Privacy Policy

Privacy Policy — Winstory

ARTICLE 1 — CONTROLLER

For its own purposes, the controller is WINSTORY, a French SAS, SIREN 924 927 965. Requests are sent to 8 rue de Wattignies, 75012 Paris, France. No data-protection officer is designated. The title is not used. That does not remove the rights.

ARTICLE 2 — SCOPE

This policy informs persons. Where a professional customer is controller, its information and the DPA prevail for that processing. Winstory remains controller for billing, security and evidence.

ARTICLE 3 — LEGAL BASIS

The legal basis is stated by purpose. Performance of the service requested, a legal obligation and the legitimate interest in security are the main bases. Acceptance of the terms is not consent to all processing.

ARTICLE 4 — ACCOUNT

The account is processed to provide and secure it: identifiers, connection logs, public wallet. Basis: performance and legitimate interest in security. Retention: life of the account, then limitation.

ARTICLE 5 — CAMPAIGN

Parameters, briefs and participations are processed to perform the Campaign. Basis: performance. Retention: the Campaign term then evidence and limitation periods.

ARTICLE 6 — UGC

Videos and metadata are processed to host, display and moderate. Basis: performance. A person’s image may reveal data; it is not classified as biometric data merely because of an ordinary video.

ARTICLE 7 — AI

Prompts, reference media and outputs are processed for the requested generation. Basis: performance. Providers receive what is necessary for that generation. Winstory does not state that each provider forbids every derived use.

ARTICLE 8 — MODERATION

Votes, grounds and logs are processed for security and evidence. Basis: legitimate interest and, where relevant, a legal obligation. Retention: the time useful for appeal and limitation.

ARTICLE 9 — MODERATOR

The public wallet address, the deposit and reputation are processed for vote access. Basis: performance. The public chain makes the transaction visible independently of Winstory.

ARTICLE 10 — PAYMENT

Stripe receives the payment data required. Basis: performance and the legal accounting obligation. Retention: accounting periods, in practice ten years for French accounting records where the law requires it.

ARTICLE 11 — SPENDABLE CREDIT RECORD

Spendable and promotional credits are processed in order to apply them to the service. Basis: performance. They are not a copy of the bank card.

ARTICLE 12 — CONNECT

Identity data requested by Stripe Connect for a payout are processed in order to pay the Reward. Basis: performance and the provider’s legal obligation.

ARTICLE 13 — CHAIN

A public transaction cannot be erased by Winstory. Associated off-chain information is deleted under the periods in this policy.

ARTICLE 14 — CRM

Professional contacts used for an ongoing business relationship are processed on legitimate interest, with a right to object. They are not described here as a purchased prospecting file.

ARTICLE 15 — EVIDENCE

Proof of acceptance, payment and moderation is kept for limitation, which may reach five years for personal actions and ten years for accounting records. Basis: legal obligation and legitimate interest in a defence.

ARTICLE 16 — SECURITY

Security logs are processed on legitimate interest to detect fraud, for a proportionate period, then deleted or aggregated.

Content reports, notice contact details, moderation decisions, statements of reasons and platform review requests are processed to handle alleged illegal content and platform-policy restrictions, on the basis of legal obligation and legitimate interest in security, with retention limited to what is necessary for handling, defence and applicable transparency duties.

ARTICLE 17 — PROFESSIONAL CUSTOMER

The customer’s billing data are processed for the contract and accounting. The DPA does not absorb them where they belong to Winstory.

ARTICLE 18 — AGENCY

The end client’s name entered by the agency is processed to perform the Campaign. It does not by itself prove the mandate.

ARTICLE 19 — COOKIES

Trackers are described in the cookie policy. Accepting them is distinct from accepting the terms.

ARTICLE 20 — SUPPORT

Complaint messages are processed in order to answer them and keep evidence. Basis: performance or legitimate interest. Retention: the dispute then limitation.

ARTICLE 21 — RETENTION

Retention follows the purpose: open account, Campaign until its end, then evidence and accounting archives. There is not one period for everything.

ARTICLE 22 — RECIPIENTS

The recipients are Stripe, the host, the database, the AI providers called for a generation, and authorities where the law requires it. There is no sale of files.

ARTICLE 23 — TRANSFERS

Providers may be outside the European Economic Area. Not all personal data remains in the EEA. The mechanism is adequacy or the clauses of the provider concerned, where they exist for that provider.

ARTICLE 24 — RIGHTS

The person may request access, rectification, erasure, restriction, objection, portability where the basis allows it, and withdraw consent without retroactive effect on processing that was already lawful. The request is sent in writing to the address in article 1.

ARTICLE 25 — CNIL

The person may refer the matter to the CNIL, the supervisory authority, www.cnil.fr, without prejudice to a court action.

ARTICLE 26 — AUTOMATED DECISION

A Campaign rank is not presented, by itself, as an automated decision producing a legal effect within the meaning of article 22. If a processing fell within it, the person would have a right to human intervention.

ARTICLE 27 — MINORS

Paid operations, Rewards and image or voice uses are reserved to persons aged at least eighteen. This rule is not presented as a technical check already carried out on every visit.

ARTICLE 28 — SECURITY MEASURES

The measures include access control, encryption in transit where the channel allows it and logging. They do not remove every risk.

ARTICLE 29 — UPDATE

The policy may be updated. The version published on the date of consultation is the one that informs. A substantial change of a purpose is the subject of appropriate information.

ARTICLE 30 — CONTACT

Rights are exercised in writing at 8 rue de Wattignies, 75012 Paris, France. A reply is given within the periods of the regulation.