Privacy Policy
Last updated: [date]
1. Data controller
[Company legal name], tax ID [NIF], registered office at [address], Spain. Contact: finvify@gmail.com. [If a data protection officer is appointed: dpo@…] This policy complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights (LOPDGDD).
2. Data we process
• Account data: email, encrypted password, username, language and currency. • Public profile: display name, photo, cover, bio, social links and wishes. • Identity verification (creators): legal name, date of birth, ID document and, if the provider requires it, a facial image to check it matches the document. • Payout data (creators): bank account holder and IBAN. • Payment data (fans): amount, date, last digits of the card and result of the transaction, provided by the payment processor. • Activity: contributions sent and received, nicknames, notes, spending limits and support messages. • Technical data: IP address, device, browser and security logs.
3. Purposes and legal bases
• Providing the service, managing your account and processing payments and payouts: performance of a contract (art. 6.1.b GDPR). • Verifying identity and age, and preventing money laundering: legal obligation (art. 6.1.c GDPR, Law 10/2010). Where a facial image is used, it is processed with your explicit consent (art. 9.2.a GDPR) and only for verification. • Meeting tax and accounting obligations, including platform reporting: legal obligation (art. 6.1.c GDPR). • Preventing fraud, keeping the Platform secure and handling chargebacks: legitimate interest (art. 6.1.f GDPR). • Sending marketing communications: your consent (art. 6.1.a GDPR), which you can withdraw at any time. • Non-essential cookies: your consent, as described in the Cookie Policy.
4. What each user can see
Fans only see the creator's public profile. Creators see the nickname and note of whoever sends them a contribution, unless it was sent anonymously. No user can see another user's email, address, bank details or payment details.
5. Retention periods
• While your account remains active. • Identity verification and transaction data: 10 years from the end of the relationship, under Law 10/2010. • Tax data: 4 years, under the Spanish General Tax Law. • Accounting records: 6 years, under the Spanish Commercial Code. After these periods, data is deleted or anonymised.
6. Recipients
We only share data where needed to provide the service: • Payment processor: [name]. • Identity verification provider: [name]. • Hosting and email delivery: [names]. • Authorities, where legally required. All of them act as processors under a contract compliant with article 28 GDPR, unless they act as independent controllers by law.
7. International transfers
If any provider processes data outside the European Economic Area, it will do so with appropriate safeguards, such as European Commission adequacy decisions or standard contractual clauses.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent, by writing to finvify@gmail.com and stating the right you wish to exercise. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Minors
Finvify is not intended for anyone under 18. If we detect an account belonging to a minor, we will close it and delete its data, except data we must keep by law.
10. Security
We apply appropriate technical and organisational measures, such as encrypted connections, access controls and activity logs, to protect your data against loss, alteration or unauthorised access.
11. Changes
If we make significant changes to this policy, we will let you know by email or with a notice on the Platform.
For any legal or data protection question, write to us at finvify@gmail.com.