Privacy Policy
Last updated: September 2026 (version 2026-09-30)
1. Who We Are and How to Contact Us
TribuShare is operated by SYLOE GROUP, SAS, registered in France (SIREN 898 633 409), with its registered office at 1 rue Albert Camus, 95130 Le Plessis-Bouchard, France. SYLOE GROUP, SAS is the data controller for personal data processed in connection with the operation of the TribuShare Service.
| Data Controller | SYLOE GROUP, SAS, 1 rue Albert Camus, 95130 Le Plessis-Bouchard, France |
| Privacy enquiries | privacy@tribushare.com |
| Data subject rights | privacy@tribushare.com, response within 30 days |
| Supervisory authority | CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr |
2. Scope and Application
This Privacy Policy applies to personal data collected and processed by SYLOE GROUP, SAS through the TribuShare platform, including the website (tribushare.com), film pages, company pages and storefronts (including storefronts served on a Creator's own domain), APIs, and all related services. It applies to all Users: Viewers, Creators and film participants.
TribuShare is the data controller for personal data of Viewers processed in connection with a purchase, being the seller of record of that purchase. Creators are controllers only for personal data TribuShare transfers to them and which they then use for their own purposes; where TribuShare processes personal data solely on a Creator's documented instructions, it acts as processor, governed by the Data Processing Addendum.
TribuShare operates primarily within the European Union and is subject to GDPR (Regulation (EU) 2016/679). Where TribuShare processes data of individuals in other jurisdictions, TribuShare complies with applicable local data protection law to the extent required.
This Privacy Policy is available in English, French and Spanish. Each language version is equally valid.
3. Personal Data We Collect
3.1 Data You Provide Directly
- Account registration: name and email address, and a password (hashed) if you choose one; you can also sign in with a one-time code sent by email or with Google
- Creator Account additional data: organization name, company page details, billing details for the film plan; the identity, tax and bank details needed for payouts are collected by Stripe during payout onboarding
- Film participants: company name and email address given by the Creator; the participant's identity, tax and bank details are collected by Stripe during payout onboarding
- Payment data: credit/debit card details and payment instrument data processed by Stripe (TribuShare does not store card numbers; Stripe acts as independent data controller for payment data)
- Communications: content of messages sent to TribuShare support (including through the TribuShare contact form, whose messages are also sent to the team's Discord as a notification), legal@tribushare.com, or privacy@tribushare.com
- UGC: messages sent through the contact forms of film pages and storefronts
- Follows and news preferences: the films and Creators you follow, your consent to receive their news, and your email preferences
- Dashboard assistant: for Creators, the messages, documents and images they give the assistant
- Content metadata: for Creators, film titles, descriptions, cast/crew information, and territorial availability settings uploaded to the Service
3.2 Data Collected Automatically
- Usage data: pages visited, features used, content viewed, search queries, referral source, session duration
- Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution
- Streaming data: playback events (start, pause, completion), buffering events, viewing duration, and quality metrics, used for service optimisation and Creator analytics
- Transaction data: purchases, rentals and gifts, Share & Earn credit and the purchases made through your links
- Audience measurement: pages viewed, referrer, device, and the country and city derived from your IP address, recorded without a cookie under a daily rotating hash of your IP address and browser, and kept for 365 days
- Error diagnostics: technical details of errors (page, browser, account identifier) are sent to Sentry to help fix them; if you accept analytics cookies, a replay of the last moments of the page is also sent when an error occurs, with the text and media on the page masked
- Email engagement: Brevo records whether the emails TribuShare sends are delivered, opened and clicked; these events are also counted per campaign in PostHog, without your email address
- Log data: server access logs, error logs, security event logs, retained for a maximum of 6 months
- Cookies and tracking data: as described in Section 6
3.3 Data from Third Parties
- Payment confirmation and fraud signals from Stripe
- Sign-in data where you choose to authenticate with Google, limited to the data you authorise Google to share (name, email address, profile picture)
- Share & Earn attribution: the personal link a visitor arrived from, used to credit Share & Earn rewards
4. How We Use Your Personal Data: Legal Bases
TribuShare processes personal data only where a valid legal basis under GDPR Art. 6 applies. Each processing activity has a single designated legal basis.
| Processing Activity | Legal Basis (GDPR Art. 6) | Retention Period | Primary Processor |
|---|---|---|---|
| Processing ActivityAccount creation and management | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration of Account + 3 years | Primary ProcessorNeon (AWS London region) + application layer |
| Processing ActivityPayment processing and billing | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration + 10 years (accounting) | Primary ProcessorStripe Inc. (DPF certified) |
| Processing ActivityContent delivery and streaming | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration of access period | Primary ProcessorCloudflare (storage and delivery) / AWS (video encoding) |
| Processing ActivityCreator Revenue Share calculation and disbursement | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration + 10 years (accounting) | Primary ProcessorTribuShare / Stripe |
| Processing ActivityShare & Earn credit and referral rewards | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration + 3 years | Primary ProcessorTribuShare |
| Processing ActivitySharing buyer, gift recipient and follower contact details with the Creator concerned (Section 5.2) | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) for buyers and gift recipients; Consent (Art. 6.1.a) for followers | Retention PeriodUntil the Creator deletes its copy | Primary ProcessorTribuShare / the Creator |
| Processing ActivityCustomer support and legal correspondence | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention Period3 years from last interaction | Primary ProcessorSupport mailbox; Discord for contact form notifications |
| Processing ActivityFraud detection and platform security | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention Period6 months (logs) / 3 years (fraud cases) | Primary ProcessorTribuShare / Cloudflare |
| Processing ActivityService analytics and performance optimisation | Legal Basis (GDPR Art. 6)Consent (Art. 6.1.a) for analytics cookies and identification; Legitimate interests (Art. 6.1.f) for cookieless measurement when you decline | Retention Period13 months maximum | Primary ProcessorPostHog |
| Processing ActivityFirst-party audience measurement (page views, referrer, device, country and city) | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention Period365 days | Primary ProcessorTribuShare / Neon |
| Processing ActivityError monitoring | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention PeriodSentry's retention period | Primary ProcessorSentry |
| Processing ActivityReplay of the page when an error occurs, with text and media masked | Legal Basis (GDPR Art. 6)Consent (Art. 6.1.a), given with analytics cookies | Retention PeriodSentry's retention period | Primary ProcessorSentry |
| Processing ActivityTransactional email notifications | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention Period3 years | Primary ProcessorBrevo |
| Processing ActivityMarketing newsletters (opt-in): Tribushare Friday, and What's new on Tribushare for organization members, who can switch it on in their account settings (off by default) | Legal Basis (GDPR Art. 6)Consent (Art. 6.1.a) | Retention PeriodUntil consent withdrawn | Primary ProcessorBrevo |
| Processing ActivityNews from the films and Creators you follow | Legal Basis (GDPR Art. 6)Consent (Art. 6.1.a) | Retention PeriodUntil you unfollow or unsubscribe | Primary ProcessorBrevo |
| Processing ActivityAI features: describing and tagging uploaded images; the dashboard assistant for Creators | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b) | Retention PeriodDuration of Account | Primary ProcessorCloudflare AI Gateway and the AI model provider it routes to |
| Processing ActivityTax and regulatory compliance | Legal Basis (GDPR Art. 6)Legal obligation (Art. 6.1.c) | Retention Period10 years | Primary ProcessorTribuShare accounting |
| Processing ActivityTechnical server and security logs | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention Period6 months | Primary ProcessorCloudflare / Sentry |
| Processing ActivityCreator audience analytics (aggregate) | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention Period13 months | Primary ProcessorPostHog / TribuShare |
| Processing ActivityViewing status tracking (not started / in progress / completed) for withdrawal right determination | Legal Basis (GDPR Art. 6)Legitimate interests (Art. 6.1.f) | Retention PeriodDuration of access period + 3 years (statute of limitations) | Primary ProcessorTribuShare application layer |
| Processing ActivityMarketplace tax calculation and collection (VAT/GST/sales tax on Viewer purchases) | Legal Basis (GDPR Art. 6)Legal obligation (Art. 6.1.c): EU OSS registration and applicable marketplace facilitator laws | Retention Period10 years (tax record retention requirement) | Primary ProcessorStripe Tax / TribuShare |
| Processing ActivityDAC7 platform operator reporting, Creator revenue reporting to tax authorities | Legal Basis (GDPR Art. 6)Legal obligation (Art. 6.1.c): EU Directive 2021/514 (DAC7), applicable from threshold | Retention Period10 years | Primary ProcessorTribuShare accounting / SYLOE GROUP |
| Processing ActivityContent rating declaration storage (Creator-declared rating per film) | Legal Basis (GDPR Art. 6)Contract (Art. 6.1.b): required for platform operation and legal compliance | Retention PeriodDuration of Content availability + 5 years (legal record) | Primary ProcessorTribuShare / Neon DB |
Legitimate interests pursued by TribuShare include: operating a secure and functional service; preventing fraud and abuse; improving the platform based on usage patterns; and enforcing our Terms of Service. Where legitimate interests are relied upon, TribuShare has conducted a balancing test confirming that these interests are not overridden by the data subjects' rights and freedoms.
5. Who We Share Your Data With
5.1 Sub-Processors (Service Providers)
TribuShare uses the following third-party service providers who process personal data on TribuShare's behalf. A Data Processing Agreement (DPA) is in place or in progress with each provider. DPA reference URLs are provided for transparency and can be verified independently.
| Provider | Purpose | Location | Transfer Basis | DPA URL |
|---|---|---|---|---|
| ProviderStripe, Inc. | PurposePayments & Stripe Connect | LocationUS (DPF certified) | Transfer BasisEU-US DPF + SCCs | DPA URLstripe.com/legal/dpa |
| ProviderNeon, Inc. | PurposePrimary PostgreSQL database: all user and transaction data | LocationUnited Kingdom (AWS London, eu-west-2) | Transfer BasisUK adequacy decision; DPF + SCCs for the US parent | DPA URLneon.tech/partnerdpa |
| ProviderAmazon Web Services | PurposeVideo encoding (AWS Batch) | LocationEU (Paris, eu-west-3) | Transfer BasisEU hosting; DPF + SCCs for the US parent | DPA URLaws.amazon.com/compliance/gdpr-center |
| ProviderCloudflare, Inc. | PurposeApplication hosting (Workers), CDN, R2 storage, video delivery, image resizing, AI Gateway, DDoS and security | LocationGlobal (EU primary) | Transfer BasisSCCs | DPA URLcloudflare.com/cloudflare-customer-dpa |
| ProviderBrevo (Sendinblue) | PurposeEmail: transactional, news from the films you follow, newsletter | LocationEU (France) | Transfer BasisEU, no transfer | DPA URLCGU Brevo, section DPA |
| ProviderPostHog (EU cloud) | PurposeProduct analytics | LocationEU (eu-central-1) | Transfer BasisEU, no transfer | DPA URLposthog.com/dpa |
| ProviderSentry (Functional Software, Inc.) | PurposeError monitoring, performance tracking and error replays | LocationEU (Germany) | Transfer BasisEU hosting; DPF + SCCs for the US parent | DPA URLsentry.io/legal/dpa |
| ProviderUpstash, Inc. | PurposeRate limiting (including IP addresses) and short-lived sign-in tokens | LocationGlobal | Transfer BasisSCCs | DPA URLAvailable on request |
| ProviderAI model provider | PurposeImage description and tagging; dashboard assistant for Creators, reached through Cloudflare AI Gateway | LocationUS | Transfer BasisSCCs | DPA URLAvailable on request |
| ProviderDiscord, Inc. | PurposeInternal team notifications: messages sent through the TribuShare contact form (name, email address, message), and platform activity with email addresses masked | LocationUS | Transfer BasisSCCs | DPA URLAvailable on request |
DPF = EU-US Data Privacy Framework. SCC = EU Standard Contractual Clauses (Commission Decision 2021/914). SOC 2 = independent annual security audit. TribuShare notifies users within 30 days of any sub-processor change. Full list: privacy@tribushare.com.
5.2 Creators, Access to Viewer Data
Creators have access to audience analytics for their Content through the Creator Dashboard (e.g., sales, visitors, geographic distribution, engagement metrics). They do not have access to payment details.
TribuShare shares with the Creator concerned the name and email address of the Viewers who follow its films or its company page, including through the opt-in offered at checkout, and whether they have bought. On storefronts, the Creator can also see and export the name and email address of the Viewers who buy, rent or receive access to its films. The Creator can export these lists and sync its followers to its own email tool (such as Brevo or Mailchimp). From the moment it receives this data, the Creator is an independent data controller for its own copy and is solely responsible for using it in compliance with applicable data protection, e-privacy and anti-spam law (including EU opt-in requirements for marketing).
News that a Creator sends to its followers through TribuShare is sent by TribuShare, from TribuShare's own email service, and every such email lets you unsubscribe in one click.
A Creator may also add a Meta Pixel or a Google tag to its storefront. These tags load only if you accept Advertising cookies in the cookie banner, and only on that storefront's account, purchase, gift, library, legal and watch pages; they then send page views, checkout and purchase events from that storefront to Meta or Google, which process them under their own terms.
5.3 Legal Disclosure
TribuShare may disclose personal data to law enforcement authorities, regulatory bodies, or courts where required by applicable law, court order, or regulatory instruction. TribuShare will endeavour to notify the affected User in advance where legally permitted. TribuShare will not disclose personal data in response to informal requests from law enforcement without a formal legal mandate.
5.4 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of TribuShare's assets, personal data held by TribuShare may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection safeguards and notification to affected Users.
5.5 No Sale of Personal Data
TribuShare does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. TribuShare does not allow third-party advertisers to target Users on the basis of their TribuShare activity.
6. Cookies and Tracking Technologies
6.1 What We Use
TribuShare uses cookies, local storage, and similar tracking technologies to operate the Service and, where you have consented, to analyse usage and improve the platform.
| Category | Can be disabled? | Purpose |
|---|---|---|
| CategoryStrictly necessary | Can be disabled?No, required for the Service to function | PurposeAuthentication, session management, security, payment processing |
| CategoryFunctional | Can be disabled?Yes, via the consent banner | PurposeCreator dashboard display state and the last dashboard you opened |
| CategoryAnalytics | Can be disabled?Yes, via the consent banner | PurposeUsage statistics with PostHog cookies, identification of signed-in users, campaign attribution, error replays (when declined, PostHog measures without cookies and without identifying you) |
| CategoryShare & Earn | Can be disabled?Yes, via the consent banner (without consent, the link you arrived from is not remembered) | PurposeRemembering for 30 days the Share & Earn or share link you arrived from, to credit the person who shared it |
| CategoryAdvertising | Can be disabled?Yes, via the consent banner | PurposeMeta Pixel or Google tag added by a Creator to its storefront, measuring visits and purchases for its advertising |
6.2 Managing Your Preferences
At your first visit, a consent management banner allows you to accept or decline non-essential cookies. The banner provides equally prominent "Accept All" and "Reject All" options, in compliance with CNIL recommendations (2020, updated 2022). You may change your preferences at any time via the "Cookie preferences" link in the footer of the Service. Your choice is kept for 12 months, after which your preferences will be requested again. For detailed information about the specific cookies used on the Service, including their names, providers, and durations, please see our Cookie Policy.
7. Your Rights
If you are located in the European Union or European Economic Area, you benefit from the following rights under GDPR. TribuShare will respond to all valid requests within 30 days of receipt. Where a request is complex or numerous, the response period may be extended by a further 60 days with notice to you. All standard requests are free of charge.
| Right | What it means in practice |
|---|---|
| RightAccess (Art. 15) | What it means in practiceRequest a copy of all personal data TribuShare holds about you, including processing purposes and retention periods. |
| RightRectification (Art. 16) | What it means in practiceRequest correction of inaccurate personal data. Update most data directly through your Account settings. |
| RightErasure (Art. 17) | What it means in practiceRequest deletion of your personal data where: (i) it is no longer necessary for the purpose it was collected; (ii) you withdraw consent and no other basis applies; (iii) you object to processing and no overriding legitimate interest exists. Note: TribuShare may retain data where required by legal obligation (e.g., accounting records). |
| RightRestriction (Art. 18) | What it means in practiceRequest that TribuShare restrict processing of your data pending resolution of an objection or accuracy dispute. |
| RightPortability (Art. 20) | What it means in practiceReceive your personal data in a structured, commonly used, machine-readable format (CSV or JSON) for data processed by automated means on the basis of contract or consent. |
| RightObjection (Art. 21) | What it means in practiceObject to processing based on legitimate interests. TribuShare will cease processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms. |
| RightWithdraw Consent (Art. 7.3) | What it means in practiceWithdraw consent for any processing based on consent (e.g., marketing emails, analytics cookies) at any time, without affecting the lawfulness of processing before withdrawal. |
| RightLodge a complaint | What it means in practiceLodge a complaint with the CNIL (France) or the supervisory authority of your EU country of residence, at any time, regardless of whether you have first raised the matter with TribuShare. |
7.1 Deleting Your Account
You can delete your Account yourself in your account settings, unless you own an organization, hold a balance of earnings, or are an active film participant; in those cases, contact privacy@tribushare.com. When you delete your Account, TribuShare erases or anonymises: your name, email address and picture; your sign-in sessions and linked sign-in methods; your dashboard assistant chats and the prompts they contain; your comments and the IP address recorded with them; your playback positions and Share & Earn settings; the email address on your checkout attempts, form submissions, contact form messages, reports, notifications and gift orders received; the email events and invitations sent to your address; your follows and newsletter subscriptions; and the contact records Creators hold for you on TribuShare. Any Share & Earn credit is forfeited. Your page views and analytics events are unlinked from your Account and deleted after 365 days. In an organization you do not own, you then appear as "Deleted user".
TribuShare keeps, and why:
- Because the law requires it: purchases, gift orders, the earnings ledger and film participations (accounting and tax records); your acceptances of the Terms, the Creator Agreement and the Participant Payout Terms, and the IP address and browser recorded with your consent at checkout (proof of consent and of contract)
- For legitimate interests: security audit records; a suppression entry so that your opt-outs keep being honoured; the reports you submitted, without your email address; and the consent records of past follows, as proof of consent for emails already sent
- Records that no longer identify you: AI usage counts per organization, video view counts used for revenue reporting, and your Share & Earn link code
- With Stripe: your Stripe customer record, under Stripe's own retention rules
Contacts that a Creator has already synced to its own email tool (such as Brevo or Mailchimp) are held by that Creator as an independent data controller: ask the Creator to delete them.
8. International Data Transfers
TribuShare is based in France and processes data primarily within the European Union. Some sub-processors operate globally or in the United States. Where personal data is transferred outside the European Economic Area (EEA), TribuShare ensures that appropriate safeguards are in place:
- EU-US Data Privacy Framework (DPF): for US-based processors certified under the DPF (including Stripe and Google)
- EU Standard Contractual Clauses (SCCs): the 2021 Commission SCCs, incorporated into DPAs with processors in non-adequate countries
- Adequacy decisions: where the European Commission has determined that the destination country provides an adequate level of protection
TribuShare does not transfer personal data to countries without an applicable transfer mechanism. The sub-processor list in Section 5.1 identifies the transfer mechanism applicable to each provider. You may request a copy of the relevant SCCs by contacting privacy@tribushare.com.
9. Data Security
TribuShare implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
- Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
- Access controls: role-based access, least-privilege principles, multi-factor authentication for administrative access
- Regular automated backups with 90-day retention
- Security monitoring: intrusion detection, anomaly alerting, and regular vulnerability scanning
- Secure software development practices including code review and dependency auditing
- Encryption of video files when they are encoded; the decryption key and the video links, which expire, are given only to signed-in Viewers who hold access
No system can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, TribuShare will notify the CNIL within 72 hours of becoming aware of the breach, and will notify affected Users without undue delay where the risk to their rights is high.
10. Minors
The Service is intended for individuals aged 18 and over. TribuShare does not knowingly collect personal data from individuals under the age of 18. If TribuShare becomes aware that personal data has been collected from a minor without appropriate parental consent, TribuShare will delete such data promptly. If you believe that a minor's data has been collected, please contact privacy@tribushare.com immediately.
11. Changes to This Privacy Policy
TribuShare may update this Privacy Policy from time to time to reflect changes in the law, our data processing activities, or our services. Material changes will be notified by email and by a prominent notice on the Service at least 30 days before taking effect. The effective date is displayed at the top of this document.