1. Who is the controller and the Data Protection Officer
The controller of personal data processed by the TopGames platform is Diogo Véras. For purposes of the Brazilian LGPD (Law No. 13.709/2018), the controller is the party that decides about personal data processing.
Data Protection Officer (DPO), as per art. 41 of LGPD: requests and communications about data protection can be directed to the channel below, which is the contact point between you, the controller and the ANPD (Brazilian data protection authority).
- DPO: Diogo Véras.
- DPO contact channel: support@topgames.app.br.
Note on size: TopGames is treated as a small-size agent under Brazilian Res. CD/ANPD No. 2/2022. In that condition, appointing a DPO is optional, but the Platform chose to keep an identified communication channel with the data subject as a good-faith governance measure.
2. Data collected
We collect the following personal data:
| Category | Data | Origin |
|---|---|---|
| Identification | name, email, profile picture | registration / social login (Google) |
| Authentication | password (encrypted), session tokens | registration / login |
| Payment | last 4 digits of card, subscription status, billing history | Paddle as Merchant of Record (we do not store full card data; payment via card, PayPal, Google Pay, Apple Pay or Pix depending on the country) |
| Usage | games played, playtime, sessions, achievements, settings | launcher and games |
| Technical | IP, device identifier, operating system, launcher version | launcher (anti-fraud and device binding) |
| TikTok LIVE (viewer data) | viewer public nickname and @, profile picture address, name and quantity of the gift sent, time of the interaction | public live events, received by the launcher while you are streaming with the feature on |
| Voice (optional features) | text you type for speech conversion; audio sent for voice features, when you use those features | voice features in the launcher/games (TTS and voice conversion) |
| Cloud overlays | your TopGames channel identifier, overlay link key, overlay visual preferences (color, frame, skin) | launcher, when you use overlays served from the cloud |
| Referrals (partner programme) | Pix key (which may be a national ID number, phone number, e-mail or random key) and/or PayPal e-mail, used to pay your commission | you, when filling in the Referrals tab in the launcher — only asked of people who have a referral code |
We do not collect sensitive data (LGPD art. 5, II) and we do not use advertising tracking cookies on the site. Voice features are optional and are only triggered when you actively use them.
3. Processing purposes
We process your data for the following purposes:
- authenticate your account and prevent unauthorized use;
- process the Subscription, charges and renewals via payment providers;
- provide access to Catalog games and manage the license;
- enforce the bond between account and device as anti-fraud;
- integrate with TikTok LIVE during active use of the feature (gifts → in-game actions);
- save game progress and settings on your device (and optionally in the cloud);
- provide optional voice features (TTS speech synthesis and voice conversion), processing the text or audio you provide;
- answer questions, support and refund requests;
- comply with legal obligations (tax, regulatory and judicial);
- analyze usage and diagnose errors in the launcher to improve the service, using a pseudonymous identifier (account code) and masked input fields — you may object to this processing (opt-out).
- relay, in real time, the public events of your live (gifts, likes) from your computer to the overlay window open in your OBS, through a server of ours in the cloud that only distributes and stores nothing.
- pay the commission of people who have a referral code, using the Pix key or PayPal e-mail they provided themselves;
- show people who have a referral code the statement of sales made with it — the date (without the time), what was bought, the amount and the first part of the buyer's name, enough to check the commission.
4. Legal bases
Each purpose is supported by a LGPD legal basis:
| Purpose | Legal basis (LGPD art. 7) |
|---|---|
| Authentication, account and license | contract execution (V) |
| TikTok LIVE integration (opt-in) | consent (I) |
| Voice features / TTS (opt-in) | consent (I) |
| Payment and billing | contract execution (V) + legal obligation (II) |
| Anti-fraud (device binding, IP) | legitimate interest (IX) |
| Support and service | contract execution (V) |
| Legal/tax compliance | compliance with legal obligation (II) |
| Account communications | contract execution (V) |
| Usage telemetry and launcher improvement | legitimate interest (IX), with pseudonymization and the ability to object (opt-out, in the “Help improve TopGames” option in the launcher Settings) |
| Showing on the overlay the nickname, picture and gift of the viewer who interacted with the live | legitimate interest (IX), together with art. 7 §4 (data made manifestly public by the data subject when interacting publicly in a live). We have carried out and maintain a legitimate interest assessment. Viewers may object through the DPO channel |
| Running the cloud overlays (channel, link key, visual preferences) | contract execution (V) |
| Storing the Pix key / PayPal e-mail of someone with a referral code | performance of a contract (V) — it is how the commission is paid — together with legal obligation (II) as to the record of the payment |
| Showing the referrer the date, item, amount and first part of the buyer's name | legitimate interest (IX) — checking their own commission. That is why the statement carries no exact time, no e-mail and no full name: only what is needed to check, not the TopGames customer list. The buyer may object through the Data Protection Officer channel |
| Launcher error reports (error message, version, operating system, account and device code) | legitimate interest (IX): keeping the launcher working and fixing failures. It is sent even with usage telemetry turned off and carries no usage data or the content of your live |
5. Who we share with (processors and subprocessors)
To run the Platform we rely on providers that process personal data on our behalf (processors, art. 5, VII of LGPD). Each one handles only what is strictly needed for its function and is, or will be, bound by a data processing agreement (DPA). The list below is kept up to date:
| Processor | Function | Data accessed | Location |
|---|---|---|---|
| Supabase | database and authentication | identification, authentication, usage, technical data | United States |
| Railway | hosting of the application server and of the cloud overlay server (overlay.topgames.app.br) | data in transit during Platform use; public live events in transit (nickname, @, profile picture address, gift, time), which are not recorded; channel identifier, link key and overlay visual preferences | United States |
| Cloudflare R2 | storage for builds, updates and cloud saves | game files and saves; technical identifiers | United States / global |
| Paddle.com Market Limited | payment processing as Merchant of Record, responsible for payment methods (card, PayPal, Google Pay, Apple Pay, Pix) and for tax obligations on charges | email, name (when provided by the payment method), amount, transaction identifiers, status, country and last 4 digits of card (when applicable) | United Kingdom / United States |
| ElevenLabs | speech synthesis (TTS) for voice features | text you provide for speech conversion | United States |
| Replicate | voice conversion (RVC) for voice features | audio you provide for conversion | United States |
| Eulerstream | technical signing of the TikTok LIVE connection | technical session identifiers; does not receive registration data | United States |
| PostHog | product telemetry, usage analytics, error diagnostics and launcher interface recording (session replay) | usage events, pseudonymous identifier (account code), technical data (IP, device, operating system); launcher screen recording with input fields (email, password, @username) masked; does not receive your name, email or phone | United States |
The following also receive data, when applicable: TikTok, only during active use of the "TikTok LIVE" feature, we receive public live events (gifts, comments); we do not send registration data to TikTok. Competent authorities, when required by court order, law or regulatory authority.
We do not sell, rent or transfer personal data to third parties for marketing or profiling purposes.
Railway uses Cloudflare as a network layer in front of its servers. In that arrangement Cloudflare is a subprocessor of Railway, not a direct processor of TopGames. The address overlay.topgames.app.br is resolved by Cloudflare DNS in DNS-only mode, meaning your overlay traffic does not go through the Cloudflare proxy under any contract of ours. The overlay link works like a password: anyone holding the link can see your live events while it is valid. Treat the link as secret, do not put it on screen or in screenshots, and generate a new link in the panel if it leaks.
Referral commissions are paid by us, by hand, outside Paddle. The Pix key or PayPal e-mail provided is not passed on to any operator on this list: it is used at the moment of payment, and at that instant it reaches the chosen payment institution (the bank, for Pix; PayPal, for a PayPal e-mail), which handles the data as a controller in its own right. Within TopGames, only the person making the payment sees it, and every read is recorded in an audit log.
6. International transfer
Part of the processors listed above (Supabase, Railway, Cloudflare R2, Paddle, ElevenLabs, Replicate, Eulerstream and PostHog) processes data on servers outside Brazil, mainly in the United States and the United Kingdom. This constitutes an international data transfer, informed under art. 33 of LGPD.
These transfers are supported by:
- the commitment, in the process of being formalized, to maintain with each processor a data processing agreement and to incorporate into it the Standard Contractual Clauses approved by ANPD (Annex II of Res. CD/ANPD No. 19/2024), adopted in full and without modification;
- security mechanisms applied by the processors (encryption in transit and at rest);
- assessment that the processors adopt protection standards compatible with LGPD.
You can request more information about the safeguards applied to any transfer through the DPO channel.
The cloud overlay server is located in the United States, at Railway. This means the public events of your live cross servers outside Brazil before reaching your OBS, even though they are not recorded there. For your customer data (channel, link key, preferences), this transfer is necessary to perform the contract you entered into with us (art. 33, IX, "b" of LGPD). For viewer data, which is not part of that contract, the applicable instrument is the ANPD Standard Contractual Clauses, whose incorporation into the Railway contract is in progress, as described above.
7. Retention and deletion
We keep personal data only for the time needed for the purposes, observing legal deadlines:
| Category | Term |
|---|---|
| Active account | while the account exists |
| Closed account (no active subscription) | 6 months (recovery) → deletion |
| Billing history | 5 years (tax obligation) |
| Technical logs (IP, device identifier) | 90 days after last activity |
| Your live gift scoreboard (on your computer) | kept only on your computer, in a launcher data file. It is not sent to TopGames servers and we keep no copy. It stays for as long as you want and is gone when you reset the scoreboard in the panel or uninstall the launcher |
| Voice features (text/audio sent) | processed transiently; not retained by TopGames after the result is generated. Retention policy of processors (ElevenLabs and Replicate): up to 90 days after the interaction or as long as necessary to provide the service |
| Launcher telemetry and diagnostics (PostHog) | up to 12 months, then deleted or aggregated |
| Live events on the overlay server (cloud) | not stored. The event passes through the server memory, is distributed to your overlay and then discarded. There is no database, no history and no record of the event on disk |
| Overlay visual preferences on the server (cloud) | kept in memory only, so that an overlay opened mid-live already shows up customized. Erased when the server restarts and when your access ends |
| Referrer's Pix key / PayPal e-mail | for as long as the person holds a referral code. They can delete it whenever they want by clearing the fields in the launcher's Referrals tab — no need to ask anyone |
| Commission records (sale, amount and commission) | 5 years, for the same reason as the billing history: it is a record of a payment made |
| Launcher error reports | up to 180 days per occurrence. After that only the grouped error remains, without the information of who was affected |
| “Talk to the team” conversations (problems and suggestions sent from the launcher, with the launcher and Windows version) | for as long as the account exists. They are deleted together with the account |
After the term, data is deleted or anonymized, except when legally required to keep it.
8. If you are a live viewer
This part is for anyone watching a TikTok live where the streamer uses TopGames overlays. You do not need an account with us, or to be our customer, to have rights here.
What happens: when you send a gift or like the live, TikTok announces it publicly to the whole room. The streamer software receives that announcement and relays it, in real time, to the graphic panel shown on the broadcast. What travels in that relay is your nickname, your @, the address of your TikTok profile picture, the name and quantity of the gift and the time of the interaction.
What we do NOT do: we do not store those events. We build no history, no permanent ranking and no profile of you. We do not cross what you do on one streamer live with what you do on another. We do not sell and do not share this data with advertisers. Your profile picture is not copied to our servers: the streamer browser fetches the image directly from TikTok, and what travels through us is only its address.
Why we may do this: we process this data on the basis of legitimate interest (art. 7, IX of LGPD), together with the fact that you yourself made that interaction public by doing it in an open live (art. 7, §4). Being shown on screen is generally the very effect one expects when interacting in a live. We keep a documented legitimate interest assessment and provide it on request.
Your rights: you may request confirmation, access, correction, deletion and information about sharing, and you may object to this processing, by emailing support@topgames.app.br. Since the processing is real time and without storage, what we can do in practice is: (a) tell you exactly what travels; (b) block your nickname so it stops being displayed on TopGames overlays; (c) forward your request to the streamer when the display decision is theirs. Service is free of charge.
Roles: TikTok is the one collecting and publishing your interaction, and answers for that. The streamer decides to display the interaction on their broadcast. TopGames provides and runs the tool that performs that display. Regarding your interaction, streamer and TopGames act jointly, and you may come to us directly, without having to figure out who does what.
If you are under 18: talk to whoever is responsible for you before sending gifts in lives. If you are responsible for a teenager and want their nickname to stop appearing on TopGames overlays, write to support@topgames.app.br and we will block it.
9. Your rights
Under art. 18 of LGPD, you have the right to:
- confirmation of the existence of processing;
- access to the data we process about you;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
- data portability (export in structured format);
- deletion of data processed under consent;
- information about public and private entities with which we share your data;
- information about the possibility of not providing consent and its consequences;
- revocation of consent, with effect on future processing.
You may also object to processing based on legitimate interest, providing justification, and request review of automated decisions that affect your interests.
To exercise any right, send your request to the DPO at support@topgames.app.br. Service is free of charge. We confirm receipt and respond within the term of art. 19 of LGPD: up to 15 days for access and confirmation. Since we are a small-size agent (Res. CD/ANPD No. 2/2022), this term may be extended by double upon justification; in that case you will be informed of the extension and the reason.
10. Security
We apply technical and administrative measures to protect the data:
- passwords stored in encrypted form (never in plain text);
- encrypted communication (HTTPS) across the entire site and launcher;
- session tokens with expiration and automatic renewal;
- permission-level access control on the database;
- monitoring of suspicious events and anti-fraud;
- total separation between test environment and real environment.
Even with our measures, no system is 100% immune. In case of a security incident that may bring relevant risk or harm to you, we will notify you and ANPD within a reasonable term, as per art. 48 of LGPD.
12. Children and adolescents
The Platform is not directed at children under 13 and its use by children is not allowed. Teens between 13 and 17 may only use the Platform with the consent and under the supervision of at least one parent or legal guardian, as per art. 14 of LGPD, which determines that the processing of data of children and adolescents must always be done in their best interest.
Subscription contracting and payment features are intended for adults over 18 or for minors duly assisted or represented by their legal guardians.
We do not condition participation in games or activities on providing personal data beyond what is strictly necessary (art. 14, §3). If we identify a minor registration without proper authorization, we will suspend the account and delete the data, unless we receive confirmation from the responsible guardian.
The legal guardian may, at any time, request information about the minor data or its deletion through the DPO channel.
13. Changes to this policy
This Policy may be updated to reflect legal, technical or operational changes. Material changes will be communicated with 30 days notice by email and/or notice on the Platform.
Version history: v1.0.0 (05/09/2026), initial version. v1.1.0 (05/17/2026), inclusion of processors PayPal, ElevenLabs, Replicate and Eulerstream; detail on international transfer and Standard Contractual Clauses; identification of the DPO and contact channel; adjustments to data collected (voice features) and to data subject rights. v1.2.0 (05/27/2026), replacement of payment processors Mercado Pago and PayPal by Paddle.com Market Limited (United Kingdom), now Merchant of Record responsible for card, PayPal, Google Pay, Apple Pay and Pix; update of the international transfer section to include the United Kingdom. v1.2.1 (retroactive record), inclusion of PostHog as processor for product telemetry and interface recording (session replay), with pseudonymous identifier and masked input fields, and the corresponding legitimate interest basis with an option to object. v1.3.0 (07/22/2026), migration of LIVE overlays from a local server on the streamer computer to a cloud server (overlay.topgames.app.br, hosted at Railway, United States); declaration of the viewer data traveling through that path and of the applicable legitimate interest basis; declaration that events are not stored; new section addressed to live viewers; update of the international transfer section; correction of the gift scoreboard retention period, which described server-side storage that never existed (the scoreboard has always been kept only on the streamer computer). v1.4.0 (09/10/2026), inclusion of partner payment data (Pix key and PayPal email), used to pay out partnership commissions. v1.5.0 (10/19/2026), separation of launcher error reports (always sent, to keep the launcher working, kept for up to 180 days per occurrence) from usage telemetry (which keeps the option to turn it off). “Talk to the team” was also added: conversations are kept for as long as the account exists.
Current version: 1.5.0 · effective from October 19, 2026.
14. How to get in touch
- DPO / data protection: support@topgames.app.br
- General support: support@topgames.app.br
- Discord: link available at /support
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.