Data Collection Policy

Last Updated: April 24, 2026

This document explains specifically what data RAATV collects, why, who it’s shared with, and your rights over it. It complements our Privacy Policy and our Ad Privacy Policy with a clear, app-store-compliant breakdown of every data point.

1. What Data We Collect

Data Type	Examples	Purpose	Collected?
Identity	Name, email, password (hashed)	Account creation & login	YES
Contact	Phone number (optional), date of birth	Account recovery, age verification	YES
Payment	Last 4 of card, billing address, payment status	Subscription billing — full card data is held by Stripe, not us	YES
App Activity	Videos watched, watch duration, search queries	Recommendations, “Continue Watching,” creator royalty calculations	YES
Device Info	IP address, user-agent string, browser/device type	Compatibility, fraud prevention, rate limiting	YES
Approximate Location	Country & region inferred from IP address	Content licensing geo-restrictions	YES
Cookies & Session Tokens	Authentication cookie, anti-CSRF token, preferences	Keeping you logged in, security	YES
Communications	Support tickets, email replies	Customer support	YES
Precise GPS Location	Latitude/longitude	—	NO
Microphone / Audio	Voice recordings	—	NO
Camera / Photos	Images, videos from your device	—	NO
Contacts	Address book	—	NO
Calendar	Calendar events	—	NO
SMS / Call Logs	Text messages, call history	—	NO
Health Data	Steps, heart rate, fitness	—	NO
Biometric Data	Fingerprint, face scans	—	NO
Files on Device	Documents, downloads, media	—	NO
Web Browsing History	Other websites you visit	—	NO
Children’s Data	Data from users under 13	— we target adults 18+	NO

2. Who We Share Data With (Service Providers)

We share specific, limited data with the following third-party service providers solely to deliver the RAATV service to you. These providers are bound by data processing agreements and may not use your data for their own purposes.

Service Provider	What’s Shared	Why
Stripe (Stripe, Inc.)	Email, name, billing address, full payment card details	Subscription billing & payment processing. Stripe is PCI-DSS Level 1 certified.
Amazon Web Services (AWS)	Everything (CloudFront, S3, DynamoDB, Lambda, SES)	Cloud hosting infrastructure. AWS is SOC 2 / ISO 27001 certified. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
Mailgun (Sinch)	Email address, email message content (password resets, support replies, notifications)	Transactional email delivery. Mailgun Privacy Policy
Vimeo	Video request only (no personal data)	Video hosting and streaming delivery. Vimeo Privacy Policy
Google Analytics (optional, only when enabled by admin)	Anonymous page views and session info	Site analytics. Google Privacy Policy
Google Tag Manager (optional)	Page view events	Marketing tag management
Meta Pixel (Facebook, optional)	Anonymous conversion events	Ad attribution — only when ads are run
TikTok Pixel (optional)	Anonymous conversion events	Ad attribution — only when ads are run
Hotjar (optional)	Anonymous session recordings	Site UX research — only when enabled

3. What We Do NOT Do With Your Data

• We do NOT sell your personal data to advertisers, data brokers, or any third party.
• We do NOT share your watch history with advertisers for ad targeting outside our platform.
• We do NOT use your email address for spam — only for account-related communications you opt into.
• We do NOT track you across other websites.
• We do NOT use your data for AI training or to build profiles sold to third parties.
• We do NOT collect data from anyone under 13. RAATV is for adults 18+.

4. Data Security

• In transit: All data flows over HTTPS (TLS 1.2 or higher). HTTP is automatically redirected to HTTPS.
• At rest: Database (DynamoDB) is encrypted with AES-256. Files (S3) are encrypted with AES-256.
• Passwords: Never stored in plain text. We store a one-way salted SHA-256 hash. Even our own database admins cannot read your password.
• Payment cards: Never stored on our servers. Stripe handles all card data; we only see the last 4 digits and a token.
• Access control: Admin access requires multi-step authentication. Backend systems use AWS IAM with principle of least privilege.

5. How Long We Keep Your Data

Data	Retention
Account info (while account active)	For as long as your account exists
Account info (after deletion)	Anonymized within 30 days; financial records kept 7 years for tax compliance
Watch history	While account active; deleted 30 days after account deletion
Support tickets	2 years
Payment records	7 years (US tax law)
Server logs (IP addresses)	30 days, then deleted
Stream qualifying records	48 hours (auto-expired via DynamoDB TTL)

6. Your Rights

You have the right to:

• Access — request a copy of all personal data we hold about you
• Correct — update or fix inaccurate personal data
• Delete — request that we delete your account and personal data
• Export — receive your data in a machine-readable format (CSV/JSON)
• Opt out — unsubscribe from marketing emails (transactional emails like password resets cannot be opted out of)
• Restrict — limit how we use your data while a complaint is reviewed
• Object — object to processing of your data on legitimate-interest grounds
• Lodge a complaint — with your national data protection authority (e.g., the FTC in the US)

To exercise any of these rights, email privacy@richazzauntietv.com. We respond within 30 days.

7. State-Specific Rights (US)

California (CCPA / CPRA)

• Right to know what categories of personal info we collect
• Right to know what we sell or share (we don’t sell — CPRA “sharing” for cross-context behavioral advertising also: NO)
• Right to delete personal info
• Right to correct inaccurate personal info
• Right to limit use of sensitive personal info
• Right to opt out of automated decision-making
• Right to non-discrimination for exercising these rights
• Global Privacy Control (GPC) signal is honored automatically

Virginia, Colorado, Connecticut, Utah

Residents of these states have similar rights to California residents under their respective privacy laws. Same email above to exercise.

8. International Users (EU / UK / Canada)

GDPR (EU residents) / UK GDPR

• Legal basis for processing: contract performance (account & subscription) and legitimate interest (fraud prevention, service improvement)
• Right to access, rectify, erase, restrict, port, and object
• Right to lodge a complaint with your national supervisory authority
• If data leaves the EEA, it goes to the US (AWS data centers) under Standard Contractual Clauses

PIPEDA (Canada)

Canadian users have rights under the Personal Information Protection and Electronic Documents Act. Same email contact.

9. Cookies & Tracking

We use a minimum set of cookies:

• Essential cookies (always on): session token, authentication, anti-CSRF. Required for login.
• Functional cookies: language preference, “remember me”
• Analytics cookies (only if you accept): Google Analytics, Hotjar — can be opted out via the cookie banner
• Marketing cookies (only if you accept): Meta Pixel, TikTok Pixel — only set if you visited from an ad campaign

10. Changes To This Policy

We’ll announce material changes to this policy at least 30 days before they take effect, via banner on the platform and email to active subscribers. Non-material changes (typo fixes, link updates) may be applied immediately.

11. Contact Us

Questions, concerns, or to exercise any rights listed above:

• Privacy questions: privacy@richazzauntietv.com
• General support: support@richazzauntietv.com
• Data Protection Officer (EU): dpo@richazzauntietv.com
• CCPA inquiries: ccpa@richazzauntietv.com

RAATV is a service of Rich Azz Auntie TV, LLC.