StreamYard can now keep personal data for three years after you leave

The change

StreamYard is a browser-based studio for live streams and recordings, used by marketers, podcasters, and event teams. It is run by Bending Spoons, the Italian company whose name appears throughout its legal documents. On October 1, 2026, three of those documents were replaced at once: the Terms of Service, the Data Processing Addendum, and the Privacy Policy. The versions they replaced were all dated January 1, 2026.

These are full rewrites, not edits. Almost every line is different, which makes them hard to compare by eye. Read side by side, the new documents give the company more room in three areas: how long it keeps data, what it may do with that data for itself, and when it may end an account.

What changed

• Deletion. Personal data is now deleted "three years after the last use of the Services or the expiration of the subscription." The old addendum had no fixed period and tied deletion to the customer's written direction.

• Bending Spoons' own purposes. A new section 11 of the addendum authorizes Bending Spoons to process customers' personal data "for the following autonomous further purposes."

• Indemnity. The customer must now "defend, indemnify and hold harmless the Processor." The old addendum had no indemnity.

• Termination. StreamYard may end the terms "at any time (a) for any reason by providing you with prior notice." Under the old terms, ending a customer's agreement required an uncured material breach or insolvency.

• Inactive accounts. An account with no active plan that has not been accessed for 36 months can be deleted with its content.

• Advertising. A new clause says "The Service may contain advertisements."

• Retention in the Privacy Policy. Marketing data goes from two years to three, support data from three years to five, and compliance data from seven years to ten.

• One document for everyone. The terms now cover hosts, team members, guests, and viewers in a single document, with Bending Spoons Operations S.p.A. as the contracting party.

• Edits in the customer's favor. Interest of "2% per month" on overdue balances is gone, the Privacy Policy no longer lists your employer as a recipient of your data, and a customer can leave at no cost if the processor breaches the addendum and does not fix it.

Three years after you leave

The old addendum put the customer in charge at the end of the contract: "StreamYard shall, at the written direction of the Customer, delete or return Customer Data to the Customer, on termination of the DPA unless required by applicable laws to store the Customer Data."

The new one sets a clock. Recordings follow the retention rules of the customer's plan. For other personal data, "three years after the last use of the Services or the expiration of the subscription, as defined in the Agreement, whichever occurs later, the Processor shall delete the Personal Data." Before that point, the company "shall offer a means for the Customer to retrieve the Personal Data," and "The Customer shall reimburse the Processor for any additional costs arising from the return of the Personal Data."

Personal data here means data about real people that passes through a customer's streams, such as speakers and chat participants. A company that stopped using StreamYard used to be able to tell it to delete that data. The new addendum no longer says so, and the default is that the data stays for up to three years.

Bending Spoons' own purposes

A data processing addendum normally rests on one idea: the vendor handles personal data only on the customer's instructions. The old StreamYard addendum made one exception, for account data such as names, contact details, and usage. For everything else it said "Customer is the controller of Customer Data and StreamYard is the processor."

The new section 11 is headed "Further processing carried out by Bending Spoons as Autonomous Data Controller." It reads: "The Customer authorizes Bending Spoons to process Personal Data involved in the Services for the following autonomous further purposes: (1) establish, exercise, or defend rights of Bending Spoons and its affiliates, including proving the correct execution of the Service, (2) comply with legal or regulatory obligations applicable to the processing and retention of data to which Bending Spoons is subject, (3) ensure and improve the quality and the proper functioning of the Service, including by analyzing, preventing or correcting failures and bugs, as well as the illicit use or misuse of the Services, and (4) enforce the Agreement and enhance the safety and integrity of the Services."

The addendum defines Personal Data as the data "that the Processor processes on behalf of the Customer." So the company's own purposes now reach the data it handles for customers, not only account data. Three of the four purposes are defensive. The third, improving the service, is the broad one. Changes inside a data processing addendum are easy to miss, as when Klaviyo stopped promising to pass privacy requests on to its customers.

New duties and costs for customers

• Two indemnities are new. The customer indemnifies the processor for breaches of privacy law, and must "defend, indemnify and hold harmless the Processor (including its employees and affiliates)" from claims connected with the customer's use of the services.

• Objecting to a new sub-processor is still allowed, but the addendum adds a warning: "objecting to the use of a Sub-processor may prevent the Processor from offering the Services to the Customer."

• Audits are limited to "no more than once per year" unless an authority asks for one.

• There is one new right. If the processor breaches the addendum and does not fix it within thirty days of notice, "the Customer will be entitled to withdraw from the Agreement at no cost and without penalties."

One Terms of Service, with new rights for StreamYard

The old Platform Terms applied to hosts and their team members and sent everyone else to a separate document. The new Terms of Service say: "These Terms apply to you regardless of whether you use or access the Service as a Host, Team Member, Guest, or Viewer." The contracting party changed from Bending Spoons US Inc. to Bending Spoons Operations S.p.A., and the page now holds two versions, one for the US and the rest of the world and one for the European Economic Area, the United Kingdom, and Switzerland.

The US version adds several rights that the old terms did not have:

• "We may terminate these Terms or your right to access or use the Service at any time (a) for any reason by providing you with prior notice." The old terms let either side terminate if the other "materially breaches this Agreement and does not cure the breach within 30 (thirty) days," and promised a prorated refund if StreamYard was the one in breach. StreamYard could already discontinue the service itself at any time, but not end one customer's agreement without cause.

• "We will consider your account as inactive if you have not accessed your account for 36 (thirty-six) months and you do not have an active Subscription Plan. We may delete your account and the Content associated with it, if it becomes inactive."

• "You agree that we, our affiliates, and our third-party partners may place advertising on the Service."

Changes to when a platform can cut off a customer are worth tracking, as when Meta dropped the 30-day notice from its WhatsApp Business terms. So are new grounds for deleting stored data, as when Apple gave itself the right to delete iCloud data over the storage limit.

Longer retention in the Privacy Policy

The Privacy Policy covers the data StreamYard holds as a company in its own right, such as account, marketing, and support records. Three of its retention periods grew.

• Marketing: from "no more than 2 years" to "no more than three (3) years."

• Customer support: from "no more than 3 years from your most recent interaction" to "no more than five (5) years from when we close your request."

• Compliance: from "no more than 7 years" to "no more than ten (10) years."

What did not change

• The licence customers give StreamYard over their content is worldwide, royalty-free, and non-exclusive in both versions.

• The US terms still require arbitration and waive class actions, with a 30-day window to opt out.

• Bending Spoons US Inc. is still named as the data controller in the Privacy Policy.

Why this matters

When a product is rewritten under one owner's standard terms, the changes do not arrive one clause at a time. They arrive as a new document that looks nothing like the old one, and the redline is close to solid. A reader who opens the page sees clean, modern terms and has no way to tell which sentences are new and which promises are missing.

Here the missing pieces add up. The customer's right to direct deletion at the end of the contract became a three-year default. A processor that acted on instructions became, for some purposes, a company using the same data for itself. A contract that ended for cause can now end for any reason. Each of these is disclosed, and a business that runs customer events or interviews on StreamYard is affected by all three.

Potential impact

If you use StreamYard, the update raises five practical questions:

• Do your streams and recordings include personal data of guests or viewers that your own privacy notice says you control?

• When you stop using StreamYard, what do you need to export first, and is three years of retention acceptable for the rest?

• Does your own data processing record still describe StreamYard as a processor only?

• Do you have an account without a paid plan that nobody has logged into for a long time?

• Would your team see a termination notice in time to move a scheduled event?

How Venpo detected it

Venpo monitors StreamYard's legal documents as part of continuous vendor risk monitoring. It recorded all three new versions and compared each with the one it replaced. Because the documents were fully rewritten, every point in this article was checked against the complete old and new texts and against the live pages, and anything that had only moved was left out. The redlines are on the change pages for the Data Processing Addendum, the Terms of Service, and the Privacy Policy, and every monitored StreamYard document is listed on the StreamYard vendor profile.

Business outcome

Teams that track StreamYard had the old and new wording side by side on the day the rewrite appeared. That is enough to update a vendor record, decide whether the addendum still fits the events they run, and plan an export before leaving. Without the old text, the same team would be reading a tidy new contract with no sign of what it replaced. That gap is the hidden risk of vendor legal changes.

Key takeaway

StreamYard's October 1 rewrite keeps customers' personal data for three years after they leave, lets Bending Spoons use that data for four purposes of its own, and allows termination for any reason with notice. None of it is visible from the new documents alone, because a full rewrite hides what was removed. The only reliable check is to monitor vendor terms of service and keep the old version to compare.