Privacy policy

Data controller

[Company name, address]. Contact about your data: [email address]. [Data protection officer, if any.]

Data processed and purposes

• Account: email address, role, username — to create and secure your account (performance of the contract).
• Identity and age: status of the Didit verification (verified, pending, declined), its date and the Didit session ID — legal obligation to restrict the service to adults. The ID document and selfie are processed by Didit; Shootik does not keep them.
• Profile, posts, messages, reviews, collaborations: to provide the service.
• “STI test up to date” mention (optional): a simple box you tick yourself on your profile, publicly visible while ticked. No document is sent or stored; the mention is not verified by Shootik and does not count towards the trust score. You can untick it at any time.
• Payment: handled by Verotel (Netherlands), which collects the subscription; we never see your card numbers and only receive the subscription status.
• Security and moderation: reports, moderation decisions, hashed IP addresses — legitimate interest and legal obligations.
• News emails: only with your consent, which you can withdraw at any time.
• Homepage (creators, optional): if you tick “Appear on the homepage”, your profile photo may be shown there, blurred, with no name or link to your profile, to visitors who are not signed in. Legal basis: your consent, which you can withdraw at any time in “Edit my profile”; withdrawal takes effect the next time the page loads.

Processors

[Application host], [database host], [file storage], [email provider], Verotel (payment, Netherlands), Didit (identity and age verification, “Verified identity” badge), Sightengine (automatic analysis of uploaded photos to detect nudity and possibly underage faces; the provider does not keep images for its own purposes — to be checked in its data processing agreement), Pusher (real time), Google (sign-in, if you choose it). [For each, state the hosting country and, outside the EU, the transfer safeguards.]

Retention periods

• Account data: for as long as the account exists, then erased within 24 hours of deletion.
• Moderation log: [duration] from the decision, as a technical identifier, to handle appeals and legal requests.
• Invoices: 10 years (accounting obligation), kept by Verotel and [accounting provider].

Your rights

You can access your data, download it, correct it, delete it, object to certain processing and withdraw your consent. Download and deletion are available directly in “My account”. For any other request: [email address]. You can also contact the CNIL (cnil.fr), the French data protection authority.

Cookies

Shootik only uses cookies that are necessary for the site to work (sign-in session, age verification, language). No advertising or third-party analytics cookies. [To be adapted if an analytics tool is added.]