Last update: September 16, 2026
At Octopus Community ("we" or "Octopus Community"), we are strongly committed to protecting the privacy of our clients ("Clients") and their end users ("Users") and ensuring complete transparency regarding how their personal data is collected, used, and shared.
By "personal information" or "personal data", we mean any information that can identify you directly (such as your photo, name, or email address) or indirectly (such as a user ID, location data, or technical information about your device).
This Privacy Policy explains how personal data is processed in connection with our services, including our SDKs, APIs, and administration tools (collectively, the "Services"), as well as our websites ("Sites"), including www.octopuscommunity.com and dashboard.octopuscommunity.com.
This Privacy Policy is supplemented by our Cookie Policy, which provides detailed information about the use of cookies and similar technologies on our Sites.
This Policy does not apply to the processing of personal data relating to Octopus Community employees.
This Privacy Policy is provided for information purposes, in accordance with Articles 12 to 14 of the GDPR. It is not a contract and does not require your acceptance: it describes how personal data is processed and what rights you have in relation to it. The terms governing the use of a community are set out in the terms of use and community rules made available within the Client's application.
If you are a member of a community powered by Octopus Community, the publisher of the application through which you access that community is the controller of your personal data. The privacy notice describing that processing is made available within that application, and a default version is published at www.octopuscommunity.com/privacy-policy-en.
If you have any questions, please contact us at contact@octopuscommunity.com.
Octopus Community is a technology company that provides a community platform designed to be embedded into mobile applications and websites operated by its Clients, in order to:
The Client is the publisher of one or more applications or websites into which the Services are integrated via Octopus Community SDKs and APIs.
Octopus Community acts as a data controller for the personal data it processes for its own purposes, including through its websites.
When our SDKs are integrated into a Client's application, the Client acts as the data controller for the personal data collected through the application. In this context, Octopus Community acts as a data processor, in accordance with a data processing agreement entered into with each Client, and processes data solely on the Client's instructions and in compliance with the GDPR.
Octopus Community SAS is headquartered at 14 Avenue du Général de Gaulle, 94160 Saint-Mandé, France, and is registered with the Créteil Trade and Companies Register under number 929385888.
Contact: contact@octopuscommunity.com.
We process data related to:
To create a Client account or subscribe to our Services, you are required to provide professional contact details such as your name, company name, job title, email address, postal address, and phone number.
We also collect personal data when you contact us via contact forms, phone calls, video calls, or in person (for example at events or trade shows).
Phone or video calls may be recorded for training and service improvement purposes.
In the context of a Client or supplier relationship, we process billing, transaction, payment, and contractual information.
Account data: Users create a community account by choosing a username. They may optionally add a profile picture and a short biography, which may include links to external profiles or websites.
When Single Sign-On (SSO) is used, the Client's authentication service may transmit certain information to us, such as email address, username, profile picture, or biography, to enable account creation.
Community content: We process and store content shared by Users (such as photos and messages), as well as their interactions (reactions, poll responses).
We also process technical data associated with these actions (timestamps, operating system information, IP address).
Content shared within a community may be visible to other Users, who may save it (e.g. screenshots). In some cases, content may also be indexed by search engines and become publicly accessible.
Users are strongly discouraged from sharing sensitive personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or intimate life). Where such data is voluntarily made public by Users in accessible areas, it is considered manifestly made public within the meaning of Article 9(2)(e) GDPR. Octopus Community neither encourages nor requires the publication of such data.
Community engagement data: We process data derived from a User's activity within the community, such as engagement indicators, levels, scores, or similar features made available to the community.
Access and status information provided by the Client: The Client may transmit to us, through the SDK or our APIs, information relating to a User's access rights or status within its own application, so that community features can be made available accordingly.
Records of acceptance of terms: Where the Client uses the corresponding feature, we record the acceptance by a User of the terms of use and the community rules, so that the Client is able to demonstrate that acceptance.
Content published by the Client: The Client may publish content within its community from its administration dashboard, or from its own systems through the APIs made available by Octopus Community. Such content is defined by the Client, which is responsible for it as data controller.
Direct interactions with us: When a User reports content or another User, contacts support, files a complaint, or exercises data protection rights, we process the information provided. This data is not shared with other Users.
Photo access: Our SDK does not access the device photo gallery directly. When a User uploads a photo, the SDK relies on system-level components provided by iOS or Android, and only the selected image is shared.
Device and technical data: We collect certain information about the device used to access the Services, including:
Community activity data, including:
Activity on our Sites
When browsing our Sites, we automatically collect certain information, such as:
For more information about the cookies and similar technologies we use on our Sites, including their purposes and how to manage them, please refer to our Cookie Policy.
Other Users: We may receive information from other Users, particularly through user-generated content, support requests, or reports.
Business Partners: We may receive personal data from our business partners, for example in connection with joint marketing operations, events, or the distribution of our Services, and where an existing Client or partner introduces a prospective client to us, including under our referral programme. Where we obtain professional contact details in this way, we inform the person concerned in accordance with Article 14 GDPR.
Simplified Registration or Login: When Users sign up or log in via Single Sign-On (SSO), we may receive certain personal data from the relevant provider (for example, Google, Apple, or Meta), such as an email address.
We process data for the following purposes:
Legal basis: These processing activities are based on the performance of the contract entered into between Octopus Community and the Client, consisting of the Order Form, the Master Services Agreement, and the Data Processing Agreement.
Legal basis: These processing activities are carried out for the performance of the contract between the User and the Client, as reflected in the community terms of use integrated into the Client's application.
In this context, Octopus Community acts solely as a data processor and processes Users' personal data on behalf of, and in accordance with the instructions of, the Client.
We process certain data in order to measure how the Services are used, analyse their performance, improve their operation, and provide Clients with insights into their community, including to:
These processing activities are carried out strictly in the context of providing the Services to the Client and in accordance with the parameters and instructions defined by the Client.
Data concerned
Depending on the configuration chosen by the Client and how Users interact with the Services, these processing activities may involve the following categories of data:
Community insights and reports. We produce, for each Client, insights and reports on the activity of its community — such as activity trends, themes discussed, and engagement indicators — which may be generated with the assistance of the features described in Section 4.4 and are made available to the Client's teams. Octopus Community also produces comparative benchmarks across the communities it operates; these are produced exclusively on irreversibly anonymised data, and data relating to one Client's community is never made visible to another Client.
Optional analytics features used by the Client. Where the Client implements optional SDK analytics capabilities within its own application, additional categories of data may be involved:
Where analytics are carried out by Octopus Community for the overall improvement of its Services (and not for the specific provision of Services to a given Client), they are performed exclusively on irreversibly anonymised data. Such processing does not involve personal data and therefore falls outside the scope of the GDPR.
Legal basis
Personal data processing described in this section is carried out on behalf of the Client and is primarily based on:
Where these features are used, we process community content in order to:
Our commitments. Every provider involved in providing these features is bound by contract not to retain content beyond the processing of the request and not to use it to train any model. These providers are identified, together with their location and the applicable transfer mechanism, in the sub-processor list published at octopuscommunity.com/legal/subprocessors, which forms part of the data processing agreement entered into with each Client.
Translation and AI-assisted features are provided in agreement with the Client and in accordance with the configuration it defines.
Content generated with AI assistance. A Client may choose to publish, within its community and under a profile it controls, content that has been drafted or suggested with the assistance of these features. Such content is published under the Client's responsibility.
Legal basis: These processing activities are carried out on behalf of the Client, based on the performance of the contract between the User and the Client and on the Client's legitimate interest in operating and animating its community. In this context, Octopus Community acts as a data processor.
We process personal data to ensure the security of communities and to prevent content that is illegal or violates the Community Rules, including through:
Automated assessment of content, and human review where it matters. Content and profiles are first assessed by automated tools, against the Community Rules configured by the Client, which also defines the action associated with each rule. Depending on that configuration, an automated assessment may result in an individual item of content being filtered, having its visibility restricted, or being removed, without prior human intervention.
No community account is suspended or banned without human review. Any temporary or permanent suspension is reviewed by a human moderator — a member of the Octopus Community moderation team, or the Client's own team acting from its dashboard.
Where the applicable Community Rules provide for the User to be informed of a measure applied to their content, the User is informed of the measure and of the reasons for it, and may contest it and request human review through the channel made available by the Client. Any measure may in all cases be reviewed and reversed by the Client's moderation team, or by Octopus Community acting on the Client's instructions. These assessments are based solely on the Community Rules and on the detection of unlawful content, and are never used for any other purpose, and in particular never for profiling for marketing purposes.
Because measures taken solely by automated means concern individual items of content, and never the existence of a User's community account, they do not constitute decisions producing legal effects concerning the User or similarly significantly affecting them within the meaning of Article 22(1) GDPR. Decisions that would have such an effect — the suspension or the ban of an account — always involve human intervention.
Legal basis:
These processing activities are carried out on behalf of the Client, based on the Client's legitimate interest and/or legal obligations to ensure a safe online environment.
In this context, Octopus Community acts as a data processor. It carries out moderation within the rules, thresholds, and parameters defined by the Client, and determines only the technical means of implementing them. The Client may review, override, or reverse any moderation measure from its dashboard.
Octopus Community may also process certain personal data in order to comply with its own legal obligations, in particular in relation to the handling of manifestly illegal content and cooperation with competent authorities.
Moderation activities are carried out in accordance with the Community Rules, which are made available to Users within the Client's application and describe prohibited content, possible moderation measures, and available remedies.
We process personal data for compliance purposes, including:
Legal basis: These processing activities are based on legal obligations applicable to the Client, with Octopus Community acting as a data processor, and on Octopus Community's own legal obligations where these apply directly to it.
We process personal data in order to:
Legal basis: Octopus Community's legitimate interest (Article 6(1)(f) GDPR) in securing its Services and protecting its rights, and, where applicable, compliance with a legal obligation.
We process personal data in order to manage our relationships with Clients, partners, and suppliers, including:
Legal basis: These processing activities are based on the performance of contractual or pre-contractual measures between Octopus Community and the relevant party.
We may process personal data for the following purposes:
Community content used in our own communications. Where a Client has agreed to act as a commercial reference, we may illustrate our communications with content that is publicly visible within its community, such as extracts or screenshots of community pages. Before any such use, we remove or obscure the elements that identify individual Users, in particular usernames and profile pictures, so that the illustration does not allow a User to be identified. Where a User could nonetheless be identified — for example because they are quoted by name with their agreement — we obtain their prior consent.
Legal basis: Where required by applicable law, these processing activities are based on consent. Where we address a professional at their professional contact details about a matter relating to their professional activity, they are based on our legitimate interest in developing our business (Article 6(1)(f) GDPR). In all cases, you may object to receiving marketing communications at any time, without having to give a reason, by using the unsubscribe link included in every message or by contacting us.
We process personal data for recruitment purposes, including:
Legal basis: Steps taken at the request of the applicant prior to entering into a contract (Article 6(1)(b) GDPR) and, where we retain an application for future opportunities, Octopus Community's legitimate interest in maintaining a talent pool, subject to the applicant's right to object.
We retain Users' personal data for as long as necessary to enable use of the Services.
Users can act directly. At any time, a User may delete their own posts, comments, and polls, remove their reactions from other Users' content, and change their username, profile picture, and biography.
A community account is deleted if:
A Client may instruct a shorter inactivity period, in accordance with the data processing agreement entered into with it.
Upon deletion of a community account:
Please note that removing a User's comment also removes the context for any replies left by other Users, so a discussion thread may show gaps.
Deletion requests are processed within one (1) month of the User's request. Residual copies present in automated backups are retained for the period set out in Section 5.2 and are subject to the same security and confidentiality obligations until they are destroyed.
These provisions are subject to any data that must be retained for legal reasons, in particular under applicable laws governing online services, and such data will be deleted once the relevant legal retention periods expire.
The following categories of data are subject to specific maximum retention periods:
Notwithstanding the above, certain personal data may be retained for a longer period where required by law, or for as long as necessary to resolve disputes or to establish, exercise, or defend legal claims.
After the applicable retention periods expire, data is permanently deleted, except where the table above expressly provides for anonymisation. Where data is anonymised, the anonymisation is irreversible and does not allow any direct or indirect re-identification of the User.
Retention periods applicable to data processed on behalf of Clients are defined in accordance with the Client's instructions and validated under the applicable data processing agreement.
At the end of these periods, data is deleted or anonymised for statistical purposes, unless legal obligations or ongoing disputes require longer retention.
Personal data relating to job applicants is retained for the duration necessary to process the application.
If no employment contract is concluded, applicant data is retained for up to two (2) years after the last contact with the applicant, unless the applicant objects or explicitly consents to a longer retention period.
If the applicant is hired, their personal data is included in their HR file and retained in accordance with applicable employment laws.
We only share personal data where this is strictly necessary, in particular in the following situations:
Other Users. Content published by a User within a community, together with their username, profile picture, and biography, is visible to the other Users of that community and, where the Client has enabled a publicly accessible community, to the public and to search engines.
Octopus Community personnel. Authorised employees of Octopus Community may access personal data solely to the extent required to perform their duties and for the purposes described in Section 4. Access is subject to strict confidentiality obligations and role-based access controls.
Third-party service providers (sub-processors). We may share personal data with carefully selected service providers that assist us in operating, securing, and improving the Services, in particular for hosting and infrastructure, content delivery, content moderation, and translation and AI-assisted features. All such providers are contractually bound to provide appropriate safeguards, to process personal data in compliance with applicable data protection laws, and not to use content submitted through the Services to train their own models. Each of them is identified, with its purpose, its storage location, and the applicable transfer mechanism, in the sub-processor list published at octopuscommunity.com/legal/subprocessors. Clients are informed in advance of any addition or replacement of a sub-processor and may object on documented data protection grounds, in accordance with the data processing agreement entered into with them.
Client's own analytics tools. Where the Client implements the Octopus Events publisher capability and forwards events to its own analytics or tracking providers, those providers become recipients of the relevant community activity data. The Client is responsible, as data controller, for the choice, configuration, and compliance of those providers, including with respect to consent collection and international data transfers.
Corporate transactions. In the event of a merger, acquisition, restructuring, insolvency, or other change of control affecting Octopus Community, personal data may be transferred as part of the transaction, subject to applicable legal safeguards.
Affiliated entities. We may disclose personal data to entities affiliated with Octopus Community where necessary to operate the Services or for other purposes described in this Privacy Policy.
Legal claims and enforcement of rights. We may share personal data where necessary to establish, exercise, or defend our legal rights, to enforce the agreements entered into with our Clients, or in connection with legal proceedings, audits, or dispute resolution. This may include disclosure to courts, regulators, legal advisors, insurers, or expert consultants.
Legal obligations and public safety. We may disclose personal data to judicial, administrative, or other competent authorities where required to comply with applicable laws, regulations, court orders, subpoenas, or lawful requests, or where disclosure is necessary to protect the rights, safety, or integrity of individuals, Users, Clients, the Services, or Octopus Community.
Many changes can be made directly, without contacting anyone: within a community, a User may at any time delete their own posts, comments, and polls, remove their reactions, and edit their username, profile picture, and biography.
You have the following rights under applicable data protection laws:
To exercise these rights, please contact us at contact@octopuscommunity.com.
We respond free of charge and within one month of receiving your request. Where the request is complex or where we receive a large number of requests, this period may be extended by two further months, in which case we will inform you within the first month and explain why (Article 12(3) GDPR).
Where Octopus Community acts as a data processor, requests relating to the exercise of rights are handled on behalf of the Client, acting as data controller. If you are a member of a community, please address your request to the publisher of the application through which you access that community. Where such a request reaches us directly, we handle it on the Client's behalf where we are authorised to do so, or forward it to the Client without undue delay.
The exercise of these rights may vary depending on the applicable laws and regulations. These rights may be subject to limitations where permitted by law, in particular in order to protect the rights and freedoms of others, comply with our legal obligations, preserve confidentiality obligations, protect trade secrets, and safeguard intellectual property rights. We may retain certain personal data where required by law, or where such retention is necessary to establish, exercise, or defend legal claims, or to resolve a dispute. Where applicable, we will inform you of the reasons why we are unable to fully or partially comply with your request.
We may request proof of identity if reasonable doubts exist as to the identity of the requesting party.
If you believe your rights have been violated, you may lodge a complaint with the French data protection authority, the CNIL, via www.cnil.fr or by mail at: CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risks, including encryption of data in transit using TLS 1.3 and encryption of data at rest.
Our security measures include, in particular:
Personal data breaches. We maintain a breach management process.
Where Octopus Community acts as data controller, we notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33(1) GDPR, and we inform the individuals concerned where the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR).
Where Octopus Community acts as data processor, we notify the Client without undue delay after becoming aware of a personal data breach, in accordance with Article 33(2) GDPR, providing the information the Client needs in order to meet its own notification deadline.
The Services provided by Octopus Community are intended to be integrated into applications operated by its Clients and are not intended for children under the age of 16. The minimum age for a community account is 16, as set out in the terms of use that Users accept before contributing to a community, unless a higher age is required by applicable local law or set by the Client.
Within the scope of SDK-based Services, the Client is solely responsible for defining, implementing, and enforcing rules regarding the minimum age of Users, including any age verification mechanisms and, where applicable, parental consent requirements.
Octopus Community acts solely as a data processor and processes personal data relating to minors only on the documented instructions of the Client.
If a Client informs Octopus Community that a community account does not comply with applicable age rules or has been created in violation of applicable laws or the Client's terms, Octopus Community will promptly disable or delete the account and the associated personal data, in accordance with the Client's instructions and applicable legal obligations.
Content that sexually exploits or endangers children is prohibited in every community. Where such content is detected, we prevent it from being accessible, preserve the relevant evidence, and notify the Client without delay. Reports concerning the safety of a minor are handled as a priority.
Where the platform runs. Octopus Community SAS is a French company. The platform — compute, databases, storage, and backups — runs on cloud infrastructure located in the European Union, with a disaster recovery region also located within the European Economic Area (EEA). Community content and moderation data are hosted in the EU.
Where transfers occur. Some of our sub-processors are established outside the EEA. Each of them is identified in the sub-processor list published at octopuscommunity.com/legal/subprocessors, together with its country of establishment, its storage location, and the transfer mechanism that applies to it.
On what basis. Any transfer of personal data outside the EEA takes place on the basis of one of the following mechanisms:
What we require from every sub-processor. Whether established within the EEA or in a third country, all sub-processors are bound by written agreements that set out their data protection obligations, the principles of lawfulness, transparency, and data minimisation, the security measures they must implement, a prohibition on using content submitted through the Services to train their own models, and the monitoring and audit mechanisms available to us to verify their compliance.
We may update this Privacy Policy from time to time to reflect technical, economic, regulatory, or legal developments, or changes in our data processing practices.
The version in force, and the date of the most recent update, are shown at the top of this document and published at www.octopuscommunity.com/privacy-policy. Where changes are material, we will inform you in advance by email or through in-app notifications, so that you can review them before they take effect. Previous versions of this Privacy Policy are available on request.
Where a change to this Privacy Policy affects the retention periods applicable to personal data processed on behalf of a Client, Octopus Community informs that Client in advance, in accordance with the data processing agreement entered into with it.
If you have any questions regarding this Privacy Policy or any requests related to your personal data, you can contact us at contact@octopuscommunity.com..
Ready within 24h — we'll send it straight to your inbox.
Sandbox environment, no credit card required.
Your demo API key will be in your inbox
at within 24h.
In the meantime, explore the
developer docs →
