Privacy Policy

2.1. Your account

Data: email (sign-in with a single-use code, no password) or Discord identifier if you sign in with Discord; pseudonym; language; acceptance of the terms (date and IP address).

Purpose: open your account and authenticate you. Basis: contract.

Retention: as long as your account exists. The record of acceptances is kept during the contract and then for the limitation period, as proof (article 7.1 GDPR).

2.2. Billing, payments and tax reporting (creators and agencies)

Data: first name, last name, date and place of birth, nationality, address, phone, country of tax residence, tax identifier (SIRET or equivalent), VAT number and regime, bank details, earnings, withdrawals and self-billing invoices. Collected step by step during signup, at the latest before the first payout; without them, no payout is possible.

Purpose: pay you, issue the self-billing invoices (self-billing mandate) and file the mandatory tax returns (DAC7, DAS2, VAT). Basis: contract and legal obligation (article 242 nonies A of Annex II to the French General Tax Code, Directive (EU) 2021/514, articles 240 and 1649 ter A of the French General Tax Code).

Retention: accounting records 10 years (article L123-22 of the French Commercial Code); data reported under DAC7, 5 years after the reported year; including after the account is deleted.

2.3. Identity and business verification

Data: for creators, identity document, selfie, address and tax status, collected and kept by Stripe, not by Swiplay; for studios and agencies, legal name, registration, VAT number, address, billing email and legal representative, completed where needed from public registers.

Purpose: open the payment account, verify the business, screen against international sanctions, invoice. Basis: contract, legal obligation (anti-money laundering, EU sanctions) and legitimate interest.

Retention: that of the account, then that of the accounting records (2.2).

2.4. Security

Data: IP address, browser, sign-in logs, security events.

Purpose: protect accounts and prevent fraud. Basis: legitimate interest.

Retention: technical logs 90 days; security events 5 years; financial events 6 to 10 years (accounting and tax obligations).

2.5. Linked networks and statistics (creators)

Data: username, identifier and public statistics of the accounts you link (followers, picture); public statistics (views, likes, comments, shares) of submitted videos, read through the platforms' APIs or on their public pages; if you link YouTube or Instagram, detailed statistics of submitted videos (watch time, retention, traffic sources, subscribers gained) and aggregated audience data (age, gender, country), which identify no viewer. Details by platform in section 5.

Purpose: measure your participations, calculate your earnings (with views only), show you your statistics, show them to the studio of the campaign concerned and, if you choose, in your media kit. Basis: contract; linking an account relies on your consent, which you withdraw by unlinking it; publishing your audience in your kit also relies on your consent (2.7).

Retention: as long as the link is active; deleted when you unlink the network or when the account is closed. The views used to calculate your earnings stay with the accounting records (2.2).

2.6. Submitted videos, transcription and translation (creators)

Data: the videos you submit and their information (link, title, description, thumbnail, public statistics); their written transcription, taken from the platform's subtitles (YouTube, TikTok) or, failing that, produced from the sound by a tool installed on our servers in the European Union; its automatic translation; videos sent for review; copies of videos made before October 15, 2026. To get the sound of a video without subtitles, we may use a retrieval service (3.1), which only receives the public address of the video; the sound is deleted as soon as the transcription is done.

Purpose: check that the brief is respected, let the studio follow its campaign, show you your transcription, keep evidence in case of a report, dispute or fraud. No decision is made automatically from the transcription. Basis: contract; evidence: legitimate interest.

Retention: the transcription and its translation, as long as the submission exists, and at the latest until your account is closed; the video sent for review, 30 days after it goes online, or 30 days after the end of the campaign if it is never published; copies made before October 15, 2026, as long as the campaign and any disputes about it are open, then 90 days. Everything is deleted when your account is closed, except what the law requires us to keep (2.2).

2.7. Profiles, public page and media kit (creators)

Data: for each profile, pseudonym, photo, banner, bio, private label and linked networks; what you publish on your public page and media kit (bio, links, business email, images, documents, videos, statistics); your swiplay.gg address, your change requests, the reason for a refusal and your former addresses.

Purpose: present your profiles to studios, publish your page, let you be contacted. Basis: contract; the audience of your YouTube and Instagram accounts (age, gender, country) is only published in your kit with your consent, which you give by ticking, before publishing, the box accepting its publication, and which you withdraw at any time from the editor; the kit states the source of these figures.

Retention: as long as your account exists; you can take your page down at any time. A former address remains reserved for you for 90 days, then may be taken by another user. Everything is deleted when the account is closed.

2.8. Visitors of creators' public pages

Data: country (inferred from the IP address, which is not kept), device type, category of the referring site, clicks on the page, whether or not you are signed in with a studio account; a technical fingerprint that changes every day, to count a visit only once. No cookie.

Purpose: give the creator visit statistics; they only see totals. Basis: legitimate interest of Swiplay and of the creator, without cross-site tracking.

Retention: fingerprint deleted after 3 days; daily totals contain no personal data.

2.9. Collaboration requests sent to a creator

Data: what you enter (name, company or brand, email, project, budget, message), your language, proof of your agreement and, if you tick it, your agreement to be contacted by Swiplay; an encrypted fingerprint of your IP address against abuse.

Purpose: pass your request on to the creator, or to the agency that represents them, who replies to you directly (steps taken at your request); contact you if you agreed to it (consent); limit abuse (legitimate interest).

Retention: 24 months after sending, or until the creator's account is closed if that happens first; IP fingerprint 30 days. Your agreement to be contacted can be withdrawn at any time at contact@swiplay.com.

2.10. Direct offers

Data: video concerned, proposals, messages, code or advertising authorisation, delivery, reason for a dispute and the creator's explanation. Each party only sees its own amount.

Purpose: perform the offer and settle a dispute. Basis: contract; keeping the exchanges in case of dispute: legitimate interest.

Retention: amounts, dates and statuses 10 years (accounting records); messages, codes and reasons for the limitation period applicable to disputes.

2.11. Representation by an agency

Data: the link with the agency (start, end, end request), your agreement to the mandate and its date, the record of the acts performed by the agency in your name; for an agency, its company information, its VAT regime, its acceptances and its Stripe payment account.

Purpose: enable the representation, keep proof of it and pay the agency. Basis: contract; record of the acts: legitimate interest of Swiplay and of the creator.

Retention: during the representation, then for the limitation period, as proof.

2.12. Support, reports, decisions and notifications

Support: messages and attachments sent through the “Help and support” page and our replies (contract); kept as long as your account exists, anonymised when it is closed.

Reports of content: address of the page, content concerned, explanations, name, email, statement of good faith and our exchanges (legal obligation, Regulation (EU) 2022/2065, articles 16 and 17). The author's name and email are not passed on to the creator concerned, unless necessary. Kept for the time needed to handle the report, then for the limitation period.

Team decisions (refusal, removal, recovery of earnings): the reason given to you and the team's internal notes, kept with the submission or account concerned, as proof (legitimate interest); they are provided to you if you request access to your data.

Notifications in your account: 12 months.

2.13. Preferences, lists and emails

Display currency (contract): conversions use the rates published by the European Central Bank, to which no data is sent.

“Notify me” for a service in preparation: your request, its date, your language, your IP address and your browser (consent); kept until the launch message or until you ask to stop being notified (contact@swiplay.com).

Newsletters and marketing: opt-in only (consent), revocable through the link in each email or at contact@swiplay.com; sending stops as soon as you withdraw. Email delivery events (delivered, opened, clicked) are kept for the duration of the account.