- The Provider makes every effort to keep the Service running continuously but may carry out maintenance, where possible outside peak hours.
- Authors are responsible for their content and external providers for their services to the extent required by law and their contracts. This does not exclude HiLobby's responsibility for its own acts or omissions, duties concerning reported illegal content, or conformity of its Service with the contract. Mandatory consumer rights are not restricted.
- Towards Users who are not Consumers (subject to §1(4)), the Provider's liability is limited to the amount paid for the plan in the last 12 months. This limitation does not apply to damage caused intentionally.
§13. Complaints
- Complaints about the Service can be sent to contact@hilobby.com or through the contact form in the Service.
- Helpful complaint details include your account email, the problem, approximate event date and requested resolution. An order number helps with payment issues. Do not send passwords, full card details or integration keys. Omitting unnecessary details or using another method does not remove statutory complaint rights.
- We respond to Consumer complaints within 14 days of receipt unless applicable law sets a different period; shorter mandatory deadlines remain protected. We reply by email on a durable medium. HiLobby handles Service-operation complaints. The seller identified in a PayPro Global order handles transaction-settlement requests; we help identify the appropriate contact without excluding responsibility for our own Service.
- The Service Provider is responsible to the Consumer for conformity of the paid plan (digital service) with the contract under Chapter 5b of the Polish Consumer Rights Act. Subject to statutory conditions, remedies include bringing the service into conformity, a price reduction or termination of the contract. The absence of discretionary refunds does not restrict those rights.
§14. Out-of-court dispute resolution
- A Consumer may seek help from a municipal or district consumer ombudsman or the regional Trade Inspection office.
- Using out-of-court dispute resolution is voluntary.
- A Consumer from another EU country may ask the European Consumer Centre in their country (ECC-Net) or the competent national out-of-court dispute resolution body for help.
§15. Business Users
- Businesses may use HiLobby. Creators accepting payments in their own name are responsible for their relationship with supporters, required disclosures and their own accounting. Tax classification depends on the payment's actual purpose and any benefit supplied in return, not the feature's name. Providing a form alone does not make HiLobby a party to an agreement between creator and supporter.
- We give at least 15 days' notice of planned changes. Where applicable law, including the P2B Regulation where it applies, requires more time for technical or commercial adjustments, we allow the appropriate longer period. Businesses may terminate before the changes take effect. Restrictions and termination are explained on a durable medium; section 3 paragraph 7 describes the 30-day notice period and exceptions.
- The Service does not run a joint search engine or ranking of User profiles, does not treat differently creators using other tools and does not limit showing the same content in other channels.
- A business has access to data on its donations and supporters in the dashboard and by export. Complaints are handled under §13.
§16. Changes to the Terms and final provisions
- Changes may be required by law, to clarify ambiguities, improve security or reflect an actual change to the described services. Their scope must match their reason. We notify users of contractual changes by email and in the panel at least 15 days in advance, or earlier where law or necessary adjustments require it. The notice identifies the text, reason, effective date and termination procedure. Changes are not retroactive, do not remove acquired rights and do not by themselves alter the price of a paid period. Users may terminate before a change takes effect by contacting HiLobby; they are not required to use only account deletion. Changes to a digital service also remain subject to statutory notices and a 30-day termination right where they materially and negatively affect access or use, unless the law permits continued unchanged access without extra cost instead.
- Polish law applies. The choice of law does not deprive a Consumer of the protection of the mandatory rules of the country of their habitual residence. A Consumer may bring proceedings in the courts of their country of residence or of the Provider's country; disputes with businesses are settled by the court competent for the Provider's registered office.
- Matters not covered here are governed by the Polish Civil Code, the Consumer Rights Act, the Electronic Services Act and the Digital Services Act (Regulation (EU) 2022/2065).
Contact
Questions about the Terms: contact@hilobby.com
Privacy policy
1. Data controller
The personal data controller is HILOBBY PROSTA SPÓŁKA AKCYJNA, UL. POZNAŃSKA 43/63A lok. 5, 59-220 LEGNICA, tax ID 6912599142, KRS 0001274987, REGON 54601954800000, SĄD REJONOWY DLA WROCŁAWIA FABRYCZNEJ WE WROCŁAWIU, IX WYDZIAŁ GOSPODARCZY KRAJOWEGO REJESTRU SĄDOWEGO, Share capital: 300,00 PLN. For data protection matters write to contact@hilobby.com.
We have not appointed a data protection officer. All requests are handled via contact@hilobby.com and the form below.
2. Our roles
We process Users' data (account, payments, Service analytics) as controller. Data that Visitors give to Profile owners (messages, donations, shop orders) is processed on behalf of the Profile owner under the data processing agreement described at the end of this page.
Providing data is voluntary, but without the data marked as required in forms you cannot create an account, buy a plan or use the feature concerned. When buying a plan, the details needed for tax purposes (e.g. country, VAT number) are required by law.
3. What data we collect, why and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account and login | e-mail, password hash, Profile name, country, account type (private or business), language, registration date, settings, 2FA codes | performance of a contract (Art. 6(1)(b) GDPR) | until account deletion |
| Public profile | content you publish: name, bio, links, images, music, code | performance of a contract (Art. 6(1)(b) GDPR) | until the content or account is deleted |
| Payments and invoices | order, amount, transaction status and ID, invoice details | contract and legal obligation (Art. 6(1)(b) and (c) GDPR) | HiLobby's own tax records: generally 5 years from the end of the calendar year in which the relevant tax payment was due. Suspension or interruption of the limitation period and an open case may extend this period. |
| VAT processing and tax records | country of residence or establishment, billing address, company name and EU VAT number with the VIES check result, currency, tax rate and amount, evidence of the place of supply (country of the IP address, country given at purchase, country of the payment method) | legal obligation under VAT law (Art. 6(1)(c) GDPR) | Where HiLobby accounts for a transaction through VAT OSS: records and customer-location evidence for 10 years from the end of the transaction year. Other HiLobby tax records follow the tax-payment deadline described in the preceding row. |
| Security and abuse prevention | IP address, browser, login time and result, approximate login country | legitimate interest (Art. 6(1)(f) GDPR) | server logs 30 days, login history 12 months |
| Visit statistics for the Service and Profiles | approximate location (country, region, city), device, operating system, browser, language, time zone, screen resolution, referring page and UTM parameters, time on page, scroll depth, link clicks, daily visitor hash | legitimate interest: statistics for Profile owners and Service development (Art. 6(1)(f) GDPR); you may object | events 26 months, then aggregate data only; the visitor hash changes daily |
| Extended analytics (returning visits) | random browser identifier lp_aid, pages visited | consent (Art. 6(1)(a) GDPR, Art. 399 of the Polish Electronic Communications Act) | 13 months |
| Campaign measurement | campaign source remembered until sign-up (lp_ref) | consent (Art. 6(1)(a) GDPR, Art. 399 of the Polish Electronic Communications Act) | 30 days |
| Service improvement | use of dashboard features linked to the account | legitimate interest (Art. 6(1)(f) GDPR) | 14 months |
| Newsletter | e-mail, date and wording of consent | mailings: consent (GDPR Article 6(1)(a) and Article 398 of Poland's Electronic Communications Law); consent evidence: accountability and, where necessary, defending claims (Article 6(1)(f)) | Mailing data: until unsubscribe or withdrawal of consent. Minimal consent evidence: while the processing relying on it continues, then for 3 years from the end of the year in which that processing ended; longer only for a specific case under a separate basis. |
| Respecting marketing unsubscribes and objections | Minimal HMAC of the address, block scope and creation date; this is not a mailing list | respecting withdrawal and objections, and preventing renewed unlawful mailings (GDPR Articles 6(1)(c), 6(1)(f) and 21) | While marketing within that scope continues, to avoid restarting mailings to an unsubscribed person. We review the need for the block at least annually. We remove it when that purpose permanently ends or after a new confirmed subscription; we do not use it for marketing. |
| Contact and support | name, e-mail, message, ticket number | legitimate interest (Art. 6(1)(f) GDPR) | Routine questions and support: 12 months after the response concluding the case or its closure. Complaints, disputes and accounting evidence are classified separately, using the criteria below this table. |
| API and webhooks | keys (hashed), request log with API client IP address, webhook addresses and delivery history | performance of a contract (Art. 6(1)(b) GDPR) | 30 days |
| Content reports and moderation | report content, decision, reporter details | legal obligation under the Digital Services Act (Art. 6(1)(c) GDPR) | 24 months |
| Data requests | requester details, request content and outcome | handling rights and accountability: legal obligation (GDPR Article 6(1)(c)); separately, where necessary, establishing or defending claims (Article 6(1)(f)) | In the request register, we remove excess description and reasoning 30 days after closure unless needed for a specific case. We retain a minimal handling record for 3 years from the end of the year in which the request was closed. |
| Proof of cookie consent | time, chosen categories, banner version | accountability (Art. 7(1) GDPR) | The browser choice is valid for up to 180 days. We retain minimal evidence during that validity period and then for 3 years from the end of the year in which it expired; a specific open case may require longer retention. |
| Messages from Visitors | content, optional sender e-mail, time | on behalf of the Profile owner (Art. 28 GDPR) | 12 months |
| Donations | nickname, amount, message, optional e-mail, transaction ID | on behalf of the Profile owner (Art. 28 GDPR) | while the Profile owner uses donations; billing data as required by law |
| Users’ fan newsletters | e-mail, name (optional), sign-up source, consent text and date, confirmation and unsubscribe dates, queued messages | Visitor consent (Art. 6(1)(a) GDPR); processed on behalf of the Profile owner (Art. 28 GDPR) | Active recipients: until unsubscribe or a lawful instruction from the Profile owner. Unconfirmed subscriptions: 30 days. Minimal consent evidence: during processing and for 3 years from the end of the year in which it ends. Terminal queued-message content: 90 days. The Profile owner remains controller of their recipients' data. |
| Video play requests | YouTube video link, nickname, tip amount | on behalf of the Profile owner (Art. 28 GDPR) | while the Profile owner uses donations; billing data as required by law |
| File library | files you upload (images, GIFs, sounds, videos), file name, size and dimensions; photo metadata (e.g. camera location) is removed on upload | performance of a contract (Art. 6(1)(b) GDPR) | until the file or the account is deleted |
| Supporter wall | the supporter's nickname and, depending on the creator's settings, the amount and message, date of support | Visitor consent (Art. 6(1)(a) GDPR); processed on behalf of the Profile owner (Art. 28 GDPR) | until consent is withdrawn or the support data is deleted |
| Content filter and automated moderation | the text of checked messages and descriptions, the filter result; the log keeps only the category and a short excerpt with numbers and e-mail addresses masked | legal obligation under the Digital Services Act (Art. 6(1)(c) GDPR) | hit log 90 days |
| Push notifications in the browser and app | browser subscription address (endpoint), encryption keys, short browser name, delivery dates; notification content is encrypted before sending | performance of a contract (Art. 6(1)(b) GDPR) | until notifications are turned off on the device or the subscription expires (we delete it after repeated failed deliveries) |
| Creators' advertising and analytics pixels (PRO) | pixel identifiers in Profile settings; the Visitor's consent stored in their browser. Events (e.g. page view, purchase) are sent by the browser directly to the pixel provider; we do not store them | Visitor's consent (Art. 6(1)(a) GDPR, Art. 399 of the Electronic Communications Law); the Profile owner is the controller of pixel data | identifiers until deleted by the User; consent until withdrawn |
The 12-month routine-contact period and 3-year minimal-evidence periods are HiLobby's retention policy, not a single GDPR deadline for all data. We limit evidence to what is needed for accountability and the specific purpose; open requests are not deleted as closed cases are.
Evidence for a specific complaint, dispute or proceeding is kept until it ends and the applicable claims period expires, allowing for suspension or interruption of limitation. A deletion hold must identify the case and its justification and is subject to review. Rules may depend on the country and claim type; an unclassified case does not justify indefinite retention.
Where a separate seller handles a purchase, that seller's privacy policy describes retention of its records. HiLobby remains separately responsible for its own records and settlements. Changing the seller does not shorten mandatory periods for earlier transactions.
Analytics and location
Statistics help Profile owners understand their audience and help us develop the Service. For each visit we record an event (view, click, message, donation) with the following data:
- Approximate location: country, region and city determined from the IP address at the time of the visit using a local geolocation database (IP Geolocation by DB-IP). The IP address itself is not stored in statistics and is not sent to the database provider.
- Device and software: device type, operating system, browser, browser language.
- Browser data when leaving the page: time on page, scroll depth, screen resolution and time zone. They are sent once, without cookies and without an identifier.
- Visit source: referring domain, UTM parameters, QR code scan information.
- Uniqueness: a daily hash created from the IP address, browser and date. It changes every day and cannot be used to identify a person or track them across days.
- Automated traffic: bot visits are flagged and excluded from statistics.
Profile owners see aggregate data only (e.g. the number of views from a given city) and cannot identify individual visitors. We do not use this data for advertising or profiling and we do not sell it.
You may object to this analytics by writing to us. Extended analytics (returning visits) and campaign measurement work only after consent is given in the cookie banner.
A creator may share a media kit from their statistics with brands. It contains aggregated data only (totals and percentages, e.g. audience countries and devices), with no data that identifies visitors.
Company analytics data (sharing with partners)
Aggregate statistics (including cumulative summaries for creators) may be shared with HiLobby's business partners in bulk and anonymized, without data identifying individual persons, only on the explicit permissions described in this document.
Sharing of analytics data with partners: only on the basis of your consent marked in the cookie settings (analytics category). You can withdraw it at any time.
4. Data recipients
We share data only with parties that help us provide the service, acting under data processing agreements or as separate controllers:
- server and hosting provider (data centres in the European Union),
- the PayPro Global plan seller identified in the order, acting as a separate controller for transaction data; for creator payments, the provider selected by the creator, currently SimPay or PayPal, under its own privacy policy,
- the e-mail delivery provider,
- Profile owners to whom you provide data (messages, donations),
- Twitch Interactive, Inc. (USA) and Kick Streaming Pty Ltd (Australia) – only if the User connects a channel; we exchange with them the data needed for authorisation and event subscriptions,
- Google (YouTube) and Vimeo.com, Inc. (USA) – when you watch a video embedded in a play request or a profile; the player loads from their servers and they, as separate controllers, receive e.g. your IP address and may store information in your browser,
- the content delivery network (CDN) and attack protection provider through which traffic to the Service may pass (it receives e.g. the IP address and technical request data),
- push notification services built into browsers (e.g. Google, Mozilla, Apple, Microsoft) – only if you turn on notifications; notification content is encrypted and the provider cannot read it,
- pixel providers (Meta, TikTok, Google) – only on Profiles whose owner has enabled pixels and only after your consent in the banner; they receive data directly from your browser and the Profile owner is the controller,
- an accounting office or accounting software provider receiving donation statements and invoices, and tax authorities
- public authorities where required by law.
5. Transfers outside the EEA
As a rule we do not transfer data outside the EEA. The music player on profiles (YouTube) loads automatically from Google/YouTube servers under their rules; details are in the cookies section.
After a User connects a channel we exchange data with Twitch (USA) and Kick (Australia). Transfers rely on Chapter V GDPR mechanisms (e.g. an adequacy decision or standard contractual clauses) or, where necessary to provide the service requested by the User, on Art. 49(1)(b) GDPR.
The payment provider, the CDN provider, push notification services and pixel providers may process data outside the EEA (e.g. in the USA). In that case the transfer is based on the mechanisms of Chapter V GDPR, e.g. a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
The Service is directed at people in the EU. If you visit Profiles from outside the EU, you send your data directly to us, and we store it in the European Union under this policy.
6. Profiling and automated decisions
We do not make decisions with legal effects solely automatically. Automated protection mechanisms (a filter for unlawful content, word and link filters set by creators, limits, bot detection) may block content or hold it for human review. You can appeal such a decision.
Referral abuse detection automatically compares masked IP addresses and e-mail domains of accounts. The result may withhold a referral reward. You may ask for human review of the decision by writing to the contact address.
Your rights
- access to data and a copy (Art. 15) and data portability (Art. 20),
- rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
- objection to processing based on legitimate interest (Art. 21), including level 1 analytics,
- withdrawal of consent at any time, without affecting earlier processing (via "Cookie settings" in the footer or in the panel),
- lodge a complaint with a supervisory authority: in Poland the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw), or the authority in the EU country of your habitual residence or place of work (Art. 77 GDPR).
You can export your data and delete your account yourself in the dashboard (Account and privacy). Other rights can be exercised via the form below or by writing to contact@hilobby.com.
7. Security
We use encrypted connections (HTTPS), password hashing, encryption of provider keys and secrets, two-step verification, rate limiting, security logs and encrypted backups.
Database and file backups are encrypted and kept in data centres in the European Union, also outside the Service server, for up to 60 days. Data deleted from the Service disappears from the backups no later than after this period.
8. Children and the Global Privacy Control signal
We do not sell personal data. We treat a Global Privacy Control signal sent by your browser as a refusal of optional consents in the cookie banner.
The Service is not directed at children under 16. If we learn of an account belonging to such a person, we will delete it.
9. Changes to this policy
We will inform you of significant changes to this privacy policy by e-mail and in the dashboard before they take effect.
Cookie policy
We use cookies and browser storage only as described below. Categories other than necessary work only after consent in the banner, which you can change at any time.
| Name | Category | Purpose | Validity |
|---|---|---|---|
__Host-sid or __Secure-sid | essential | session (login) and form security (a CSRF token stored on the server) | browser session |
lp_self | essential (at your request) | excluding your visits from your own profile statistics (you enable it in the panel) | 12 months |
lp_m… | essential (at your request) | access to a creator's supporters area after clicking the e-mail link (only on that creator's club page) | 180 days |
lp_ck (browser storage) | essential | recording your consent choice and the banner version | Up to 180 days; we then ask for a new choice without automatically granting consent |
lp_cur | essential (at your request) | Price currency chosen with the switch in the footer or the price list (PLN, EUR or USD). Without a choice we suggest the currency from your IP address country and store nothing. | 12 months |
lp_lang | essential (at your request) | remembering the chosen language of the Service (Polish or English) | 12 months |
lp_aid | analytics (consent) | a random browser identifier for extended analytics, no personal data | 13 months |
lp_ref | marketing (consent) | remembering the campaign source until sign-up | 30 days |
lp_px_… (browser storage) | essential | stores your consent to pixels on a given creator's Profile (only if the creator has enabled pixels) | until consent is withdrawn |
lp_pxo_… (browser storage) | marketing (consent) | prevents a purchase being counted twice by pixels (only after consent to pixels) | until browser data is cleared |
lp-offline-… (app cache) | essential (at your request) | offline page of the dashboard installed as an app (PWA) | until browser data is cleared |
__cf_bm, cf_clearance | essential | bot and attack protection set by the CDN provider (only when traffic passes through the CDN) | 30 min – up to 1 year |
- Visit statistics (location from IP, device, time on page, scrolling, screen) work without cookies and without storing data on your device.
- Meta, TikTok or Google Analytics 4 pixels on their Profile
- External content: the music player (YouTube) on profiles loads automatically when the profile with the track opens; it may set its own cookies and transfer data outside the EEA per YouTube rules. Google is the controller of that player's data. If you do not accept it, press play manually or block YouTube cookies in your browser.
- User profiles: HiLobby does not set its own analytics or advertising cookies on profiles. Creators' pixels work only after consent (see above). Any own tools added in code by the profile owner are their responsibility.
- You can also delete or block cookies in your browser settings, which may limit logging in.
Report content or a profile
If you believe a profile or link breaks the law or the Terms (e.g. phishing, copyright infringement, illegal content, impersonation), report it below. We will confirm receipt automatically, and a person makes the decision. The profile owner receives a statement of reasons and can appeal.
Data processing agreement
The provisions below form a data processing agreement (Art. 28 GDPR) between the User as controller and the Provider as processor, covering Visitor data passed to the User through the Service. By accepting the Terms, the User enters into this agreement.
- Subject and duration: storing and sharing messages, donation data (including voice recordings), newsletter subscribers and events from connected streaming services for as long as these features are used.
- Scope: name or nickname, email address, message content, voice recording, amount, newsletter consent data, transaction identifier, streaming service events. This data summary in the Fans tab serves the User only.
- The Provider processes data only on the User's documented instructions, ensures the confidentiality of persons with access and applies the security measures described in the privacy policy.
- The User agrees to the use of sub-processors: the hosting provider, the e-mail delivery provider and the content delivery network (CDN) provider. We give advance notice of changes and the User may object.
- The Provider assists the User in fulfilling data subject rights and notifies personal data breaches without undue delay.
- When the agreement ends, the Provider deletes the data unless the law requires it to be retained.
- The User may carry out an audit at an agreed time, to the extent necessary to demonstrate compliance with Art. 28 GDPR.
Digital accessibility
We design the Service in line with WCAG 2.1 level AA and EN 301 549: keyboard operation, visible focus, labelled form fields, sufficient contrast, text alternatives, a working layout on phones and with enlarged text, and reduced animation when this preference is set in the system.
Known limitations: content added by Users (images, videos, custom code, embedded players) may not meet these requirements, and the Profile's author is responsible for its accessibility. Custom Profile colours and backgrounds may reduce contrast.
You can report an accessibility barrier using the contact form or at contact@hilobby.com. You can also ask for information in another format that is accessible to you.
If you are not satisfied with our response, you can contact the President of the State Fund for Rehabilitation of Disabled Persons (PFRON), which supervises the accessibility of services in Poland, or the market surveillance authority in your EU country.