Ariel Belhamou (Entrepreneur individuel (immatriculation en cours)) — Adresse postale communiquée sur demande à belhamouariel@icloud.com
Contact: belhamouariel@icloud.com. No Data Protection Officer is currently designated; the contact above is your entry point for any question about your data.
2. Data we collect
• Account: email, name, username, profile photo, bio; if you sign in with Google: identifier, email and name provided by Google.
• Usage: booked sessions, followed creators, session chat messages, private messages and shared images, reviews, reports and blocks.
• Payment: transaction history and payment status (card numbers are NEVER stored by VYVE — they are handled directly by Stripe Payments Europe, Ltd.).
• Technical: IP address, technical logs, device identifiers, push notification token.
• Creators: information needed to pay out their earnings (Stripe payout account, payout history).
3. Purposes and legal bases (GDPR)
• Providing the service (account, bookings, lives, messaging) — performance of contract.
• Collecting payments and paying creators — performance of contract.
• Bookkeeping and tax obligations — legal obligation.
• Securing the platform, preventing fraud and abuse — legitimate interest.
• Handling reports and moderating content — legal obligation and legitimate interest.
• Sending you push notifications — consent (revocable at any time in Settings or your device settings).
• Sending service emails (confirmations, security) — performance of contract.
We do no targeted advertising, no sale of data, and no fully automated decision-making with legal effects.
4. Recipients and processors
Your data is processed by our providers, each for its own mission:
• Supabase, Inc. — database and authentication (hosted in the European Union, Paris region).
• Stripe Payments Europe, Ltd. — payments and payouts.
• LiveKit, Inc. (États-Unis) — live video streaming.
• Vercel Inc. — website hosting.
• Resend (Plus Five Five, Inc., États-Unis) — transactional emails.
• Expo (650 Industries, Inc., États-Unis) — push notification delivery.
• Google LLC — only if you choose Google sign-in.
And administrative or judicial authorities where required by law. We do not sell your data to anyone.
5. International transfers
Our primary data is hosted in the European Union (Paris). Some providers (Stripe, LiveKit, Vercel, Resend, Expo, Google) may process data in the United States or outside the EU; such transfers are covered by appropriate safeguards: adequacy decision (EU-US Data Privacy Framework) and/or the European Commission’s standard contractual clauses.
6. Retention periods
• Account and profile data: for the life of the account, then erased or anonymized within 30 days of account deletion.
• Financial records (transactions, payouts, refunds): 10 years after the relevant fiscal year (accounting and tax obligation) — upon account deletion they are kept in a separate archive, isolated from the deleted profile.
• Technical and security logs: 12 months maximum.
• Live video and audio: nothing is kept. The stream is neither recorded nor stored — it is gone when the session ends.
• Private messages and media: for the life of the conversation, deleted with the account.
• Push notification token: until notifications are disabled or the account is deleted.
• Reports and moderation records: 12 months after the case is closed.
7. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time (for processing based on it). Under French law you may also set directives about your data after your death (art. 85, Loi Informatique et Libertés). You can delete your account directly in Settings, or email us at belhamouariel@icloud.com — we reply within one month. You may lodge a complaint with your data protection authority; in France: the CNIL (www.cnil.fr).
8. Cookies and trackers
The website only uses cookies and storage strictly necessary for the service: the "vyve-lang" cookie (remembering your language) and your session authentication tokens. No advertising cookies and no third-party analytics trackers are used — which is why no consent banner is required. You can delete these cookies in your browser settings (you will then be signed out).
9. Minors
VYVE is not intended for people under 16. We do not knowingly collect their data; any such account will be deleted.
10. Security
We apply appropriate technical and organizational measures: encryption in transit (TLS), row-level access control (RLS) on the database, key and role separation, least privilege, logging. No system is completely secure; in case of a data breach likely to result in a high risk to your rights, you will be notified in accordance with the GDPR.
11. Changes
This policy may change; material changes will be notified to you.