Privacy

Last updated: 21 September 2026. This page explains what data our servers process and why (GDPR Art. 13 notice).

Controller: Sergen Stream — operated by 2Run (Halil Ertekin), Rollekens 83, 2400 Mol, Antwerpen, Belgium · Company no. (KBO) 1038.480.317 · VAT BE 1038.480.317 · halil@2run.be · 2run.be Questions and requests: halil@2run.be
Data we process and legal bases: Pairing record (performance of contract, GDPR Art. 6(1)(b)): a randomly generated device id, an optional device name and the source configuration you attach (M3U URL, EPG URL or Xtream login). This configuration is transient: at the latest 2 hours after it is first downloaded by the target device it is automatically erased, together with every copy — your playlist lives on your device. "Remove this device's list" on the portal erases it instantly.
Connection and technical data (legitimate interest, Art. 6(1)(f) — security and abuse prevention): IP address, country/city (Cloudflare edge metadata), device model, OS, app version, timestamps.
Payments: payments run through Mollie B.V. (Netherlands); we never see or store card/iDEAL/Bancontact details. Mollie shares only the payment status and the device-id reference with us.
Invoice details (legal obligation, Art. 6(1)(c) — Belgian accounting and VAT law): the name, email and address you enter at the payment step are passed to 2Run's accounting platform Billit (Belgium) to issue the sales invoice, which is sent to you by email. The email is also used for your receipt and licence information — never for marketing. Invoices are kept for the statutory retention period (7 years).
Cookies and device storage: We use strictly functional storage only: a "lang" cookie for your language choice and browser storage for app settings. No analytics or advertising trackers — hence no consent banner (ePrivacy exemption).
Retention: Pairing codes are deleted after 30 minutes. The source configuration (playlists) is automatically erased at the latest 2 hours after it is first downloaded by the target device — the permanent copy of your list is on your own device. Device records (identifier, connection and technical data) are deleted when you request it, or automatically 24 months after last use. Payment records are kept by accounting under Belgian tax law.
Recipients and transfers: Hosting and database: Cloudflare, Inc. (EU and global network; data processing agreement in place). Payments: Mollie B.V. (Netherlands). The APK download is served from this site (via Cloudflare). Transfers to these providers are covered by EU standard contractual clauses / adequacy decisions.
Your rights: You may exercise access, rectification, erasure, restriction, portability and objection by writing to halil@2run.be with your device id; we reply within 30 days. You can find your device id in the app under Settings → Device Pairing. If unsatisfied, you may lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, rue de la Presse 35, 1000 Brussels, gegevensbeschermingsautoriteit.be).
Automated decisions and profiling: None. Geographic/technical data is used only for security, diagnostics and support you request.
Children: The service is not offered to users under 13 (Belgian threshold) without parental consent.
Security: All traffic is HTTPS; sites are served with a strict Content-Security-Policy and permission headers; administrative access is restricted by a separate key; Xtream credentials are processed only to run the service and can be deleted with one click on the portal.