Privacy Policy

Last update: September 29, 2026

1. Introduction

This Privacy Policy explains how personal data is processed when you use the community (the “Platform”) available in a mobile application or website published by a third party (the “Publisher”) and powered by a technical solution provided by Octopus Community (the “Provider”). In this Policy, “we” and “us” refer to the Publisher, and to Octopus Community when it acts on the Publisher's behalf.

This Policy is provided for information, in accordance with Articles 12 to 14 of the GDPR. It is not a contract and does not require your acceptance. The rules for using the community are set out in the Terms of Use and the Community Guidelines.

By “personal data”, we mean any information that directly identifies you (for example your photo, name or email address) or indirectly identifies you (for example your user ID or device-related technical details).

2. Who is responsible for your data

The Publisher — the company that publishes the application or website in which you use the community — is the data controller. Its name and contact details appear in the privacy policy of that application and on its page in the app store. Where the Publisher provides its own privacy policy for the community, that policy applies.

Octopus Community, a SAS incorporated in France with its registered office at 14 avenue du Général de Gaulle, 94160 Saint-Mandé, France, operates the Platform on the Publisher's behalf as data processor. It processes your data only on the Publisher's instructions.

For any question about this Policy, or to reach Octopus Community's Data Protection Officer, write to contact@octopuscommunity.com.

3. Data we collect

3.1 Data you provide

Account. You access the community through the Publisher's application, which handles your sign-in. The Publisher may share the information needed to create your community account, such as an email address, age, username, profile picture or description. Where the Publisher uses a separate community profile, only an identifier is shared.

Within the community you may choose a username and add a profile picture and a short description (“Bio”), which can include links to other profiles or websites. These are optional.

Content you share. We process and store the content you share (such as messages and photos), your interactions (such as reactions and poll answers), and the technical data associated with them (date, time and IP address).

Content you share is visible to other users, who can save it, for example by taking a screenshot. Where the Publisher makes the community publicly accessible, it may also be indexed by search engines.

We discourage you from sharing sensitive information, such as your racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation or sex life. If you choose to publish such information in the community, you make it manifestly public.

Direct interactions. If you report a user or content, ask for help, make a complaint or exercise your rights, we process the information in your request. It is not shared with other users.

3.2 Data collected automatically

Technical data: IP address; language settings; operating system; user ID (a unique identifier associated with your account); install ID (an identifier associated with your installation of the application); and, where the application uses push notifications, the identifier needed to deliver them to your device.

Community activity:

• the dates and times you signed up, logged in and logged out;
• your settings, such as notification or display preferences;
• your interactions with community features and other users — reactions, groups visited, content viewed, app opens, reports — with their date and time;
• your gamification level and score, and engagement metrics calculated from your activity;
• performance metrics of the community features;
• where the Publisher uses the corresponding feature, whether you hold an active subscription or entitlement in the Publisher's app;
• a record of your acceptance of the Terms of Use and Community Guidelines.

Optional features. The Publisher may use additional capabilities of the Octopus SDK in its own app, such as sending us events about actions you perform in that app. Where it does, it informs you in its own privacy policy. Data collected this way is kept for no more than 13 months, and some of it is not stored at all.

3.3 Data we receive from others

We may receive information from the Publisher (for example when you sign in through its application, or about your access rights or subscription), and from other users (for example through their content or reports).

4. How we use your data

4.1 Account and access to the community

• Creating, verifying and managing your community account;
• Giving you access to community features, such as posting content and interacting with other users;
• Handling your requests, questions and complaints;
• Sending in-app notifications and emails about interactions with other users, new features, and community or security updates.

Legal basis: performance of the contract between you and the Publisher, formed by the Terms of Use (Article 6(1)(b) GDPR).

4.2 Statistics and improvement of the Platform

• Measuring how the community is used and producing usage statistics;
• Developing new features and running tests to assess them;
• Identifying and fixing technical issues, and improving performance;
• Assessing service quality through optional surveys and feedback;
• Tailoring the content displayed to you and suggesting posts or features based on your interactions.

Statistics produced to improve the Services as a whole are based on irreversibly anonymised data.

Legal basis: the Publisher's legitimate interests (Article 6(1)(f) GDPR).

4.3 Online safety

• Moderating content and profiles that go against the Community Guidelines: warnings, removal or filtering of content, restriction of its visibility, or suspension of your account. Some content may be filtered, restricted or removed automatically. A suspension or a ban of an account is always decided by a person.
• Using automated technologies to detect breaches of the Community Guidelines and manifestly unlawful content, such as violence, drug-related content, child abuse, spam, and sexually explicit, hateful or discriminatory content — including before it is reported.
• Detecting and preventing fraudulent profiles.
• Recording reports made by users or moderators, so that they can be reviewed.
• Improving our safety procedures and tools, including quality reviews of moderation.

You are told of a measure taken against your content or account and of its reasons, and you can contest it, as set out in the Community Guidelines.

Legal basis: the Publisher's legitimate interest in keeping the community safe and respectful, and applicable legal obligations. Where the Terms of Use are enforced following a breach, the legal basis is performance of the contract between you and the Publisher (Article 6(1)(b) GDPR).

4.4 Legal compliance

• Removing or disabling access to unlawful content as soon as we become aware of it, and preserving the related evidence;
• Handling situations or content that may pose a threat to life or safety, such as self-harm or violence, and informing the competent authorities where the law requires it;
• Responding to lawful requests from judicial or administrative authorities;
• Handling your requests under Section 7.

Legal basis: the legal obligations to which we are subject (Article 6(1)(c) GDPR).

4.5 Translation and AI-assisted features

We use AI-assisted technologies to moderate content, to translate content, to suggest content likely to interest you, and to help the Publisher's team create and animate community content. Content created this way is published under a profile controlled by the Publisher.

The providers involved are bound by contract not to use content to train any model, and to keep it no longer than necessary to process the request and to prevent abuse.

Legal basis: performance of the contract between you and the Publisher, and the Publisher's legitimate interest in a safe and active community.

5. How long we keep your data

5.1 Your account and its deletion

At any time, you can delete your posts, comments and polls, remove your reactions, and change your username, profile picture and bio.

Your community account is deleted if you ask for it, or if you remain inactive for 3 years — meaning you neither access the community nor contact us during that period. The Publisher may set a shorter period.

When your community account is deleted:

• your profile is no longer visible to other users;
• your posts, comments, polls and reactions are permanently deleted;
• content that had been moderated, and the data needed to link you to your past activity, are kept for 12 months and then permanently deleted;
• all other data is deleted, subject to the periods in Section 5.2.

Removing a comment also removes the context of the replies left by other users, so a discussion may show gaps.

Deletion requests are processed within one month. Residual copies in our automated backups are destroyed within 180 days and remain protected until then.

Data we are legally required to keep, in particular under the laws governing online services, is deleted once the legal period has expired.

5.2 Specific periods

• Moderated content and moderated profiles: 12 months after the moderation decision or ban;
• Data linking you to your past activity, after deletion of your account: 12 months after the deletion request;
• Contacts with support and requests to exercise your rights: 3 years, or until the end of the 12-month period above if your account is deleted, whichever comes first;
• Identity documents provided as proof: deleted once the request has been processed;
• Data collected through an optional feature used by the Publisher: 13 months at most;
• Residual copies in automated backups: 180 days at most.

Data may be kept longer where the law requires it, or for as long as necessary to resolve a dispute or to establish, exercise or defend legal claims. After that, it is permanently deleted or irreversibly anonymised.

6. Who we share your data with

• Other users see the content you publish, with your username, profile picture and bio — and, where the Publisher makes the community publicly accessible, so can the public and search engines.
• Authorised staff of the Publisher and of Octopus Community, only as needed for the purposes in Section 4, under confidentiality obligations.
• Service providers that help operate the Platform: hosting and infrastructure, content delivery, content moderation, and translation and AI-assisted features. They are bound by contract to protect your data. The list is published at octopuscommunity.com/legal/subprocessors.
• A buyer or successor in the event of a merger, acquisition, restructuring or other change of control.
• Courts, authorities, legal advisers and experts, where necessary to comply with the law, answer lawful requests, protect the safety of any person, or establish, exercise or defend legal claims.

7. Your rights

You have the right to:

• access your data and receive a copy of it in a commonly used format (portability);
• rectify inaccurate, incomplete or outdated data — much of it can be changed directly in the app;
• erase your data or your whole account;
• withdraw your consent at any time, where processing is based on it;
• object to processing, on grounds relating to your particular situation;
• restrict processing in certain cases;
• give instructions on what happens to your data after your death.

To exercise these rights, contact the Publisher using the details in its privacy policy. You can also write to contact@octopuscommunity.com: your request is then handled on the Publisher's behalf where it has authorised Octopus Community to do so, or passed on to the Publisher without delay.

These rights may be limited by law, in particular to protect the rights of others. Where we cannot fully meet your request, we tell you why. We may ask for proof of identity if there is reasonable doubt as to who you are.

You may lodge a complaint with the data protection authority of the country where you live, work, or where you believe the breach took place. In France, this is the CNIL (www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

8. Security

We take appropriate technical and organisational measures to protect your data, including encryption of data in transit and at rest, and strict control of staff access.

If a personal data breach occurs, Octopus Community informs the Publisher without undue delay so that it can meet its own obligations.

9. Children

The Platform is not available to people under 16, or under a higher age where the law or the Publisher requires it. If the Publisher informs us that an account does not meet the age rules, the account and its data are disabled or deleted.

Content that sexually exploits or endangers children is prohibited. Where it is detected, it is made inaccessible, the evidence is preserved and the Publisher is informed without delay.

10. International transfers

Your data is hosted in the European Union. Our databases and backups are in the European Union, and our disaster recovery site is in the European Economic Area (EEA).

Some service providers are established outside the EEA. Transfers to them rely on an adequacy decision of the European Commission — including the EU-U.S. Data Privacy Framework — or on Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional measures. Each provider, its location and the applicable mechanism are listed at octopuscommunity.com/legal/subprocessors.

11. Changes to this Policy

We may update this Policy to reflect legal, technical or practical developments. The date of the last update is shown at the top. We will inform you in advance of any significant change.

12. Contact

For any question about this Policy or your personal data, contact the Publisher or write to contact@octopuscommunity.com.