PaneLiveLegal
Privacy policy
Last updated: 18 October 2026
Who is responsible
Artur Cichosz, trading as Clownfish Web, operates the PaneLive website, PaneLive Mobile App and PaneLive Companion and is responsible for the personal data we receive and process as described in this policy.
Postal address: ul. Blacharska 32 lok. 2B, 53-206 Wrocław, Poland
Privacy contact: Artur Cichosz, ac@clownfishweb.pl
This policy covers panelive.app, PaneLive Mobile App, including PaneLive Pro, PaneLive Companion, and support requests sent through Jira or email. Sections about a specific feature apply when you use that feature.
Your studio connections and local app data
For studio monitoring and control, PaneLive exchanges data only with your selected PaneLive Companion instance or directly with your production software, such as OBS Studio, vMix or Streamlabs Desktop. Your Companion instance is part of your production setup. Support diagnostic files reach us only when you choose to send them by email or through Jira.
These connections exchange authentication information, control requests and production data, including scene and source names, video and audio previews, output status, and teleprompter scripts and session state. The operator of your studio or Companion instance controls that system and any copies it keeps.
PaneLive stores connection profiles, server addresses, profile names, authentication and pairing information, preferences and feature settings on your device so it can reconnect and retain your setup. Saved profile secrets use your device's secure storage facilities. Local content can also include scripts, cached production information, voice cue definitions, recorded voice examples and speech calibration data.
Shared teleprompter features exchange scripts and session changes with your selected Companion instance. You or your organisation control access to your production systems and are responsible for the personal information included in your production content.
Camera, microphone and speech features
- Camera: PaneLive requests camera access to scan connection or pairing QR codes. Frames are decoded on your device, and the connection details, including any credentials or pairing information, are used to set up your selected connection.
- Microphone: voice features use microphone audio for voice cue setup, calibration, command recognition and teleprompter voice following. Voice examples, their text and derived speech references may be saved locally to match the commands you configure.
- Speech processing: microphone audio is processed on your device using embedded recognition or the device's on-device speech service. Recognised text is processed locally, and recognised commands can trigger control requests to your selected production system.
- Your choice: you can manage camera, microphone and speech-recognition permissions in your device settings. Each feature needs its matching permission to work. Saved profiles and voice examples remain until you delete them.
Model downloads and external services
When you prepare embedded speech recognition that needs additional models, PaneLive downloads them from the sherpa-onnx project's releases on GitHub. The download provider receives your IP address and the technical request information needed to deliver the files. See GitHub's Privacy Statement.
Your device's on-device speech service manages its own language models and any downloads under its provider's privacy information. Model downloads can require internet access; speech recognition takes place on your device.
Opening website, help, store or support links connects you to the destination service, which receives browser or network request information. The Google Analytics and cookie practices below apply to visits to this website.
In-app purchases
PaneLive Pro purchases are handled through Google Play or the Apple App Store. Prices vary by country and app store. Current offers, prices and purchase terms are shown in your store.
The store provider processes account, payment and transaction information to handle your purchase. See Apple’s App Store privacy information and the Google Payments Privacy Notice for their data handling, retention and privacy controls.
Advertising in PaneLive
When PaneLive displays startup advertisements on Android, iPhone or iPad, it uses Google AdMob. The information below applies when this advertising integration is active.
Google and its advertising partners may receive information automatically from the advertising SDK. This can include your IP address and approximate location derived from it, advertising and other device identifiers, information about ads displayed and interactions with them, app interactions, and crash, performance and other diagnostic information. On Android, this can also include the app set ID and, where applicable, identifiers associated with signed-in accounts on the device. The information processed depends on the platform, privacy choices, device settings and applicable SDK restrictions.
This information supports ad delivery and measurement, advertising analytics, reliability, and protection against fraud and abuse. Where permitted by your choices and settings, information may also support personalized advertising, including use with information from other apps and websites.
PaneLive does not supply your production server credentials, saved connection profiles, scene names, production video, audio or scripts as advertising targeting data. Advertising requests are separate from your studio connections.
Your advertising choices
Google's consent and privacy forms explain the available purposes, providers and choices for your region. PaneLive checks the consent status before requesting ads. You can continue using the app if you decline optional consent. Depending on your choices and availability, you may receive non-personalized or limited ads, or no ad. Declining personalized advertising does not necessarily stop all advertising-related data processing.
For users in the EEA, the UK and Switzerland, we rely on consent for the collection, sharing and use of personal data for personalized advertising, and obtain consent for storing or accessing information on your device where required by law. Where the GDPR applies, the legal basis for this consent-based processing is Article 6(1)(a). The privacy form explains the purposes and providers covered by your choice.
For other advertising purposes where permitted by law, ad partners may rely on legitimate interests (GDPR Article 6(1)(f)), as identified in the privacy form and their own notices. You can review those purposes and object through the form's legitimate-interest controls. Those controls are enabled and initially switched on; they are separate from choices that require your consent. We have not selected additional purposes for PaneLive's own use of data in the advertising consent form.
When available, open Ad privacy choices on the connection setup screen or in Settings > About to review or change your advertising choices. Regional options can include withdrawing consent or opting out of sale or sharing. These app choices are separate from the website's analytics-cookie controls.
On both Android and iOS, our US privacy messages cover all current and future US states supported by Google's messaging service. Eligible users can use Ad privacy choices to access the available opt-out controls for sale, sharing or targeted advertising.
On iPhone and iPad, Apple may also ask whether you allow tracking. This permission is optional and separate from the advertising consent form. You can change it in Settings > Privacy & Security > Tracking. PaneLive requests non-personalized ads when tracking is not authorized and disables Google's publisher first-party identifier in that case. Allowing tracking does not guarantee that a personalized ad will be delivered.
On Android, you can also manage your advertising identifier through your device's advertising privacy settings. The available controls vary by Android version and device manufacturer.
Google and the providers identified in the privacy form explain their own data handling, retention and privacy controls in their policies. Changing consent or deleting PaneLive's local data does not automatically delete information already received by those providers. Use their privacy controls and request procedures, and the contact details in this policy for requests addressed to us.
Keeping and deleting data on your device
Saved profiles, settings, scripts, app-managed speech models and voice references remain on your device until you remove them, replace them or clear the app's storage. Temporary caches may be cleared or replaced sooner.
- Connection profiles: deleting a profile removes its saved connection settings and credentials. Manage server-held information and Companion authorisations on the connected system separately.
- Voice examples and cues: deleting an example or cue removes its saved entry and associated audio once other saved entries have finished using it. Other voice settings, calibration data and downloaded models stay until you remove them or clear the app's storage.
- Removing local app data: remove saved profiles first to delete their credentials from secure storage, then use your device settings to delete the app and its data. Manage exported or shared copies, retained device backups and content on your production systems separately.
For personal data you have sent to us through support or email, use the contact details above to request deletion. The retention rules and rights below apply.
Protecting your connections
Keep your device, connection credentials and pairing codes secure. Transport protection depends on your selected protocol and server configuration; some direct studio connections use unencrypted local-network protocols. Use trusted networks and the secure connection options your system offers.
What we collect and why
- Support, bug reports and feature requests: your contact details, request content, correspondence and any setup details or attachments, including log files, that you choose to provide through Jira or email. We use these to answer you, investigate problems, consider suggestions and improve reliability. Our legal basis is our legitimate interest in providing support, resolving issues and evaluating suggestions, or performance of a contract where your request concerns support owed under that contract (GDPR Article 6(1)(f) or (b)).
- Website operation and security: technical request data, such as your IP address, browser information, requested URL and time of access. We use these to deliver the website, diagnose errors and prevent abuse, based on our legitimate interest in operating a secure service (Article 6(1)(f)).
- Optional website analytics: with your consent, Google Analytics measures visits and interactions so we can understand website usage and improve the site. The data and cookies are described below. Our legal basis is your consent (Article 6(1)(a)).
- App advertising: Google AdMob and the providers described in the app's privacy form process advertising-related information as explained under Advertising in PaneLive. These practices apply to advertising in the mobile app and are separate from optional analytics on this website.
Contacting us is voluntary. The Jira portal shows which details are required to submit a request. We need a description and sufficient contact information to handle your request and reply. Share only information relevant to your request.
Requests through Jira
Choose the Atlassian-hosted portal that fits your request for bug reports, feature requests and technical support:
We manage your requests in Jira Service Management, provided by Atlassian. Atlassian processes request data on our behalf and handles its own account and service data as described in Atlassian's Privacy Policy.
Who receives data
Authorised staff and providers supporting our hosting, email, maintenance, Jira request management and consented website analytics may access data as needed for those services. We may also disclose data when legally required.
Our own server infrastructure is hosted by Hetzner Online GmbH in Germany, within the European Economic Area (EEA).
Atlassian and its service providers may process support data outside the EEA. Where required, transfers are covered by the European Commission's standard contractual clauses incorporated into Atlassian's Data Processing Addendum. You can contact us for a copy of these safeguards. Further information about Atlassian's international processing is available in Atlassian's Privacy Policy.
For Google Analytics, our provider is Google Ireland Limited. Google and its subprocessors process analytics data on our behalf under Google's Data Processing Terms. Processing may take place outside the EEA, including in the United States. Google uses applicable adequacy decisions, including the EU-US Data Privacy Framework for covered transfers to Google LLC, and standard contractual clauses where required. See Google's transfer safeguards; you can contact us for further information or a copy of the applicable safeguards.
Our contracting entity for AdMob advertising is Google LLC. For its advertising services, Google's Controller-Controller Data Protection Terms describe us and Google as independent controllers, each responsible for its own processing. Those terms identify Google Ireland Limited as Google's controller for EEA and Swiss personal data, and Google LLC for UK personal data. Where Google's restricted data processing applies under US state privacy laws, Google acts as a service provider or processor for the covered processing.
Other advertising recipients are the providers identified in the app's privacy form, which links to their privacy information. Our European messages automatically include Google's commonly used ad partners; our US messages use active ad partners. These lists can change. Review the current form for the applicable partners, purposes and choices. Their own notices explain their roles and processing; they are not all processors acting on our behalf.
Advertising information may be processed outside the EEA, including in the United States. Google describes its safeguards in its advertising international-transfer information: applicable adequacy decisions, including the EU-US Data Privacy Framework for covered transfers to certified US entities, and standard contractual clauses where applicable. Other advertising providers describe their own processing locations and transfer safeguards in the policies linked from the privacy form. Google's safeguards do not automatically cover every advertising provider. Contact us for further information about the safeguards applicable to our use of these services.
How long we keep data
The periods below apply to information you share with us and data processed through our website and support services. You control local app data as described above.
The 14-month Google Analytics setting below applies only to website analytics. It is not a retention period for AdMob. Google and the advertising providers identified in the app's privacy form explain their own retention practices in their privacy policies.
We do not keep our own copies or exports of advertising reports. Google and other advertising providers may retain information in their own systems under their respective retention policies; this statement does not mean that their advertising data is deleted.
- Jira support requests: we keep requests, comments and ordinary attachments such as screenshots for 24 months after closure, to handle follow-up questions and recurring problems, and delete them within a further 7 days. If a request is reopened, the period starts again at its next closure.
- Support email: we keep correspondence and ordinary attachments for 24 months after the related request closes, or after the last message for email-only enquiries. Deletion is completed within 27 months of that event.
- Diagnostic files: submitted log files, crash dumps and configuration exports are deleted within 90 days after the related request closes, plus up to 7 days for cleanup. This also covers downloaded working copies and diagnostic email attachments. We may retain an anonymised technical summary.
- Inactive requests: when we are waiting for your reply, we send a reminder before closing a request after 30 days without a response. The retention periods above then apply.
- Feature requests: we close the customer request when a decision is made or after 12 months without activity. The retention periods above then apply. We may keep an anonymised description of the suggestion for product planning.
- Website access and error logs: we keep routine logs for up to 90 days from the log entry.
- Website Google Analytics data: our user-level and event-level retention setting is 14 months. Covered events expire after 14 months, and user identifiers expire within 14 months of their last recorded activity. Google deletes expired data monthly. Standard aggregated reports may remain available longer for website-usage comparisons. See Google's data retention documentation.
- Security incidents: we retain only relevant evidence during an investigation and for up to 12 months after the incident is closed. A minimal incident record is retained until the end of the third calendar year after closure to document our response. The legal exceptions below may apply to specific records.
- Our backups: where we create backups or recovery exports containing personal data, each copy expires within 60 days of its creation. This includes server backups and snapshots under our control. Backup copies may therefore remain after deletion from active systems. They are restricted to recovery use, and we reapply previous deletions before restored data returns to use.
Atlassian manages its own disaster-recovery copies under its retention arrangements. See Atlassian's Privacy Policy for information about its data retention practices.
We may retain specific records longer where needed to meet a legal obligation or establish, exercise or defend a legal claim. Retention is limited to the relevant information and the applicable statutory period or proceedings. We review these records and delete them when that need ends.
Your rights
You may request access, correction, deletion or restriction of your personal data, and portability where applicable. You may object to processing based on legitimate interests. You may withdraw consent at any time; processing lawfully carried out before withdrawal remains lawful. Contact us at the email address above.
For advertising-related requests addressed to us, use the same contact email. For information held by Google or other advertising providers, use their privacy controls and request procedures linked in the app's privacy form and the advertising section above. Withdrawing consent affects future consent-based processing; it does not automatically erase information already received by those providers.
You may complain to your local data protection authority, including Poland's President of the Personal Data Protection Office (UODO).