Privacy

Who is responsible

BLEUCOMMERCE, Paris, France, is responsible for your data on Fanvayra.

Privacy contact: privacy@fanvayra.com. Write there with any question about your data or to use your rights.

If you have an account

• Your account: your email address, which version of the terms you accepted and when, and your stated age (15 or older).
• Signing in: our database provider keeps your session open with the IP address and browser you used, and a log of sign-in events (your email address and what happened, such as a link sent or a sign-in), for security.
• Your page: everything you publish on it, such as your name, links, pictures and gamer tags. These are public.
• Your actions: a log of changes made to your account, so they can be undone and for security.
• Reports you send: the reason, the message and your email address (optional only for a report about a child's safety).
• Security: to limit abuse, a keyed hash of your IP address or email, kept for minutes and at most an hour.
• The host's technical logs: IP address, page requested and time, which the service needs to run.

If you visit a creator's page

When you open a creator's page or press one of its buttons, we count it for that creator's statistics: the time, what the page was showing, where you came from (only the site's name, such as tiktok.com, or the link's tag) and which button you pressed.

We store no IP address, no browser details and no identifier, and set no cookie for this. Our host sees your IP address in its technical logs, and we use a keyed hash of it for a few minutes to limit abuse.

Why: giving the creator statistics about their own page, on the basis of our legitimate interest. They are kept for 25 months.

You can object: below, stop counting your visits on this browser. We then set one cookie, relay_no_stats, that holds only that choice, for 13 months. Your visits and clicks are no longer counted; the page works as before.

For your other rights, write to privacy@fanvayra.com. Because visits aren't linked to anyone, we usually can't find yours.

Why, and on what legal basis

• Providing the service, your account and your page: performing our contract with you.
• Protecting the service and preventing abuse (sign-in, limits, logs): our legitimate interest in keeping the service safe.
• Handling reports: our legal obligations as a host, and our legitimate interest in enforcing the terms.
• Giving creators visit statistics: our legitimate interest in showing them how their page is used, limited to what is described above, which you can object to.

Who receives your data

• Our host: OVH SAS, in France.
• Our database, sign-in and media: Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; data stored in Paris (eu-west-3). Its data processing agreement includes the European Commission's standard contractual clauses for any access from outside the European Union.
• Sign-in emails are sent by: Brevo SAS, 17 rue Salneuve, 75017 Paris, France; data stored in the European Union (France and Belgium).
• Our error monitoring, when it is switched on: Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, United States; data stored in Frankfurt, Germany. It receives what failed and where (the page, the browser), never your IP address, email or cookies. Reports from your browser go through our own servers.
• Backups: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, United States. They are made there every day, then kept encrypted with a key only we hold, under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023).

Pictures of YouTube videos come through our own servers, so YouTube doesn't see your IP address. A page's buttons lead to other sites, which have their own rules.

We don't sell your data, and we show no targeted advertising.

How long

• Visit statistics: 25 months, then deleted.
• Your account and page: until you delete your account. The page goes offline as soon as you ask, and everything is erased 30 days later.
• Sign-in sessions (IP address, browser): until they expire or you sign out, and erased with the account.
• Sign-in event log: 24 hours.
• Sign-in emails at our email provider (your address, time, delivery): 1 month; the content of the emails is not kept.
• The log of your actions: while the account exists, erased with it.
• Reports: until they are closed, then 12 months.
• Your page's name: held for 90 days after erasure, to prevent impersonation. We keep the name alone, nothing about the person.
• Security hashes: minutes to an hour.
• The host's technical logs: no record of requests (IP address, page, time) is kept; error messages, which hold no IP address, are overwritten as they fill up.
• Database backups: 30 days. Erased data can remain in them for up to that long, then is gone.
• Error reports: 30 days.
• Your choice not to be counted (relay_no_stats): 13 months, or until you take it back.

Cookies and storage

We use no advertising or audience measurement cookies, which is why you see no banner.

• Sign-in cookies: they keep your session open. The service needs them.
• relay_lang: remembers the language you chose, for one year.
• relay_no_stats: only if you ask for it, remembers that your visits must not be counted, for 13 months.
• Browser session storage: two display preferences on creators' pages (a tip you closed, a lighter effects mode), cleared when the tab closes and never sent to our servers.

Your rights

You can access, correct and erase your data, ask for a portable copy, restrict how it is used, and object to it.

In Settings, "Download my data" gives you a copy and "Delete my account" starts erasure. For anything else, write to privacy@fanvayra.com. We answer within one month, which we may extend by two months for a complex request, telling you so. We may ask you to confirm the request from your account's email address.

When you delete your account: your page goes offline at once; 30 days later your account, page, pictures, links, statistics, sessions and the log of your actions are erased; your page's name stays reserved for 90 days; reports about your page are kept until closed, then 12 months; the sign-in event log and backups expire on the periods above.

If you believe your rights aren't being respected, you can complain to the CNIL, the French data protection authority: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.