Privacy Policy

Last updated: October 13, 2026

1. Who we are and what this Policy covers

1.1 Cardinal is a live-video streaming service operated by 1st Flock, LLC (“Cardinal,” “we,” “us,” or “our”). This Privacy Policy (the “Policy”) explains what personal information we collect, how we use and disclose it, how long we keep it, and the choices and rights you have.

1.2 This Policy covers: the websites at cardinalstreaming.com and cardinal.stream (the “Site”); the customer console at app.cardinalstreaming.com (the “Console”); the Cardinal application programming interface (the “API”); the embeddable player and hosted watch pages (the “Player”); and every other feature we provide (together, the “Service”).

1.3 This Policy applies to the following people:

Account Holders: people who create or use a Cardinal account, including the staff of organizations that are our customers (“Customers”) and of Partners (businesses that use Cardinal to provide streaming to their own customers).
End Customers: customers of a Partner, on whose behalf the Partner streams through Cardinal.
Viewers: people who watch a broadcast or recording, or use chat or reactions, through the Player.
People who appear in broadcasts: anyone whose image, voice, or words are part of a Customer’s live stream or recording.
Website Visitors: people who browse the Site.

1.4 Capitalized terms not defined here have the meanings given in the Cardinal Terms of Service (the “Terms”).

2. Our roles: when we decide, and when the Customer decides

2.1 Where we are the controller. We decide how and why to process information about Account Holders, about billing, about use of the Console and API, and about Website Visitors. For that information we are the “controller” (under European and United Kingdom law) or the “business” (under California law), and this Policy describes our practices directly.

2.2 Where the Customer is the controller. Customers use the Service to stream their own content to their own audiences. The video, audio, captions, chat, and related data of a broadcast, and information about a Customer’s Viewers, End Customers, and the people who appear in its broadcasts, are collected and used at the Customer’s direction. For that information the Customer (or, where a Partner acts for an End Customer, the Partner or the End Customer, as they have agreed between themselves) is the controller or business, and we are the “processor” or “service provider.” We process it only to provide the Service as described in the Terms and our Data Processing Addendum, on the Customer’s instructions, and we do not use it for our own purposes except as the law permits a service provider to do (for example, to secure the Service, to meter and bill, and to comply with law).

2.3 What this means for you. If you are a Viewer, an End Customer, or a person who appears in a broadcast, the organization that ran the broadcast decides why your information was collected and how it is used, and its privacy notice applies to that use. Section 13 explains how to exercise your rights for that information.

3. Information we collect

We collect only the information described in this Section. We collect it directly from you, from your device when you use the Service, from Customers and Partners who supply it through the Console or API, and from our service providers (for example, our payment processor and our sign-in provider).

3.1 Account Holders

Identity and contact information: the organization’s name; the contact name and email address; the billing name and email address.
Sign-in identity: the identity information our authentication provider returns when you sign in, such as your email address, a provider user identifier, and, if you choose a third-party option such as “Sign in with Google,” the name and email address that provider shares. We do not receive your password for a third-party provider.
Payment information: the customer and payment-method identifiers assigned by our payment processor, and the card brand, last four digits, and expiration date of each card on file. Full card numbers never reach our systems; they are entered into a form controlled by our payment processor and tokenized in your browser.
API key metadata: a hash of each API key, its prefix, and when it was last used. We do not store the key itself.
Usage and billing records: streams started, their duration, resolution, and restream destinations; scheduled bookings; invoices; payment attempts and their results; credits; and refunds.
Audit records: records of actions taken on your account by you, your users, and our staff.
Support communications: what you send us when you contact support, billing, legal, or abuse addresses.

3.2 Partners’ End Customers

Partners supply the following through the Console or API about each of their End Customers: the Partner’s own identifier for the End Customer; optionally, a name and other metadata the Partner chooses to attach; stream titles; caption vocabulary (names and terms the Partner supplies to improve speech recognition); and the usage records and recordings of that End Customer’s streams. We hold this information as the Partner’s processor.

3.3 Viewers

Viewers do not create accounts. When you watch a broadcast or use chat we process:

Network information: your IP address, which we use to deliver video to you and to protect the chat service (for example, by limiting the number of connections from one address). If a connection is refused, the address may be recorded in a security log.
Chat: the display name you choose, the messages you post (up to 300 characters each), and your reactions. These are shown to other Viewers of the same broadcast and to the Customer’s moderators.
Verified name: if a Customer signs you in on its own site and passes your name to the Player, we keep that name for about 2 hours.
Access-code attempts: for private broadcasts, a digest (one-way hash) of your IP address for about 10 minutes when a wrong access code is entered, so that repeated wrong attempts can be rate-limited.
Request logs: our request logs may record the URLs requested from the Player and media servers, on a sampled basis, with standard request metadata.

We do not collect your name, email, or other contact details as a Viewer unless you type them into chat or a Customer passes a verified name.

3.4 Broadcast content

Every broadcast is received, encoded, delivered, and recorded by the Service. Broadcast content includes the video and audio of the stream, any captions or transcripts generated from it, and whatever personal information the Customer chooses to include in it (for example, the image and voice of people who appear). We process broadcast content as the Customer’s processor.

3.5 Website Visitors

When you browse the Site we record standard server logs: your IP address, browser user agent, referring page, the page requested, and the time. The Site stores a light/dark theme preference in your browser’s local storage and the state of the documentation navigation in your browser’s session storage. These values stay in your browser, are not sent to us as identifiers, and are not used to track you. The Site sets no cookies and uses no analytics, advertising, or tracking scripts.

3.6 Information we do not collect

We do not collect precise geolocation, biometric identifiers, government identification numbers, health information, financial account numbers, or information about race, religion, sexual orientation, or other special categories, except to the extent a Customer chooses to include such information in its own broadcast content, chat, titles, or metadata, which we hold as its processor. We do not draw inferences about you to build a profile. We do not buy information about you from data brokers.

4. How we use information, and our legal bases

4.1 We use the information in Section 3 for the following purposes. Where the law of the European Economic Area, the United Kingdom, or Switzerland applies, the legal basis for each purpose is shown in brackets.

Purpose	Information used	Legal basis
Provide the Service: receive, encode, deliver, record, and caption broadcasts; run chat; forward restreams; operate the Console and API	All categories, as needed	Performance of a contract with Customers; for Viewer and End Customer data, we act on the Customer’s instructions
Create and manage accounts; authenticate users	Identity, contact, sign-in identity	Performance of a contract
Meter usage, calculate fees, invoice, charge cards, retry declined charges, apply credits and refunds, and collect debts	Usage and billing records, payment information	Performance of a contract; legal obligation (tax and accounting); legitimate interest in being paid
Communicate with you about the Service: invoices, declines, suspensions, security alerts, changes to terms and prices	Contact information	Performance of a contract; legal obligation; legitimate interest in keeping customers informed
Respond to support, legal, privacy, and abuse requests	Contact information, support communications, relevant account records	Performance of a contract; legitimate interest; legal obligation
Secure the Service: prevent, detect, and respond to abuse, fraud, unauthorized access, denial-of-service, and policy violations; rate-limit connections and access-code attempts	IP addresses, request logs, access-code digests, API key metadata, audit records	Legitimate interest in protecting the Service, our Customers, and Viewers; legal obligation
Maintain audit trails of staff and account actions	Audit records	Legitimate interest in accountability and security; legal obligation
Enforce the Terms and Acceptable Use Policy; respond to copyright and abuse complaints	Account records, broadcast content, chat	Legitimate interest; legal obligation
Comply with law, legal process, and government requests; establish and defend legal claims	Any category, as required	Legal obligation; legitimate interest
Operate, maintain, debug, and improve the Service, using aggregate or de-identified data where possible	Usage records, request logs	Legitimate interest in running a reliable service

4.2 We do not use personal information for advertising, for profiling, or for automated decisions that have legal or similarly significant effects on you.

4.3 Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights. You can ask us for information about that assessment using the contact details in Section 18.

5. Captions and transcripts

5.1 If live captions are offered for a broadcast, speech recognition runs on servers that we operate on our own cloud infrastructure. Audio is not sent to a third-party speech-recognition vendor for captioning. Captions and transcript files are stored with the recording and deleted on the same 30-day schedule (Section 9).

5.2 Translated captions. If a Customer turns on translated captions for a broadcast, the caption text of that broadcast (the words recognized from the speech, not the audio or video) and any caption vocabulary the Customer supplied are sent to an artificial-intelligence language provider we engage, which returns the translation to us. The provider may use the text only to produce the translation, may not use it to train or improve any model, and may not keep it after the translation is returned, except as strictly necessary to prevent abuse or comply with law and never for more than 30 days. Chat, viewer information, and account information are never sent for translation. Translated captions are stored and deleted with the recording (Section 9). Broadcasts without translated captions are never sent to a translation provider.

5.3 No training. Broadcasts, recordings, captions, translations, transcripts, and chat are never used to train speech-recognition, language, or other machine-learning models, whether by us or by anyone else on our behalf.

5.4 Captions and translations are generated automatically and may be inaccurate. We do not review them. Caption vocabulary supplied by a Customer or Partner is used only to improve recognition and translation for that Customer’s broadcasts.

6.1 We do not sell your personal information, and we have not done so in the preceding 12 months. We do not “share” personal information for cross-context behavioral advertising (as defined in California law), and we have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own marketing. We do not engage in targeted advertising.

6.2 No advertising or tracking cookies. The Site, Console, and Player do not load analytics, advertising, social-media, or tracking scripts, and do not use cookies to track you. The only browser storage we use is: on the Site, a light/dark theme preference and your chosen code-sample language (local storage) and documentation navigation state (session storage); in the Console, only what is strictly necessary to keep you signed in, which may be held in session storage or in a session cookie; and in the Player, an access code you entered, kept for the current browser tab only (session storage), and the chat name and player preferences you chose, such as caption settings (local storage). This information stays on your device and is not used to track you.

6.3 Customers’ own sites. A Customer embeds the Player in its own website or app and links to its own giving page. The Customer’s website, app, and giving page may set cookies or use analytics under the Customer’s own privacy notice. We do not control them.

7. How we disclose information

We disclose personal information only as described below. We do not name individual vendors in this Policy; a current list of our service providers, by category and name, is available on written request to Business Customers under the Data Processing Addendum, as our confidential information.

7.1 Service providers. We use third-party companies to run parts of the Service on our behalf, under contracts that restrict their use of the information to providing their service to us. The categories are:

Cloud infrastructure and hosting, including compute, database, backups, and email delivery, located in the United States (US East).
Content delivery network and edge computing, including object storage for recordings (located in eastern North America) and the chat service (operated at global edge locations).
Payment processing, which receives card details directly from your browser and returns a token to us.
Authentication and sign-in, including the hosted sign-in service and the identity providers it offers, such as “Sign in with Google.”
Transactional email delivery, for billing notices and alerts.
Monitoring and logging, which we operate ourselves on our own infrastructure.
Machine translation, which receives only the caption text of broadcasts whose Customer turned on translated captions, under the restrictions in Section 5.2.

7.2 Restream destinations, at the Customer’s direction. When a Customer adds a restream destination, we forward the broadcast, unchanged, to the third-party service and address the Customer specifies, using the stream key the Customer supplies. The destination then processes the broadcast under its own terms and privacy policy. We encrypt the stream key and delete it one hour after the broadcast ends. We do not send any other personal information to the destination.

7.3 Sign-in providers, at your direction. If you choose a third-party sign-in option, that provider learns that you are signing in to Cardinal, and shares your name and email address with our authentication provider and us. The provider’s privacy policy governs its own processing.

7.4 Customers and Partners (the controllers). Information we process as a processor is available to the Customer that controls it. A Partner can see all of the broadcasts, usage, recordings, and chat of its End Customers, because the Partner is the controller or processor for them and needs that access to support them. If an End Customer or Viewer contacts us, we may share the fact and content of that contact with the responsible Customer or Partner.

7.5 Legal requirements and protection. We may disclose information if we believe in good faith that disclosure is required by law, regulation, subpoena, court order, or other legal process; is necessary to respond to a lawful request from a public authority, including to meet national-security or law-enforcement requirements; is necessary to enforce the Terms or investigate a violation; or is necessary to protect the rights, property, or safety of Cardinal, our Customers, Viewers, or the public. We report apparent child sexual abuse material to the National Center for Missing & Exploited Children as the law requires.

7.6 Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets or business, personal information may be disclosed to the parties involved and transferred to a successor, subject to this Policy.

7.7 With your direction or consent. We disclose information when you ask us to or consent.

7.8 Aggregate and de-identified data. We may disclose information that does not identify any person, such as statistics about usage of the Service. We will not try to re-identify de-identified data.

8. International transfers

8.1 We are located in the United States, and we store and process all personal information in the United States. Content delivery and chat use edge locations around the world so that video and chat reach Viewers quickly; the data stored at those locations is transient and is managed by our content-delivery provider under our instructions.

8.2 If you are in the European Economic Area, the United Kingdom, Switzerland, or another jurisdiction with data-transfer restrictions, your information will be transferred to and processed in the United States, a country that may not provide the same level of data protection as your home jurisdiction. Where the law requires a transfer mechanism, we rely on standard contractual clauses approved by the European Commission (and the United Kingdom addendum or international data transfer agreement, as applicable), or on another lawful mechanism, including your explicit consent or the necessity of the transfer to perform our contract with you. Business Customers may obtain those clauses through the Data Processing Addendum.

9. How long we keep information

We keep personal information only as long as needed for the purposes in Section 4 and as the law requires. Current retention periods are:

Information	Retention
Recordings, live segments, caption and transcript files	Permanently deleted 30 days after they are written. No archive is kept; deletion cannot be undone. A Customer may delete a recording earlier.
Chat messages, reactions, and gift notices	30 days after posting, then deleted
Verified Viewer name passed by a Customer	About 2 hours
Digest of IP address for wrong access-code attempts	About 10 minutes
Restream stream keys	Deleted one hour after the broadcast ends
Application and API request logs (including IP addresses and sampled URLs)	About 31 days
Website server logs	About 31 days
Database backups	Taken daily; each kept 30 days
Account, usage, billing, invoice, payment, credit, refund, and audit records	For the life of the account, and afterward for as long as needed for legal, tax, accounting, audit, and dispute purposes. Organizations are closed, not deleted. Invoices are never deleted.
Support and legal correspondence	For as long as needed to handle the matter and for as long as the law or a legal claim requires

Information held in backups is deleted when the backup expires. Information subject to a legal hold is kept until the hold ends.

10. Security

10.1 We use technical and organizational measures designed to protect personal information, including:

TLS (HTTPS) encryption for the Site, Console, API, Player, and media delivery, with HTTP Strict Transport Security.
Encryption for video sent from a Customer’s encoder to our ingest servers — TLS (RTMPS), which also protects the stream key, or AES with a passphrase unique to each broadcast (SRT); we provide ingest addresses only for encrypted connections.
API keys and ingest keys stored only as cryptographic hashes; access codes stored only as digests; restream stream keys stored encrypted with AES-256-GCM; database backups encrypted at rest.
Signed, short-lived links for recording playback and download.
Tenant isolation, so that one Customer cannot reach another Customer’s data, and a Partner can reach only the data of its own End Customers.
Staff access restricted to a managed group whose membership is re-checked continuously, with audit records of staff actions.

10.2 Where encryption in transit ends. Encryption in transit ends at our ingest servers and our delivery edge, inside our infrastructure, where video is processed to provide the Service. A restream destination that a Customer configures with plain RTMP receives the stream unencrypted, at the Customer’s direction.

10.3 No certifications. We do not currently hold SOC 2, ISO 27001, or any other third-party security certification, and we do not claim compliance with any such standard.

10.4 No method of transmission or storage is completely secure, and we cannot guarantee the security of any information. You are responsible for keeping your account credentials, API keys, ingest keys, access codes, and recording links confidential. If we learn of a breach of security affecting your personal information, we will notify you and any regulator as the law requires.

11. Your rights: residents of United States states

11.1 Who this Section covers. This Section describes rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and under the comprehensive privacy laws of other states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with similar laws), to the extent those laws apply to us and to you. Some of these laws apply only to businesses above certain size thresholds, and some exempt nonprofit organizations or data processed on another business’s behalf; where a law does not apply, we still honor the requests below as a matter of practice where we reasonably can.

11.2 Your rights. Subject to the law and to verification, you may:

Know and access: ask what personal information we have collected about you, the categories of sources, the purposes, the categories of third parties to whom it has been disclosed, and the specific pieces of information, and receive a portable copy.
Delete: ask us to delete personal information we collected from you, subject to exceptions (for example, to complete a transaction, to secure the Service, to comply with a legal obligation, or to retain billing and tax records).
Correct: ask us to correct inaccurate personal information.
Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of; if that changes, we will update this Policy and provide an opt-out.
Limit use of sensitive personal information: we do not use sensitive personal information other than as permitted for providing the Service and securing it, so no limitation right currently arises.
Opt out of profiling: we do not profile you for decisions that have legal or similarly significant effects.
Non-discrimination: we will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.
Appeal: where your state’s law provides a right to appeal our decision on a request, you may appeal by replying to our response; we will tell you the result and, if we deny the appeal, how to contact your state attorney general.

11.3 CCPA category disclosures. In the preceding 12 months we collected the following categories of personal information, from the sources, for the business purposes, and disclosed to the categories of recipients described in Sections 3, 4, and 7: identifiers (name, email, IP address, account and processor identifiers); commercial information (usage and billing records); internet and network activity (request logs, chat activity, Console and API use); audio and visual information (broadcast content, which we hold as a service provider); and professional information (organization name and role, as supplied). We did not collect characteristics of protected classifications, biometric information, precise geolocation, or inferences, and we did not sell or share any category. We retain each category for the periods in Section 9.

11.4 How to submit a request. Email legal@cardinalstreaming.com or write to the address in Section 18, stating which right you wish to exercise and the account or broadcast concerned. We do not offer a toll-free telephone number because we operate exclusively online.

11.5 Verification. To protect your information, we will verify your identity before acting on a request, typically by matching the information you provide to the information on the account and by sending a confirmation to the account email. We may ask for additional information if needed. We will not ask for government identification unless necessary.

11.6 Authorized agents. You may designate an authorized agent to make a request on your behalf. We will require the agent to provide written authorization signed by you (or a power of attorney), and we may also verify your identity directly with you.

11.7 Timing. We will confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you why.

11.8 Requests about Viewer, End Customer, or broadcast information. If your request concerns information we hold as a processor or service provider for a Customer or Partner, we will refer it to that Customer or Partner and assist them as described in Section 13.

11.9 Shine the Light. California residents may ask once a year for a notice identifying third parties to whom we disclosed personal information for their own direct-marketing purposes. We make no such disclosures.

12. Your rights: European Economic Area, United Kingdom, and Switzerland

12.1 To the extent the General Data Protection Regulation, the UK GDPR, or the Swiss Federal Act on Data Protection applies to our processing of your personal information as a controller, you have the right to: access your personal information and receive a copy; have inaccurate information rectified; have information erased in certain circumstances; restrict processing in certain circumstances; receive information you provided to us in a portable, machine-readable format; object to processing based on legitimate interests; and withdraw any consent at any time without affecting prior processing.

12.2 You may exercise these rights by contacting us at the details in Section 18. We will respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month.

12.3 You have the right to lodge a complaint with the supervisory authority in the EEA member state of your residence, place of work, or where the alleged infringement occurred, with the United Kingdom Information Commissioner’s Office, or with the Swiss Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first.

12.4 Because we do not direct the Service to individuals in the European Union or the United Kingdom, we have not appointed a representative there under Article 27 of the GDPR or UK GDPR. If that changes, we will appoint one where the law requires it.

12.5 We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

13. Viewers, End Customers, and people in broadcasts: how to exercise your rights

13.1 For information we hold as a processor or service provider (broadcast content, recordings, captions, chat, Viewer network information, End Customer records), the Customer or Partner that ran the broadcast controls the information and is responsible for responding to your request. Please contact that organization first. You will usually find its contact details on the website or app where you watched the broadcast.

13.2 If you do not know who ran the broadcast, or you cannot reach them, contact us at the details in Section 18 with the watch-page address or embed location and the approximate date and time. We will identify the responsible Customer or Partner and pass your request to them, and we will assist them in responding, including by deleting or providing information on their instruction. We will tell you that we have done so.

13.3 Because recordings, captions, and chat are deleted automatically 30 days after they are created, information you ask about may already have been deleted by the time we or the Customer respond.

14. Children

14.1 The Service, the Site, and the Console are not directed to children under 13, and chat is not intended for children under 13. We do not knowingly collect personal information from a child under 13 (or under 16 where the law of your jurisdiction sets that age) without parental consent as the law requires. If you believe a child has provided us with personal information, contact us at the details in Section 18 and we will delete it.

14.2 Children in broadcasts. Customers may stream events in which children appear, such as services, performances, classes, or camps. The Customer is solely responsible for obtaining consent from parents or guardians for a child to be recorded and streamed, for complying with laws that apply to children’s images and information, and for moderating chat where its audience may include children. We hold such content only as the Customer’s processor.

14.3 We do not sell or share the personal information of anyone, including consumers under 16.

15. Do Not Track and Global Privacy Control

15.1 Because we do not track you across websites, do not use cookies, and do not sell or share personal information, there is no tracking for a “Do Not Track” or Global Privacy Control signal to stop. We treat a Global Privacy Control signal from your browser as a valid request to opt out of any sale or sharing of personal information; since we do neither, the signal does not change how we process your information.

16. Other information

16.1 Account deletion. There is no self-service account deletion. To close your account, or to request deletion of personal information, contact us at the details in Section 18. We close (rather than delete) organization records and retain billing records as described in Section 9.

16.2 Links. The Site, the Player, and Customer broadcasts may contain links to third-party websites, including restream destinations and Customers’ giving pages. This Policy does not apply to them.

16.3 Partners’ notices. A Partner that offers streaming to its End Customers under its own brand is responsible for providing its own privacy notice to its End Customers and their Viewers that accurately describes the processing performed through the Service.

17. Changes to this Policy

17.1 We may update this Policy. We will post the updated Policy with a new “Last updated” date. If a change materially reduces your rights or materially changes how we use personal information already collected, we will give Account Holders notice by email or in the Console at least 30 days before the change takes effect. Your continued use of the Service after a change takes effect means you accept the updated Policy, to the extent the law allows acceptance in that way.

18. Contact us

Cardinal is operated by 1st Flock, LLC, which is the controller for the information described in Section 2.1.

Privacy requests and questions: legal@cardinalstreaming.com
Mailing address: 1st Flock, LLC, Attn: Privacy, 4000 Legato Road, Suite 1100, Fairfax, Virginia 22033
Legal notices: legal@cardinalstreaming.com
Data protection contact: We have not designated a data protection officer. Data-protection questions go to legal@cardinalstreaming.com.