Privacy Policy

This is a courtesy translation. In case of any discrepancy, the Spanish version (Política de Privacidad) prevails.

This Privacy Policy (the “Policy”) describes how BLACKLINE SPA, a joint-stock company incorporated in Chile, Tax ID (RUT) 76.163.084-9, hereinafter “XtreamCast”, “we” or the “Controller”, collects, uses, stores, shares and protects the personal data of those who access or use our services available at xtreamcast.co, the client panel, API, SDK and related services (collectively, the “Service”).

This Policy is written to comply with the regulatory frameworks applicable to our users worldwide, in particular:

• Chile: Law No. 21.719 on Personal Data Protection and complementary regulations.
• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.
• Argentina: Law No. 25.326 on Personal Data Protection.
• Colombia: Law 1581 of 2012, Decree 1377 of 2013 and concordant rules.
• Peru: Law No. 29733 on Personal Data Protection and its Regulations.
• European Union / EEA: Regulation (EU) 2016/679 (GDPR), where applicable.

1. Identity and details of the Controller

The controller of your personal data is BLACKLINE SPA, Tax ID (RUT) 76.163.084-9, with registered address in Santiago, Región Metropolitana, Chile. For any privacy question or to exercise your rights, contact our Data Protection Officer (DPO):

• DPO email: privacidad@xtreamcast.co
• General contact email: contacto@xtreamcast.co
• WhatsApp: +56 9 8941 7771

2. Personal data we collect

We collect the following categories of data, depending on how you interact with the Service:

2.1. Data you provide to us

• Account data: first name, last name, email address, encrypted password, company name, role and country.
• Billing data: legal name, tax identifier (Chilean RUT for local invoicing; other tax identifiers are received only for the international receipt), billing address and payment method. Card data is tokenized directly by the processor (GetNet, Khipu or PayPal as applicable) — XtreamCast does not store full card numbers.
• Communications data: content of support tickets, WhatsApp messages and emails.

2.2. Data collected automatically

• Technical data: IP address, device identifiers, browser type and version, operating system, language and time zone.
• Streaming Service usage data: broadcast metrics (bitrate, resolution, duration, concurrent viewers, latency, errors), referrer URLs and player events.
• Cookies and similar technologies: session, authentication and preference cookies and, with your consent, analytics and marketing cookies. See Section 9.

2.3. End-viewer data (where applicable)

When a client embeds our player or uses our API on their site, we may collect technical data from end viewers (IP, device, session duration) on behalf of and under the instructions of that client. In that scenario the client acts as Controller and XtreamCast as Processor.

3. Purposes of processing

We process your personal data for the following purposes:

• Provision, operation and maintenance of the contracted Service.
• Account management, authentication and technical support.
• Billing, collection and compliance with tax obligations (DTE/SII, CFDI/SAT, AFIP, DIAN, SUNAT, as applicable).
• Transactional communications about the Service (maintenance notices, incidents, plan changes).
• Service improvement, fault diagnosis and aggregated statistical analysis.
• Compliance with legal obligations, requests from competent authorities and defense of rights in judicial or administrative proceedings.
• Marketing and commercial communications, only with your prior consent and always with the right to immediate revocation.

4. Legal basis for processing

The legal bases that enable the processing are:

• Performance of a contract: when the processing is necessary to provide the Service you contracted.
• Compliance with a legal obligation: tax, accounting and anti-fraud retention required by the authorities of each country.
• Legitimate interest: Service security, fraud prevention, quality improvement and anonymous aggregated metrics.
• Consent: marketing communications, non-essential cookies, installation of advertising pixels and use of third-party features (Facebook, Google, YouTube, Zoom). You may withdraw your consent at any time without affecting the lawfulness of prior processing.

5. Retention periods

• Active account data: while your account remains active.
• Closed account data: up to 6 months after closure, to support reactivation and disputes. It is then anonymized or deleted.
• Billing data: up to 6 years, in accordance with Chilean tax legislation and equivalent periods in other jurisdictions.
• Technical logs: 90 days for diagnostics and security.
• Marketing data: until you withdraw your consent.

6. ARCO rights, portability, objection and erasure

As the data subject you may exercise the following rights at any time —recognized by Law 21.719 (CL), LFPDPPP (MX), Law 1581 (CO), Law 29733 (PE), Law 25.326 (AR) and the GDPR (EU):

• Access: obtain confirmation of the processing and a copy of your data.
• Rectification: correct inaccurate or incomplete data.
• Cancellation / Erasure / Right to be forgotten: request deletion when the data is no longer necessary or you withdraw consent.
• Objection: object to processing based on legitimate interest or direct marketing.
• Portability: receive your data in a structured, machine-readable format, or request its transfer to another controller when technically feasible.
• Restriction of processing and not to be subject to automated decisions with significant effects.

To exercise your rights, send your request to privacidad@xtreamcast.co indicating: (i) full name, (ii) tax identifier or email associated with your account, (iii) the right you are exercising and (iv) a simple copy of a document proving your identity. We will respond within the applicable legal deadlines (10–30 business days depending on the jurisdiction).

7. Processors and subprocessors

To operate the Service we share personal data —under a data processing agreement— with the following subprocessors. List current as of May 14, 2026; we reserve the right to add new subprocessors with prior notice.

The complete, up-to-date list of subprocessors is available upon request to the DPO.

8. International data transfers

Since some subprocessors operate outside Chile (mainly the United States and the European Union), personal data may be transferred internationally. These transfers are carried out under:

• Standard Contractual Clauses of the European Commission, where applicable.
• Data processing agreements (DPAs) signed with each subprocessor.
• Additional technical measures: encryption in transit (TLS 1.2+) and at rest (AES-256).
• Adequacy decisions when in force (for example the EU-US Data Privacy Framework for certified providers).

9. Cookies and similar technologies

We use cookies and similar technologies (local storage, pixels, tags) for authentication, preferences, analytics and, with your consent, marketing. We distinguish three categories:

• Strictly necessary: session, security, load balancing. They do not require consent.
• Analytics: they help us understand the use of the Service (Google Analytics 4). They are only activated with consent.
• Marketing / Advertising: they allow campaign measurement and ad personalization (Meta Pixel, Google Ads). They are only activated with explicit consent.

You can manage your preferences at any time from the cookie banner or by configuring your browser. You can also opt out of Google Analytics by installing the opt-out add-on.

10. Automated decisions, profiling and artificial intelligence

XtreamCast uses algorithms for operational tasks (alert prioritization, fraud detection, server balancing). We do not make automated decisions with significant legal effects on data subjects. Nor do we train generative artificial intelligence models with video or audio content or personal data of our clients without express, specific and informed consent. AI features within the Service (for example, automatic transcription or clip generation) operate at the client's request and, unless explicitly noticed in the panel, do not retain the content beyond the time needed to return the result.

11. Information security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction:

• Encryption in transit (TLS 1.2+) and at rest (AES-256) on cloud infrastructure (AWS / Oracle).
• Multi-factor authentication (MFA) on administrative access.
• Least-privilege principle and environment segregation.
• Payment method tokenization through PCI-DSS certified processors.
• Periodic configuration audits, security monitoring and incident response.
• Encrypted backups with retention and restoration testing.

In the event of a security breach affecting personal data, we will notify the competent supervisory authority and the affected data subjects within the legal deadlines (72 hours under GDPR; analogous periods in other jurisdictions).

12. Minors

The Service is not directed at children under 14 in Chile, nor under 13 in other jurisdictions. We do not knowingly collect data from children under those ages without verifiable parental authorization. If we become aware that we collected data from a minor without authorization, we will delete it. If you believe a minor in your care has provided us data, write to privacidad@xtreamcast.co.

13. Credentials and connections with third-party services

For specific features the Service may request third-party OAuth credentials. These are used solely for the described purpose and revoked at your request:

• Facebook / Meta: publish live broadcasts from XtreamCast to Facebook Live.
• Google / YouTube: publish broadcasts and upload recordings to your YouTube channel.
• Zoom: import recordings or live signals from Zoom meetings.
• Instagram / TikTok / X: multistreaming to social networks where available.

Tokens are stored encrypted and deleted immediately when you use the “unlink” option in your panel.

14. Changes to this Policy

We may update this Policy periodically to reflect legal, operational or technological changes. We will notify substantial changes by email and/or a prominent notice in the Service at least 15 days in advance. The “Last updated” date will remain visible in the header.

15. Supervisory authorities

If you consider that the processing violates your rights, you may file a complaint with the supervisory authority of your country:

• Chile: Personal Data Protection Agency (once operating under Law 21.719) and the Council for Transparency.
• Mexico: National Institute for Transparency, Access to Information and Personal Data Protection (INAI).
• Argentina: Agency for Access to Public Information (AAIP).
• Colombia: Superintendence of Industry and Commerce (SIC).
• Peru: National Authority for Personal Data Protection (ANPD).
• EU / EEA: the national data protection authority of the corresponding Member State.

16. Contact

For any inquiry, complaint or exercise of rights relating to this Policy:

• DPO email: privacidad@xtreamcast.co
• General email: contacto@xtreamcast.co
• Address: BLACKLINE SPA, Santiago, Chile