Privacy Policy — Lyw

Version 1.1 Last updated: 12 September 2026

Preamble

Lyw (hereinafter "Lyw", "we") places paramount importance on protecting the personal data of its Users. The purpose of this Privacy Policy (the "Policy") is to inform Users about how their personal data is collected, used, stored and protected in connection with the use of the Lyw platform (hereinafter the "Platform").

The Policy complies with Regulation (EU) 2016/679 of 27 April 2016 ("GDPR") and Act No. 78-17 of 6 January 1978 as amended, known as the "French Data Protection Act".

1. Identity of the data controller

The controller of the personal data is:

Company name: LYW, SAS with share capital of €2,000 Registered office: 61 rue Rossini, 06000 Nice, France RCS / SIRET: RCS Nice 105 173 504 / SIRET 105 173 504 00017 GDPR contact email: dpo@lyw.studio

2. Data collected

We collect and process the following categories of data:

2.1 Data declared by the User

All Users:

• Last name, first name, email address, password (encrypted);
• Registration date;
• Usage preferences (favorites, hidden items, etc.).

Talents:

• Date of birth;
• Self-declared physical characteristics (height, gender, hair and eye colour, skin tone, ethnic appearance, clothing size, visible tattoos, etc.);
• Uploaded photographs;
• Residence address (city, country);
• Bank details (via Stripe Connect — not stored by Lyw).

Creators:

• Company name or trade name;
• Type of activity;
• Postal address and registered office;
• SIRET / intra-EU VAT number;
• Bank details (via Stripe Connect — not stored by Lyw).

2.2 Data collected automatically

• IP address, browser type, technical session identifiers, collected and retained by the technical processors (Supabase, Vercel) under their own retention policies;
• Strictly necessary cookies (see Cookie Policy).

2.3 Data from third parties

• Stripe: identity verification status (KYC for Talents, KYB for Creators), legal name, country, Connect account status. Identity supporting documents are not transmitted to Lyw: they are retained by Stripe.
• Resend: delivery status of transactional emails (sent, opened, bounced) — not linked to any behavioural analysis.
• VIES (the European VAT number register): for Creators established in the European Union outside France only, the response to the query of their intra-EU VAT number — validity of the number, company name and address as recorded by the Member State, consultation number. Lyw retains only the validity, its date and the consultation number: the company name and address returned are neither stored nor displayed (see section 4.3).

2.4 Sensitive data

Some of the data collected (ethnic appearance, photographs) may qualify as special category data within the meaning of Article 9 of the GDPR.

3. Purposes and legal bases

Beyond the periods indicated above, or upon the User's request under the conditions set out in Article 6, the data is deleted or anonymised, subject to applicable legal retention obligations (in particular accounting and tax obligations).

3.1 Account deletion at the User's initiative

The User may at any time request the deletion of their Account from the settings ("Sensitive zone" section). This deletion takes effect immediately and entails the following processing of the data:

Data erased immediately (in all cases):

The erasure is complete and unconditional: no personal data of the User is kept in the Platform's active systems. The following, in particular, are erased:

• Last name, first name, date of birth, nationality, postal address;
• Photographs and videos uploaded to the Platform (deletion from the database and cloud storage);
• Physical characteristics provided (height, hair and eye colour, skin tone, ethnic appearance, clothing size, presence of tattoos);
• Gender, phone number;
• For the Creator: company name, legal form, SIREN number, intra-EU VAT number together with the outcome of its VIES verification, registered office address, description, social media links and contact details;
• Unsigned contract drafts;
• Applications to campaigns that did not result in an actually paid Assignment Contract;
• Contracts at the stage of an unfinalised proposal (statuses: submitted, awaiting payment, refused, expired, cancelled);
• Authentication identifiers (anonymised email address, password and session metadata overwritten, account permanently blocked).

Concluded Assignment Contracts — archived copy:

When an Assignment Contract has been actually paid, it constitutes accounting supporting evidence within the meaning of Article L123-22 of the French Commercial Code. Upon its conclusion, Lyw seals an immutable copy of it (a document frozen as at the date of the contract), retained for the legal period of ten (10) years. This copy contains the parties' identification details set out in Appendix A:

• for the Talent: last and first name, date of birth, postal address, Lyw identifier and Stripe Connect account identifier;
• for the Creator: company name or identity (depending on whether the Creator acts as a legal entity or as a sole trader), legal form, SIREN number, intra-EU VAT number, registered office address, Lyw identifier and Stripe Connect account identifier.

This data is retained exclusively within this archived contractual document — the active profiles themselves being entirely erased (see above). This retention is expressly justified by Article 17.3.b of the GDPR (exception to the right to erasure for compliance with a legal obligation) and by the aforementioned accounting obligations. At the end of the ten (10) year period, the archive is deleted automatically.

In the absence of an actually paid Assignment Contract, no personal data of the User is retained.

Data shared with a third party (exchanges between Users):

The messages the User has exchanged with other Users of the Platform are not erased upon the deletion of their Account. These messages are shared co-data of which the other party to the exchange is also a recipient and has a legitimate interest in retaining (Article 6.1.f of the GDPR), in particular to document the commercial or contractual relationship. The User whose Account is deleted will appear, in the conversations they had started, under a note indicating the closure of the Account.

Stripe Connect account:

The Stripe Connect payment account associated with the User is not closed upon the deletion of the Lyw Account: it remains active at Stripe to allow any pending payments to be completed and Stripe's obligations to be met (in particular the retention of KYC data for five years). The User may, if they wish, request the closure of this account directly from Stripe.

3.2 Automated purge mechanism

Lyw operates an automated mechanism that deletes, daily and without human intervention, data whose retention period has expired: expired contract drafts, reports handled more than twelve months ago, audit logs older than ten years. This mechanism ensures effective compliance with the retention periods set out in the table in Article 3.

4. Recipients and processors

Personal data may be disclosed to the following recipients:

4.1 Within Lyw

Only the natural persons authorised by Lyw, strictly within the scope of their duties.

4.2 Processors

4.3 Verification of the intra-EU VAT number (VIES)

Where a Creator is established in the European Union outside France, Lyw queries the VIES system (VAT Information Exchange System) to verify the validity of their intra-EU VAT number. This verification conditions the application of the reverse charge: without it, Lyw could not justify not charging French VAT on its commission.

The query transmits the VAT number to the European Commission, which forwards it to the tax administration of the Member State that issued the number. Neither acts as a processor on Lyw's behalf: they handle the request in the exercise of their own public duties, under Regulation (EU) No 904/2010 on administrative cooperation in the field of VAT.

Because a sole trader's VAT number is derived from their identification number (in France, the SIREN), it may constitute personal data. The query is nevertheless limited to that number alone, to the exclusion of any other Account data, and takes place within the European Union: it does not constitute a transfer within the meaning of Chapter V of the GDPR.

4.4 Public authorities

Data may be disclosed to any competent administrative or judicial authority, upon a legally founded request.

5. Transfers outside the EU

As indicated above, some data is hosted or processed outside the European Union:

• Supabase: main servers in Singapore (a zone of partial adequacy recognised by the European Commission).
• Vercel and Resend: hosting and servers in the United States.

These transfers are governed by Standard Contractual Clauses (SCCs) or by adherence to the EU-US Data Privacy Framework (formerly Privacy Shield) signed with the processors concerned. Lyw relies on the technical and organisational safeguards implemented by its processors for the protection of the transferred data.

6. Rights of data subjects

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

• Right of access (art. 15): obtain confirmation that data concerning you is being processed and receive a copy of it;
• Right to rectification (art. 16): have inaccurate or incomplete data corrected;
• Right to erasure or "right to be forgotten" (art. 17): request the deletion of your data under the conditions provided for by law;
• Right to restriction (art. 18): temporarily suspend the processing of certain data;
• Right to portability (art. 20): retrieve your data in a structured, machine-readable format;
• Right to object (art. 21): object to the processing of your data based on legitimate interest;
• Right to withdraw your consent at any time, for processing based on that consent;
• Right to set directives regarding the fate of your data after your death (Article 85 of the French Data Protection Act).

How to exercise your rights

These rights may be exercised at any time:

• via your Account settings ("Sensitive zone" section for Account deletion);
• by email to dpo@lyw.studio;
• by post to the registered office address (see Legal notice).

Lyw will respond within one (1) month of receiving the request, which may be extended by two (2) months for complex requests, in accordance with Article 12-3 of the GDPR.

Complaint to the CNIL

You have the right to lodge a complaint with the French supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy — TSA 80715 75334 Paris Cedex 07, France Phone: +33 1 53 73 22 22 Website: https://www.cnil.fr

7. Security

Lyw implements reasonable technical and organisational measures to ensure a level of security appropriate to the risk:

• Encryption of data in transit (TLS) across the entire Platform;
• Encryption at rest provided by the technical processors (Supabase, Vercel);
• Password hashing in accordance with industry standards, performed by Supabase Auth;
• Access controls at the database level via Supabase's Row Level Security mechanism, restricting access to data to its sole legitimate owners;
• Regular backups carried out by the technical processors.

8. Minors

The Platform is strictly reserved for adults (18 years and over). Lyw does not knowingly collect any data concerning minors. If you become aware that a minor has created an Account by circumventing this restriction, please report it to us immediately at dpo@lyw.studio: the Account will be deleted and the data erased.

9. Changes to the Policy

Lyw reserves the right to amend this Policy. Registered Users will be notified by email and by a conspicuous notice on the Platform at least thirty (30) days before substantial changes take effect.

10. Contact

For any question regarding this Policy or the exercise of your rights, you can contact us:

• By email: dpo@lyw.studio
• By post: LYW — 61 rue Rossini, 06000 Nice, France

End of the Privacy Policy — Version 1.1