Data processed, purposes, legal bases, recipients and individual rights.
Controller
CeneLiora is operated by Crelivo OÜ, an Estonian company registered under number 17608823, Sepapaja tn 6, 15551 Tallinn, Estonia. Phone: +1 581 992 1909. Email: [email protected]. Crelivo OÜ is not VAT-registered as of this version.
For privacy questions or requests, contact [email protected].
Data we process
- Account: email address, hashed password, language, preferences, policy acceptance dates and security settings.
- Device and licence: hashed device fingerprint, public activation code, model, Tizen and app version, approximate country, sessions and licence state.
- User-selected sources: name, type, encrypted URL or credentials, synchronization state, imported metadata, favourites, history and progress needed for player functions.
- Purchases: Stripe customer, session and payment identifiers, plan, amount, currency, status, invoice and refund events. Stripe—not CeneLiora—processes complete card data.
- Support and rights requests: contact details, subject, messages, submitted material, ticket status and rights requests.
- Security and operations: IP address, timestamp, error logs, request identifiers and security events. Stream URLs, tokens and IPTV credentials must not be written to logs.
Purposes and legal bases
- Contract: create the account, activate the licence, synchronize requested sources, provide the player, bill and deliver support.
- Legal obligation: accounting, tax, consumer rights and responses to competent authorities.
- Legitimate interest: protect the service, prevent fraud, diagnose incidents and improve reliability after balancing individual rights.
- Consent: optional communications or non-essential technologies where consent is required. Consent may be withdrawn for the future at any time.
Recipients and processors
Access is limited to those who need it. Depending on the feature, data may be entrusted to hosting and storage providers, Cloudflare for network and security, Stripe for payments, and Resend or Brevo for transactional email.
These providers act under their own duties and/or our contractual instructions. Transfers outside the EEA use an approved mechanism such as an adequacy decision or standard contractual clauses where required.
Retention
Account and licence data are kept for the contractual relationship and then as needed for closure, security and legal claims. Payment and invoice records are kept for mandatory accounting and tax periods. Tickets and logs are retained only as long as their purpose requires.
A deletion request results in deletion or anonymisation of data no longer needed, subject to legal duties, fraud prevention and ongoing disputes.
Security
Passwords are hashed, source credentials are encrypted, communications use TLS, administrative access is restricted and sensitive actions are audited. No system is infallible, so we maintain measures proportionate to risk and an incident-response process.
Your rights
Depending on applicable law, you may request access, correction, erasure, restriction or portability, or object to certain processing. You may withdraw consent without affecting earlier lawful processing.
Submit a request in the portal or to [email protected]. We may request proportionate proof of identity. You may also complain to the competent supervisory authority where you live or work.
Children
The service is not aimed at children and is not designed to knowingly collect their data. A parent or guardian may report a concern to [email protected].
Updates
The document date and version appear above. We will give appropriate notice of material changes and request renewed consent where legally necessary.