That would be my interpretation, but I’m not a lawyer.
And what you describe is debatable if it’s a valid/acceptably use case.
And then it gets more complicated when you consider GDPR and right to be forgotten.
Since you are using undocumented end points there is no way for Twitch to notify you to delete the data, you stored. Especially since you shouldn’t have the data given you used undocumented end points.