Privacy Policy

Controller, scope, and applicability

This privacy policy applies to the public website, the authenticated dashboard, the support area, and the paid digital services offered under the Gooverlay brand. Gooverlay is a product under the Bytterfly brand operated by Almir Mamudoski, German sole proprietor (Einzelunternehmen), Siedlungsstr. 1, 84137 Vilsbiburg, Germany. Contact: contact@bytterfly.com. Provider details are also published in the Legal Notice (Impressum).

This policy applies whenever Gooverlay determines the purposes and means of processing personal data relating to visitors, registered users, collaborators, customers, and support contacts.

Purposes and legal bases

Account registration, sign-in, sessions, workspace membership, saved scenes and widgets, subscriptions, and support requested in connection with the service are processed to perform the user contract or take steps requested before a contract (Article 6(1)(b) GDPR). If a business customer provides a representative’s contact details, our legitimate interest in administering that business relationship is the basis (Article 6(1)(f) GDPR).

Technical security records, abuse detection, and investigations protect accounts and keep the service reliable. Our legitimate interests are preventing unauthorized access, fraud, and disruption (Article 6(1)(f) GDPR). Records required by tax, accounting, or other applicable law are processed to comply with those obligations (Article 6(1)(c) GDPR).

Optional newsletter messages rely on separate consent (Article 6(1)(a) GDPR). Optional public-site analytics requires separate prior consent (Article 6(1)(a) GDPR), including consent for non-essential browser storage under Section 25(1) TDDDG. Neither is a condition of using the paid service. Necessary session and requested preference storage is used under Section 25(2) TDDDG.

Account and authentication details are necessary to create and secure an account. Billing information is necessary to process a paid order. Without the relevant required details, we cannot provide that account or paid order. Newsletter subscription and analytics consent are optional. Acknowledging this privacy information is not consent to ordinary contractual or security processing.

Categories of personal data

Processed data may include account identifiers, login credentials, encrypted or hashed contact data, plan and billing state, workspace ownership and collaborator assignments, widget and scene configuration data, support messages, and technical usage or security metadata.

Where payment flows are used, Gooverlay does not store full card details itself. Payment card handling remains with the payment provider and the data returned to Gooverlay is limited to the identifiers and billing events required to reconcile subscription state.

Screen Share Studio and streaming content

Screen Share Studio captures only the source you explicitly select through your browser permission dialog. Captured video remains in browser memory and is composed locally with your widgets. Gooverlay does not upload, receive, record, screenshot, or monitor this captured screen content. Captured audio is disabled. Capture stops when you stop it, close Studio, sign out, or lose confirmed access; reloading requires a new browser approval.

Gooverlay supplies widget output and controls. We do not receive or watch the broadcast or meeting video produced by OBS, another streaming tool, or your meeting application, and we do not monitor your streams. When you share the composed Studio tab or window, your meeting or streaming provider transmits it under that provider’s own terms and privacy policy.

Account, session, permissions, scene, widget configuration, widget content, and live commands still pass through Gooverlay as needed to provide the service. This screen-capture statement does not apply to files or messages you separately choose to submit through other features, such as support attachments or media uploads. Studio does not run public-site analytics.

Hosting and technical connection data

Gooverlay is hosted on a virtual private server (VPS) provided by STRATO GmbH, Germany. STRATO provides the hosting infrastructure and processes data on our behalf where necessary to operate the service. Using a VPS does not prevent technical connection data from being processed by the hosting infrastructure.

When you visit or use Gooverlay, technical request data such as your IP address, request time, requested resource, response status, and browser information may be processed to deliver the website and APIs, operate sessions, troubleshoot failures, and detect or prevent attacks. This processing relies on Article 6(1)(b) GDPR where necessary to provide the requested service and Article 6(1)(f) GDPR for our legitimate interest in secure and reliable operation.

Technical records are used to diagnose delivery failures and investigate security incidents. Their retention depends on the relevant diagnostic or incident purpose and applicable legal preservation duties. Hosting connection data is separate from captured presentation media: Screen Share Studio does not send captured video or audio to STRATO or Gooverlay.

Interface and widget fonts are served from our own application hosting. Loading those fonts does not contact Google Fonts.

Payments, processors, and recipients

Recipients include STRATO as infrastructure provider, the email-delivery provider used for transactional messages, authorized support personnel, and Stripe for payment processing. Authorities or professional advisers receive information where a legal obligation or the establishment, exercise, or defence of legal claims requires it.

For billing reconciliation, Gooverlay stores the customer, checkout, subscription, invoice, and price identifiers returned by the payment processor together with the internal account reference needed to assign billing events correctly.

Stripe receives the payment and billing information submitted in its checkout. Stripe also processes certain information as an independent controller, including for its own fraud-prevention and financial-regulatory purposes. Details and the responsible Stripe entity for your location are available at https://stripe.com/privacy.

Optional public-site analytics

Google Analytics is optional and loads only after you enable analytics for this browser. It measures visits to our homepage and FAQ, using fixed page names and addresses without query strings, personal account identifiers or incoming referrers. Authentication, checkout, legal, withdrawal, app, support, creator-render, output-viewer and Screen Share Studio pages do not initialize analytics. Crossing between these pages and our measured public pages loads a fresh document so analytics code cannot remain active in private views. Advertising personalization and Google Signals are disabled in this integration.

Google Ireland Limited is the European service provider; Google group companies, including Google LLC in the United States, can process information collected by that service. Such information can include pseudonymous browser identifiers, technical browser and device information, and page visits. The provider also receives the network connection, including its IP address; this processing is not anonymous merely because an account name is omitted.

Open the Cookie Policy and select Manage privacy settings to enable analytics, withdraw consent or enable it again. Before consent, the Google tag is not loaded and no analytics requests are sent. Withdrawal disables collection, requests removal of accessible Google Analytics cookies and reloads a page if needed to unload the tag. It does not undo processing that occurred before withdrawal. Separate browsers and devices have their own choices. Older accepted choices are not reused: this implementation asks again.

International transfers

Stripe operates internationally and may process information in the United States and other countries outside the European Economic Area. The same applies to data Google receives through consent-based analytics. Their published transfer information describes reliance on applicable adequacy decisions, including the EU-US Data Privacy Framework for covered certified recipients, and standard contractual clauses where required: https://policies.google.com/privacy/frameworks and https://stripe.com/privacy.

You can request information about the safeguards relevant to your data, or a copy where applicable, from contact@bytterfly.com. The safeguard used depends on the actual recipient and processing arrangement; a provider’s general policy does not itself establish that every transfer is covered.

Retention, newsletter, and rights

Account and workspace records are retained while the account and its saved content are needed for the service. Erasure requests are assessed against the need to maintain other workspace members’ rights, prevent abuse, preserve evidence for an existing dispute, and satisfy statutory recordkeeping. Contact us to request erasure; closing a browser does not delete an account.

Support correspondence is retained while needed to resolve the request and document related contractual issues or claims. Security records are retained while required to investigate an incident or prevent recurring abuse. Billing records are retained for the applicable tax and accounting retention periods even where an account is deleted. Records kept solely to meet a legal obligation are restricted to that purpose.

Newsletter contact details are used until you unsubscribe or withdraw consent; a limited suppression record may remain to honour that choice. Browser consent choices remain until changed or cleared. Google Analytics cookies set by this implementation expire after 180 days without renewal of their expiry on each visit. The current GA4 property retains event-level data for 2 months and user-level data for 14 months, with user retention reset on new activity; aggregated reports can follow different retention rules. You can contact us to request access or erasure, subject to the GDPR conditions. No presentation-capture retention period applies because Gooverlay does not receive that media.

Optional newsletter and product-update emails are sent only on an opt-in basis. An objection or unsubscribe stops future marketing messages without affecting essential account, security, billing, or service emails.

Subject to the conditions in the GDPR, you can request access, rectification, erasure, restriction, or portability. You can object to processing based on legitimate interests for reasons relating to your situation and object to direct marketing at any time. Consent can be withdrawn without affecting the lawfulness of prior processing. Send requests to contact@bytterfly.com; an account is not required to contact us.

You may complain to a supervisory authority, including the authority at your habitual residence, workplace, or the place of an alleged infringement. The Bavarian private-sector authority is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany; contact and complaint information: https://www.lda.bayern.de/de/kontakt.html.

Security and account protection

Gooverlay uses technical and organizational measures intended to protect confidentiality, integrity, availability, and resilience of the service, including access control, credential protection, signed output URLs, and role-based workspace separation.

No internet service can guarantee absolute security. Users remain responsible for protecting their own credentials, local devices, streaming endpoints, and collaborator access decisions.