Start a project

Stream Privacy Policy

Last updated: October 17, 2026

1. Who we are and what this policy covers

This policy explains how Stream ("Stream," "we" or "us") collects, uses and shares personal information through its own websites and tools: stream-holdings.com, the Stream console and business portal at admin.stream-holdings.com, the Stream Kitchen order screen at kitchen.stream-holdings.com, and the concept and demo websites Stream runs to show businesses what their websites could look like, until a business launches one as its own (together, the "Stream Sites").

Stream builds and runs websites for local businesses such as restaurants and shops. When you order from, create an account on, or write to one of those businesses through a website it has launched, that business decides how your information is used and its own privacy notice applies. Stream handles that information only as the business's service provider, on its behalf. If you are a customer of a business that uses Stream, please read that business's privacy notice and contact the business with any questions.

2. Information we collect

We collect what you give us, what is created as you use the Stream Sites, and limited information from the companies we work with.

  • Inquiries. When you ask about a website on stream-holdings.com, we collect your name, email address, business name and type, website, timeline, the features you are interested in, and your message.
  • Concept and demo sites. What you enter on a concept or demo site, such as a message in its contact form or an account you create there. A message meant for the business a concept site shows may be passed on to that business, and if the business launches the site, what you entered there moves with it to that business.
  • Owner and staff accounts. Your name, email address, password (stored only in scrambled, hashed form), role, and the businesses you work with. If an owner invites you, we receive your email address and role from them.
  • Business information. What a business gives us to build and run its website, such as its name, addresses, phone numbers, hours, menus, prices, photos and logos, and the names and contact details of its owners and staff.
  • Billing. Owners pay for Stream by card through Stripe. The card number goes from your browser straight to Stripe. We receive the card's brand, last four digits and expiry date, and your billing history.
  • Payouts. When an owner sets up payouts, Stream opens the business's Stripe account and gives Stripe the business's name, email address, address, phone number and website. Stripe then collects the owner's identity, tax and bank details directly, under its own privacy policy, and tells us the account's status.
  • Point-of-sale connections. If a business connects Square or Clover, we keep the access keys those services issue and the settings needed to send them orders.
  • Kitchen devices. For each ticket printer and order screen, we keep its name, location, pairing key, status (for example, out of paper), when it last checked in, and for printers, the hardware (MAC) address.
  • Support. What you tell us by email, text message, phone or form when you ask for help.
  • Technical information. Our servers and hosting providers record your IP address, browser and device type, the pages and features you use, and the date and time, so we can run and protect the Stream Sites. We also keep your browser and device type with each sign-in and form entry, and a scrambled (hashed) form of your IP address with each form entry, to keep accounts secure and stop spam.

3. How we use it

We use personal information to:

  • answer inquiries and prepare quotes and preview sites;
  • build, host and run businesses' websites, ordering, rewards, forms and kitchen tools;
  • create and secure accounts, send invites and password reset links, and keep people signed in;
  • charge plan fees, send receipts, and help owners set up and open their payout accounts;
  • send service messages, such as missed-order alerts, failed payment notices and printer problems;
  • give support and fix problems;
  • keep the Stream Sites secure and prevent fraud, spam and misuse;
  • improve our services, using de-identified or combined data where we can;
  • send owners news about Stream, which you can stop at any time (Section 8); and
  • meet legal, tax and accounting duties and enforce our agreements.

We use software tools, including artificial intelligence tools, to help design, write, build and support websites, and the companies that provide them are among the service providers in Section 4.

4. Who we share it with

We do not sell personal information, and we do not share it for targeted advertising. We share it only with:

  • Service providers that host, store, send or process information for us under contract: hosting, security and cloud providers (such as Cloudflare and Google Cloud), our database provider (Neon), email providers (such as Resend and Google), and the software and artificial intelligence providers that help us build and support websites.
  • Stripe, which processes plan payments and runs businesses' payout accounts. Stripe also uses information under its own privacy policy, for example to prevent fraud.
  • Point-of-sale providers such as Square or Clover, when a business connects one, so its orders reach that system.
  • The business you work with. Its owners can see the names, email addresses and roles of its team members.
  • Others, when the law requires it, such as in response to a subpoena or court order, or when needed to protect the rights, property or safety of Stream, our clients or others.
  • A buyer or successor, if Stream is merged, acquired or sells its assets, who must protect the information as this policy describes.
  • Anyone else you ask us to share it with.

5. Cookies, local storage and Do Not Track

The Stream Sites do not use advertising or analytics cookies. They use your browser's local storage to keep you signed in, keep an order screen paired, and remember settings and any cart. Our hosting provider may set cookies it needs for security. To count visits, we may use Cloudflare Web Analytics, which does not use cookies or follow you to other websites.

On billing and checkout pages, Stripe's payment form sets its own cookies and collects information about your device and browser to prevent fraud, under Stripe's privacy policy. Some forms may use Cloudflare Turnstile, which checks your browser to tell people from spam bots. Apart from these, no other company collects information about your activity across websites through the Stream Sites.

Because we do not track visitors across other websites, we do not change anything when a browser sends a Do Not Track signal.

6. How long we keep it

  • Inquiries: as long as we need to answer and follow up.
  • Concept and demo sites: as long as the site runs.
  • Accounts and business information: while the business uses Stream. After a business leaves, we delete or de-identify its information within a reasonable time, except what we must keep for legal, tax or accounting reasons.
  • Billing records: as long as tax and accounting laws require.
  • Technical logs: generally no more than thirty (30) days, unless we need them longer to look into a security problem.
  • Sign-in and form records: the browser details and hashed IP addresses kept with them stay as long as the account or form entry they belong to.

Backups are overwritten on their normal schedule, and we may keep information longer when the law requires it or to resolve a dispute.

7. Security

We protect personal information with reasonable safeguards: every Stream Site uses an encrypted (HTTPS) connection, passwords are stored only in hashed form, accounts lock for 15 minutes after 10 failed sign-in attempts, card numbers go to Stripe without passing through our servers, and access to our systems is limited to people who need it. No system is perfectly secure, so we cannot promise that information will never be accessed without permission. If a breach affects your personal information, we will notify you as the law requires.

8. Your choices and rights

  • See or correct your information. Email us at jeremie@stream-holdings.com for a copy of your personal information or to correct it. Owners can also change their team's access in the business portal.
  • Delete it. Email us to ask, and we will delete or de-identify your information unless we must keep it for legal, tax or accounting reasons or to provide services a business has not cancelled.
  • Stop news emails. Use the unsubscribe link in any marketing email or tell us. Service messages, such as receipts and alerts, continue while you have an account.
  • Customers of a business that uses Stream should contact that business. If you contact us instead, we will pass your request to the business.

We may ask you to confirm your identity before acting on a request, and we answer within forty-five (45) days. If your state's privacy law gives you more rights, we will honor them as that law requires, and we will not treat you differently for using them.

9. Children

The Stream Sites are not directed to children under 13. We do not knowingly collect personal information from children under 13, and we delete it if we learn we have.

10. Where information is stored

Our servers and database are in the United States. Our hosting provider's network may handle your connection in another country so pages load quickly.

11. Changes to this policy

We will post any change here and update the date at the top. If a change is material, we will also tell account holders by email or in the business portal before it takes effect.

12. Contact us

For any question or request about privacy, email us at jeremie@stream-holdings.com.