Privacy Policy
Last updated: March 2026
1. Who We Are and How to Contact Us
TribuShare is operated by SYLOE GROUP, SAS, registered in France (SIREN 898 633 409), with its registered office at 1 rue Albert Camus, 95130 Le Plessis-Bouchard, France. SYLOE GROUP, SAS is the data controller for personal data processed in connection with the operation of the TribuShare Service.
| Data Controller | SYLOE GROUP, SAS — 1 rue Albert Camus, 95130 Le Plessis-Bouchard, France |
| Privacy enquiries | privacy@tribushare.com |
| Data subject rights | privacy@tribushare.com — response within 30 days |
| Supervisory authority | CNIL — 3 place de Fontenoy, 75007 Paris — www.cnil.fr |
2. Scope and Application
This Privacy Policy applies to personal data collected and processed by SYLOE GROUP, SAS through the TribuShare platform, including the website (tribushare.com), web and mobile applications, APIs, and all related services. It applies to all Users: Viewers, Creators, and Partners.
This Privacy Policy does not apply to the personal data of Viewers collected by Creators through their distribution activity on TribuShare. In that context, the Creator is the data controller and TribuShare acts as data processor — governed by Data Processing Addendum.
TribuShare operates primarily within the European Union and is subject to GDPR (Regulation (EU) 2016/679). Where TribuShare processes data of individuals in other jurisdictions, TribuShare complies with applicable local data protection law to the extent required.
3. Personal Data We Collect
3.1 Data You Provide Directly
- Account registration: name, email address, password (hashed), country of residence, language preference
- Creator Account additional data: legal name or business name, tax identification number, payment account details (IBAN or equivalent), billing address
- Partner Account additional data: promotional channel information, website or social media URL
- Payment data: credit/debit card details and payment instrument data processed by Stripe (TribuShare does not store card numbers — Stripe acts as independent data controller for payment data)
- Communications: content of messages sent to TribuShare support, legal@tribushare.com, or privacy@tribushare.com
- UGC: reviews, comments, forum posts, and live event chat messages submitted through the Service
- Content metadata: for Creators, film titles, descriptions, cast/crew information, and territorial availability settings uploaded to the Service
3.2 Data Collected Automatically
- Usage data: pages visited, features used, content viewed, search queries, referral source, session duration
- Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution
- Streaming data: playback events (start, pause, completion), buffering events, viewing duration, and quality metrics — used for service optimisation and Creator analytics
- Transaction data: purchase history, ticket purchases, donation amounts, referral conversions
- Log data: server access logs, error logs, security event logs — retained for a maximum of 6 months
- Cookies and tracking data: as described in Section 6
3.3 Data from Third Parties
- Payment confirmation and fraud signals from Stripe
- Social login data where you choose to authenticate via a third-party identity provider (Google, Apple, etc.) — limited to the data you authorise that provider to share
- Partner tracking data: click and conversion events generated through Partner Links, used for Commission attribution
4. How We Use Your Personal Data — Legal Bases
TribuShare processes personal data only where a valid legal basis under GDPR Art. 6 applies. Each processing activity has a single designated legal basis.
| Processing Activity | Legal Basis (GDPR Art. 6) | Retention Period | Primary Processor |
|---|---|---|---|
| Account creation and management | Contract (Art. 6.1.b) | Duration of Account + 3 years | Neon DB (EU region) + application layer |
| Payment processing and billing | Contract (Art. 6.1.b) | Duration + 10 years (accounting) | Stripe Inc. (DPF certified) |
| Content delivery and streaming | Contract (Art. 6.1.b) | Duration of access period | Gumlet / Cloudflare CDN |
| Creator Revenue Share calculation and disbursement | Contract (Art. 6.1.b) | Duration + 10 years (accounting) | TribuShare / Stripe |
| Partner Commission tracking and payment | Contract (Art. 6.1.b) | Duration + 3 years | TribuShare Tracking System |
| Customer support and legal correspondence | Legitimate interests (Art. 6.1.f) | 3 years from last interaction | Support CRM (EU-hosted) |
| Fraud detection and platform security | Legitimate interests (Art. 6.1.f) | 6 months (logs) / 3 years (fraud cases) | TribuShare / Cloudflare |
| Service analytics and performance optimisation | Legitimate interests (Art. 6.1.f) or Consent | 13 months maximum | PostHog |
| Transactional email notifications | Contract (Art. 6.1.b) | 3 years | Brevo |
| Marketing newsletter (opt-in) | Consent (Art. 6.1.a) | Until consent withdrawn | Brevo |
| Tax and regulatory compliance | Legal obligation (Art. 6.1.c) | 10 years | TribuShare accounting |
| Technical server and security logs | Legitimate interests (Art. 6.1.f) | 6 months | Hosting provider (EU) |
| Creator audience analytics (aggregate) | Legitimate interests (Art. 6.1.f) | 13 months | PostHog / TribuShare |
| Viewing status tracking (not started / in progress / completed) for withdrawal right determination | Legitimate interests (Art. 6.1.f) | Duration of access period + 3 years (statute of limitations) | TribuShare application layer |
| DRM and watermark attribution | Legitimate interests (Art. 6.1.f) | Duration of content availability + 3 years | Gumlet DRM / TribuShare |
| Marketplace tax calculation and collection (VAT/GST/sales tax on Viewer purchases) | Legal obligation (Art. 6.1.c) — EU OSS registration + applicable marketplace facilitator laws | 10 years (tax record retention requirement) | Stripe Tax / TribuShare |
| DAC7 platform operator reporting — Creator (seller) revenue reporting to tax authorities | Legal obligation (Art. 6.1.c) — EU Directive 2021/514 (DAC7), applicable from threshold | 10 years | TribuShare accounting / SYLOE GROUP |
| Content rating declaration storage (Creator-declared rating per film) | Contract (Art. 6.1.b) — required for platform operation and legal compliance | Duration of Content availability + 5 years (legal record) | TribuShare / Neon DB |
| Internal AI content assessment score (platform-generated, not disclosed to Creator) | Legitimate interests (Art. 6.1.f) — platform safety, AVMSD compliance, regulatory defensibility | Duration of Content availability + 5 years | TribuShare (internal only — not shared with Creator or third parties) |
Legitimate interests pursued by TribuShare include: operating a secure and functional service; preventing fraud and abuse; improving the platform based on usage patterns; and enforcing our Terms of Service. Where legitimate interests are relied upon, TribuShare has conducted a balancing test confirming that these interests are not overridden by the data subjects' rights and freedoms.
5. Who We Share Your Data With
5.1 Sub-Processors (Service Providers)
TribuShare uses the following third-party service providers who process personal data on TribuShare's behalf. A Data Processing Agreement (DPA) is in place or in progress with each provider. DPA reference URLs are provided for transparency and can be verified independently.
| Provider | Purpose | Location | Transfer Basis | DPA URL |
|---|---|---|---|---|
| Stripe, Inc. | Payments & Stripe Connect | US (DPF certified) | EU-US DPF + SCCs | stripe.com/legal/dpa |
| Neon, Inc. | Primary PostgreSQL DB — all user & transaction data | US (EU region: eu-central-1) | DPF + SCCs + UK Addendum + SOC 2 Type 2 | neon.tech/partnerdpa |
| Gumlet | Video streaming, encoding, CDN | Global (EU primary) | SCCs | support@gumlet.com |
| Cloudflare, Inc. | CDN, DDoS, security proxy | Global (EU primary) | SCCs | cloudflare.com/cloudflare-customer-dpa |
| Brevo (Sendinblue) | Email: transactional & newsletter | EU (France) | EU — no transfer | CGU Brevo — section DPA |
| PostHog (EU cloud) | Product analytics | EU (eu-central-1) | EU — no transfer | posthog.com/dpa |
| Sentry (Functional Software, Inc.) | Error monitoring and performance tracking | US (DPF certified) | EU-US DPF + SCCs | sentry.io/legal/dpa |
DPF = EU-US Data Privacy Framework. SCC = EU Standard Contractual Clauses (Commission Decision 2021/914). SOC 2 = independent annual security audit. TribuShare notifies users within 30 days of any sub-processor change. Full list: privacy@tribushare.com.
5.2 Creators — Access to Viewer Data and Joint Controllership
Creators have access to aggregated and anonymised audience analytics for their Content through the Creator Dashboard (e.g., total views, geographic distribution, engagement metrics). Creators do not have access to individually identifiable Viewer data (names, email addresses, payment details) unless the Viewer has explicitly consented to share their contact information with the Creator through the platform's opt-in mechanism.
Where a Viewer purchases access to a Creator's Content or registers for a Creator's live event, TribuShare may share the Viewer's email address with the Creator solely for the purpose of delivering that specific purchase or event — and only where this is necessary to fulfil the service. This processing is governed by the Creator's own privacy policy and the Creator's obligations as data controller under Data Processing Addendum.
Where a Viewer opts in to a Creator's marketing newsletter at account creation, TribuShare and the Creator act as joint controllers within the meaning of GDPR Art. 26 with respect to that email address at the point of transfer. TribuShare collects the email as controller for account management purposes; upon opt-in confirmation, TribuShare transfers the email to the Creator's designated email platform (Brevo, Mailchimp, or equivalent). From the point of transfer, the Creator becomes the sole data controller for that email address for marketing purposes. The Creator is solely responsible for operating their newsletter in compliance with applicable e-privacy and anti-spam law (including EU opt-in requirements).
5.3 Legal Disclosure
TribuShare may disclose personal data to law enforcement authorities, regulatory bodies, or courts where required by applicable law, court order, or regulatory instruction. TribuShare will endeavour to notify the affected User in advance where legally permitted. TribuShare will not disclose personal data in response to informal requests from law enforcement without a formal legal mandate.
5.4 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of TribuShare's assets, personal data held by TribuShare may be transferred to the acquiring entity as part of the transaction, subject to equivalent data protection safeguards and notification to affected Users.
5.5 No Sale of Personal Data
TribuShare does not sell, rent, or trade personal data to third parties for their own marketing or commercial purposes. TribuShare does not allow third-party advertisers to target Users on the basis of their TribuShare activity.
6. Cookies and Tracking Technologies
6.1 What We Use
TribuShare uses cookies, local storage, and similar tracking technologies to operate the Service and, where you have consented, to analyse usage and improve the platform.
| Category | Can be disabled? | Purpose |
|---|---|---|
| Strictly necessary | No — required for Service to function | Authentication, session management, security, payment processing, streaming DRM |
| Functional | Yes — via consent banner | Language preference, playback settings, Creator dashboard state |
| Analytics | Yes — via consent banner | Usage statistics, performance monitoring, error tracking (PostHog where consented) |
| Partner tracking | Yes — via consent banner (affects Commission attribution) | Attribution of referral traffic to Partner Links for Commission calculation |
6.2 Managing Your Preferences
At your first visit, a consent management banner allows you to accept or decline non-essential cookies. The banner provides equally prominent "Accept All" and "Reject All" options, in compliance with CNIL recommendations (2020, updated 2022). You may change your preferences at any time via the cookie settings link in the footer of the Service. Consent is valid for a maximum of 13 months, after which your preferences will be requested again. For detailed information about the specific cookies used on the Service, including their names, providers, and durations, please see our Cookie Policy.
7. Your Rights
If you are located in the European Union or European Economic Area, you benefit from the following rights under GDPR. TribuShare will respond to all valid requests within 30 days of receipt. Where a request is complex or numerous, the response period may be extended by a further 60 days with notice to you. All standard requests are free of charge.
| Right | What it means in practice |
|---|---|
| Access (Art. 15) | Request a copy of all personal data TribuShare holds about you, including processing purposes and retention periods. |
| Rectification (Art. 16) | Request correction of inaccurate personal data. Update most data directly through your Account settings. |
| Erasure (Art. 17) | Request deletion of your personal data where: (i) it is no longer necessary for the purpose it was collected; (ii) you withdraw consent and no other basis applies; (iii) you object to processing and no overriding legitimate interest exists. Note: TribuShare may retain data where required by legal obligation (e.g., accounting records). |
| Restriction (Art. 18) | Request that TribuShare restrict processing of your data pending resolution of an objection or accuracy dispute. |
| Portability (Art. 20) | Receive your personal data in a structured, commonly used, machine-readable format (CSV or JSON) for data processed by automated means on the basis of contract or consent. |
| Objection (Art. 21) | Object to processing based on legitimate interests. TribuShare will cease processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms. |
| Withdraw Consent (Art. 7.3) | Withdraw consent for any processing based on consent (e.g., marketing emails, analytics cookies) at any time, without affecting the lawfulness of processing before withdrawal. |
| Lodge a complaint | Lodge a complaint with the CNIL (France) or the supervisory authority of your EU country of residence, at any time, regardless of whether you have first raised the matter with TribuShare. |
8. International Data Transfers
TribuShare is based in France and processes data primarily within the European Union. Some sub-processors operate globally or in the United States. Where personal data is transferred outside the European Economic Area (EEA), TribuShare ensures that appropriate safeguards are in place:
- EU-US Data Privacy Framework (DPF) — for US-based processors certified under the DPF (including Stripe and Google)
- EU Standard Contractual Clauses (SCCs) — the 2021 Commission SCCs, incorporated into DPAs with processors in non-adequate countries
- Adequacy decisions — where the European Commission has determined that the destination country provides an adequate level of protection
TribuShare does not transfer personal data to countries without an applicable transfer mechanism. The sub-processor list in Section 5.1 identifies the transfer mechanism applicable to each provider. You may request a copy of the relevant SCCs by contacting privacy@tribushare.com.
9. Data Security
TribuShare implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:
- Encryption of personal data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
- Access controls: role-based access, least-privilege principles, multi-factor authentication for administrative access
- Regular automated backups with 90-day retention
- Security monitoring: intrusion detection, anomaly alerting, and regular vulnerability scanning
- Secure software development practices including code review and dependency auditing
- DRM protection for all streamed Content to prevent unauthorised copying
No system can guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, TribuShare will notify the CNIL within 72 hours of becoming aware of the breach, and will notify affected Users without undue delay where the risk to their rights is high.
10. Minors
The Service is intended for individuals aged 18 and over. TribuShare does not knowingly collect personal data from individuals under the age of 18. If TribuShare becomes aware that personal data has been collected from a minor without appropriate parental consent, TribuShare will delete such data promptly. If you believe that a minor's data has been collected, please contact privacy@tribushare.com immediately.
11. Changes to This Privacy Policy
TribuShare may update this Privacy Policy from time to time to reflect changes in the law, our data processing activities, or our services. Material changes will be notified by email and by a prominent notice on the Service at least 30 days before taking effect. The effective date is displayed at the top of this document.