Privacy and data

Who is responsible

The controller is Code5 Robert Gontarczyk (CODE5), Kosynierów 44, 41-219 Sosnowiec, Poland, VAT EU PL6443390368. Contact for anything in this notice: support@letusgoho.me. No data protection officer is required.

What we process and why

The site is for adults: 18 or older, as section 3 of the Terms says. We do not knowingly process data of anyone under 18; a purchase by a minor is cancelled and refunded when we learn of it.

To buy, you must pick a team country and pay through Stripe; without them we cannot sell you voxels. A display name, a message and a ranking label other than anonymous are optional: leave them out and you can still buy.

Your purchase

For each order the ledger keeps: a random public order id (your permalink), the pack size and number of packs, the amount, the team country you picked, the order status and its times, the Stripe Checkout session and payment ids, the voxels you were given, and your acceptance of the Terms and of the immediate-delivery and withdrawal waiver (when, and which version of each text).

Why: to sell and deliver your voxels, handle refunds and disputes, and keep the accounts. Legal basis: performing our contract with you (GDPR Art. 6(1)(b)) and our tax and accounting obligations (Art. 6(1)(c)).

The team we suggest

The buy form suggests a team so you do not have to scroll through every country. The suggestion comes from your browser’s language setting (for example en-US suggests the United States). It is worked out in your browser and is not stored; only the team you actually buy for goes into the order. Legal basis: our legitimate interest in a quick buy form (Art. 6(1)(f)). You can always pick any team.

Payment: Link (Stripe) is the merchant of record

Payments run through Stripe Managed Payments. Link (Sold through Link, LLC, a Stripe company) is the merchant of record for the payment: it collects your payment details and takes the payment, calculates and remits tax, sends your receipt and invoice, and handles refund requests and disputes under its own terms. CODE5 remains the seller of the voxels and the show. Link and CODE5 are independent controllers of the data each of us holds; if you ask Link to delete your data, Link notifies us, and we treat that notice as your request to delete your name, message and e-mail address (see Deleting your name and message); the order record stays, because the accounts need it. See the Stripe privacy policy and the Link privacy policy. We never see your card details. Your statement shows LINK.COM*.

Link gives us the data it shares with the order: your name, e-mail address and billing address (country, and the full address where Link collects it). We keep the team country you picked and the e-mail data described below; the rest of that data stays with Stripe and Link.

Your e-mail address

Stripe tells us the e-mail address used at checkout. We use it in two ways. First, we turn it into a keyed hash (HMAC) so that purchases by the same person add up in the buyer ranking; the ranking runs on the hash, not on the address. Legal basis: our legitimate interest in running the ranking and its records fairly (Art. 6(1)(f)).

Second, we keep the address itself with your order, only to send you the e-mails about that order: the confirmation, which records the version of the Terms and the immediate-start consent you accepted and which we must give you on a durable medium, and the e-mail that tells you when your clip is ready. These are service messages, not marketing. They contain no advertising, no tracking pixel and no tracking link, and we send no newsletter and no other e-mail without your separate consent. We send them through Cloudflare Email Sending, as our processor, so Cloudflare handles the message and the address to deliver it. Our logs hold only the order id and whether a message went out, never the address. Legal basis: performing our contract with you and our obligation to confirm it on a durable medium (Art. 6(1)(b) and (c)). We keep the address until 28 February 2027 and delete it from 1 March 2027, or earlier if you ask (reply to any of these e-mails with your order id); the keyed hash stays for the ranking and for your deletion requests.

You choose how you appear in the ranking. The default is anonymous (“a mystery buyer from” your team country). If you pick your masked e-mail, we store and publicly show only its first letter and domain, such as l•••@example.com. Legal basis for the masked e-mail: your consent (Art. 6(1)(a)).

Your display name and message (optional)

If you add a name or a message, we check it before you pay. Our own servers apply format rules and a word list; then the text goes through OpenRouter to AI moderation models (a classifier and, for unclear cases, a second model). We remember each model verdict for 24 hours under a hash of the text, not the text itself. Names that are not approved are not stored. A message the models could not check is kept hidden and checked again; if it is then refused, we delete it.

Approved names are stored with your order. The hosts show and read them aloud on the site and on the live stream, in a grouped line of up to three names, usually within 24 hours; a name the hosts have not read aloud is read in the roll call before the final show, as time allows, and shown in the closing credits, on the stream, on the site’s stage and on a page that lists them with each name’s team country and nothing else (never your order id, e-mail address or message). They stay in our recordings and appear on your permalink, and from the date in Annex A of the Terms they appear in buyer clips ($100 or more), which we keep for 48 hours after the clip is ready or its e-mail is sent (Terms section 17) or until you ask us to delete them; for a purchase of $1,000 or more, one of the hosts also says your name in the clip, with a voice made by an AI voice service. Messages appear on your permalink, and from $100 the Critic may react to them on air. When a live line about your purchase uses your approved name, the AI voice service we use may speak it at the time of purchase, as a processor; the audio is kept for up to 24 hours (and cached briefly), then deleted, and at once if the line is not aired. Legal basis: our contract with you, because you asked us to show and say them, with the checkbox in the buy form (Art. 6(1)(b)); moderating the text is our legitimate interest in keeping the show safe and lawful (Art. 6(1)(f)). Moderation is automated and has no legal effect on you; if you think a name was refused wrongly, write to us and a person will look at it.

Your logo (optional, from $1,000)

If your order is $1,000 or more and the buy dialog offers a logo, you may upload one (a PNG, up to 512 × 512 pixels and 1 MB). Our server looks at the file itself (it must really be a PNG of that size), stores it in private storage at Cloudflare and keeps a hash of it, its size and the verdict with your order. While you pay, the picture goes through OpenRouter to an AI model that checks it for adult content only; nothing else is reviewed. The verdict is written to our log with the file’s hash, never the picture. A logo that passes is shown on the site, on the stream, in recordings and in your clip (see section 13 of the Terms); a logo that does not pass is never shown. Files that were rejected, that no order claimed or that belong to an order never paid are deleted automatically 24 hours later (a file flagged as a minor: at most 30 days). Legal basis: performing the contract you chose (Art. 6(1)(b)) for showing it; checking it is our legitimate interest in keeping the show lawful (Art. 6(1)(f)). Moderation is automated and has no legal effect on you; if you think a logo was refused wrongly, write to us and a person will look at it. A logo must not show people or faces (Terms, Annex B). A file flagged as sexual content involving a minor is reported to the police and kept at most 30 days, unless an authority asks us to keep it longer.

Questions for the bots (optional)

If you send the hosts a question or a suggestion with the “Ask the bots” field, we process its text, your network address and the bot check. Cloudflare Turnstile checks you are a person; our servers apply format rules and a word list; then the text goes through OpenRouter to the same AI moderation models as names and messages. To limit how often one network can ask, we keep a SHA-256 hash of your network address (for IPv6, its /64 network) with the times of its last questions for at most a day, never the address itself. An approved question is stored without any link to you, other than that hash, and deleted within about 23 hours, whether or not the bots answered it. Questions are anonymous: the hosts never say who asked. They may read your question out in their own words and talk about it on the site and on the live stream, which is recorded; during an operator block an AI model writes their discussion from your question, and a person can stop it before it airs. The hosts’ lines about a question are part of the show’s records: once written they stay in the studio’s input log for up to 7 days, and the lines that aired stay in the show log and the recordings. Do not put personal data in a question. Legal basis: our legitimate interest in letting viewers take part in the show and in keeping it safe (Art. 6(1)(f)).

Auctions

No auctions run unless Annex A of the Terms announces them. Before the first one runs, this notice says what we process about bidders.

Security and a fair sale

• Bot check. Cloudflare Turnstile processes your IP address and browser and device signals to tell people from bots, once for the name check and once for checkout.
• Rate limits. We count requests per network address (your IP address; for IPv6, its /64 network) at Cloudflare for up to a minute.
• Holds. While a checkout holds voxels for you (about half an hour; up to 7 days when a payment method settles later), the ledger keeps a SHA-256 hash of your network address to cap unpaid holds per network. It is deleted when the hold ends: paid, cancelled or expired. A waiting-room ticket in your browser carries the same hash for 2 minutes.

Legal basis: our legitimate interest in stopping bots and abuse and keeping the sale fair (Art. 6(1)(f)).

Hosting

The site, the ledger and their data run on Cloudflare (Workers, Durable Objects, R2 storage, Pages). Like any website, your IP address and request data pass through Cloudflare’s network. We may export the ledger each night to our own Cloudflare R2 storage for the accounts. Legal basis: the same as for the data concerned.

Viewers

Viewers are never tracked as individuals. The site counts open connections per country once a minute, from the country Cloudflare sees for each connection, and adds up emoji taps; no IP address or identifier is stored. The live stream counts only the show’s emoji in YouTube chat and never stores the text of chat messages; the identifier of a chat account is held in memory for at most 2 minutes to count each person once, and is never written down. Legal basis: our legitimate interest in letting the hosts react to their audience (Art. 6(1)(f)).

YouTube

The show streams on YouTube, run by Google. On our site the player loads only when you press “Watch live”, and then from youtube-nocookie.com; from that moment Google receives your IP address and device data and may store information on your device, under Google’s privacy policy. Legal basis: your consent, given by pressing the button (Art. 6(1)(a)). Watching on youtube.com is governed by Google’s policy alone.

Social media: the show’s own accounts

The show publishes its own videos on YouTube, Instagram, Threads and TikTok, and reads and answers comments under its own posts on YouTube, Instagram and Threads. It does this through each platform’s official API, connected to the show’s own accounts only. On TikTok we post by hand in TikTok’s own app, without any API, so we receive no data from TikTok.

What we process there:

• Our own accounts. The videos and posts we publish and the statistics the platforms report for them, such as views, likes, comments and shares.
• Public comments under our posts. The comment text and the commenter’s public display name, kept for at most 14 days. The commenter’s platform id is stored only as a keyed hash (HMAC), never as the id itself.

We never sell or share this data and never use it for advertising. Replies are written or approved by a person before they are posted; nothing is answered automatically. The comments are stored in our own Cloudflare account. Purpose and legal basis: running the show’s accounts and answering viewers, which is our legitimate interest (Art. 6(1)(f)); you can object to it at any time. To have a comment of yours deleted, or any other data we hold from these platforms, see Data deletion; we delete platform data on request within 30 days.

YouTube API Services

The show uses YouTube API Services to publish its videos and to read and answer comments under them. By interacting with the show’s YouTube channel you are also bound by the YouTube Terms of Service. Google handles data under the Google Privacy Policy.

We connect only our own Google account, the one that owns the show’s channel. We do not ask viewers to sign in to anything or to give us access to their Google accounts. Google account owners can revoke an app’s access to their account at https://security.google.com/settings/security/permissions.

Fonts

The fonts on this site are served from our own domain. Your browser does not contact Google Fonts or any other third-party font service, so no font provider receives your IP address.

Cookies and browser storage

Our own code sets no cookies. The only thing it stores in your browser is the Checkout session id on the after-purchase page, in this tab’s session storage, so that reloading the page while your payment is still being confirmed keeps working; it is deleted once the result is shown, when you close the tab, or after 24 hours at the latest. The sound switch is forgotten when you leave. Cloudflare Turnstile, and the YouTube player if you start it, run their own scripts under their own policies.

Who receives data

• Everyone: the ranking label you chose, your team and your voxel count are public on the site; approved names and messages also on the stream, on permalinks and in clips; an approved name that the hosts did not read aloud also in the closing credits and on their page (with the team country only).
• Stripe (Link): payments, tax, receipts, refunds and disputes, as an independent controller.
• Cloudflare: hosting, storage, rate limits, Turnstile, the delivery of our order e-mails (Email Sending) and the servers that make buyer clips (Containers; they see the approved name in the clip), as our processor.
• OpenRouter and the model providers it routes to: moderation of names, messages, logos (the picture) and viewer questions, and the hosts’ live lines about a question, as processors.
• OpenRouter and its voice provider: the spoken line of your clip if you bought $1,000 or more (your approved name and country), as processors, from the date in Annex A of the Terms.
• Google (YouTube): the live stream and its recordings, and the player on our site once you start it.
• YouTube (Google), Instagram and Threads (Meta) and TikTok: the videos and posts the show publishes and its replies go to them (to TikTok by hand), and they handle them under their own terms and privacy policies. Public comments flow to us from YouTube, Instagram and Threads (see Social media above); we do not pass them on.
• Our accountant and legal advisers when needed, and authorities when the law requires it.

Transfers outside the EEA

Cloudflare, Stripe, OpenRouter, the model providers and Google may process data outside the European Economic Area, including in the United States. Cloudflare, Stripe and Google: the EU-US Data Privacy Framework. OpenRouter and the model providers: the European Commission’s standard contractual clauses. Write to us for a copy.

How long we keep it

Your rights

You can ask us for access to your data, to correct it, to delete it, to restrict it, or for a copy in a portable form. You can object to processing based on our legitimate interests, and you can withdraw a consent at any time; this does not affect what was done before. Write to support@letusgoho.me; we answer within one month.

You can also complain to a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl), or the authority where you live or work.

Deleting your name and message

E-mail support@letusgoho.me with your permalink id (the part after /v/) or the e-mail address you used at checkout; we find your orders through the keyed hash without ever having stored the address. Then:

• your display name, message and masked e-mail are cleared, and your logo file is deleted (its hash stays with the order record);
• your voxels stay in the cube in your team’s colour, labelled “anonymous (your country)”;
• your permalink and the cube’s owner data are updated, and your clip and the spoken line of it are deleted;
• your name leaves the closing credits and their page the next time the list is loaded: within about a minute (our servers and the network edge keep a short-lived copy of the list). A credits roll that is already playing on a screen has loaded some of the names it is about to show, so it can still show yours until that roll ends, a few minutes at most (the roll never runs longer than four minutes); a list page already open in a browser keeps what it has loaded until it is reloaded. The audio files of lines that spoke your name are deleted;
• in our recordings on YouTube we cut or blur the part with your name within 30 days: our log of when your name was spoken tells us which fragment.

A deletion notice that Link passes on to us counts as such a request. What stays: the order record without your name, which the accounts need. Words the hosts already said live cannot be taken back, but they leave our recordings as described above.

Data deletion

To have us delete the data we hold from your interactions with the show’s accounts on Instagram, Threads or YouTube, such as a comment you wrote under one of our posts, e-mail support@letusgoho.me with the subject “Delete my data”. Tell us the platform and your public username or a link to the comment, so we can find it. We delete the data within 30 days and confirm by e-mail when it is done.

What a platform itself keeps, such as your account and your comment on the platform, is deleted through the platform’s own tools. For data from a purchase, see Deleting your name and message.